Skip to content

bpo-32008: Prefer client or TLSv1_2 in examples #5797

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
matrixise merged 3 commits into from
Sep 12, 2019
Merged

bpo-32008: Prefer client or TLSv1_2 in examples #5797

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
d76d329
bpo-32008: Prefer client or TLSv1_2 in examples
tiran Feb 21, 2018
f1373bd
bpo-32008: address review comments
tiran Sep 10, 2019
c70452d
More reviews
tiran Sep 11, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
bpo-32008: address review comments
  • Loading branch information
@tiran
tiran committed Sep 10, 2019
commit f1373bd213997b935f1c5fcdf02cfbd23491791f
16 changes: 10 additions & 6 deletions Doc/library/ssl.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,6 +130,7 @@ purposes.
:meth:`SSLContext.load_verify_locations`. If all three are
:const:`None`, this function can choose to trust the system's default
CA certificates instead.
CA certificates instead.

@benjaminp benjaminp Sep 11, 2019

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

mistake?


The settings are: :data:`PROTOCOL_TLS`, :data:`OP_NO_SSLv2`, and
:data:`OP_NO_SSLv3` with high encryption cipher suites without RC4 and
Expand Down Expand Up @@ -2226,13 +2227,16 @@ right)::
certificates in ``/etc/ssl/certs/ca-bundle.crt``; if not, you'll get an
error and have to adjust the location)

The :data:`PROTOCOL_TLS_CLIENT` protocol configures the context for cert
validation and hostname verification. :attr:`~SSLContext.verify_mode` is
set to :data:`CERT_REQUIRED` and :attr:`~SSLContext.check_hostname` is set
to ``True``. All other protocols create SSL contexts with insecure defaults.

When you use the context to connect to a server, :const:`CERT_REQUIRED`
validates the server certificate and :meth:`~SSLContext.check_hostname`
matches the hostname. Both setting ensure that the server certificate
was signed with one of the CA certificates and is a valid certificate
for the given server name. The :data:`PROTOCOL_TLS_CLIENT` protocol
configures the context for cert and hostname verification. All
remaining protocols are insecure by default::
and :attr:`~SSLContext.check_hostname` validate the server certificate: it
ensures that the server certificate was signed with one of the CA
certificates, checks the signature for correctness, and verifies other
properties like validity and identity of the host::

@benjaminp benjaminp Sep 11, 2019

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should be hostname I think


>>> conn = context.wrap_socket(socket.socket(socket.AF_INET),
... server_hostname="www.python.org")
Expand Down