see: https://cryptography.io/en/latest/faq/#starting-cryptography-using-mod-wsgi-produces-an-internalerror-during-a-call-in-register-osrandom-engine

kojihub imports koji, which imports some ssl libs, which in some environments can trigger a bug that raises an exception during that import. As explained in the link above, setting the WSGIApplicationGroup to %{GLOBAL} works around this.

hey @imcleod, I think this was the issue you were hitting a while back.

Actually, workaround not working as well as I initially thought. Looking for a better solution....

hey @imcleod, I think this was the issue you were hitting a while back.

Cheers. I remember. We both originally thought this was because I was, perhaps foolishly, attempting to run a full koji instance on a armv7 Cubietruck, but I later found myself getting the same issue when running the components on x86_64. I'll try to remember to follow this resolution.

Note that there are further problems with at least some versions of python-cryptography within Apache.
At least the version of cryptography in RHEL7.2 requires the seboolean httpd_execmem enabled, since the way it sets up handlers uses execmem.