@@ -1701,13 +1701,15 @@ to speed up repeated connections from the same clients.
1701
1701
:meth: `~SSLContext.wrap_socket ` in order to match the hostname. Enabling
1702
1702
hostname checking automatically sets :attr: `~SSLContext.verify_mode ` from
1703
1703
:data: `CERT_NONE ` to :data: `CERT_REQUIRED `. It cannot be set back to
1704
- :data: `CERT_NONE ` as long as hostname checking is enabled.
1704
+ :data: `CERT_NONE ` as long as hostname checking is enabled. The
1705
+ :data: `PROTOCOL_TLS_CLIENT ` protocol enables hostname checking by default.
1706
+ With other protocols, hostname checking must be enabled explicitly.
1705
1707
1706
1708
Example::
1707
1709
1708
1710
import socket, ssl
1709
1711
1710
- context = ssl.SSLContext()
1712
+ context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2 )
1711
1713
context.verify_mode = ssl.CERT_REQUIRED
1712
1714
context.check_hostname = True
1713
1715
context.load_default_certs()
@@ -1952,19 +1954,20 @@ If you prefer to tune security settings yourself, you might create
1952
1954
a context from scratch (but beware that you might not get the settings
1953
1955
right)::
1954
1956
1955
- >>> context = ssl.SSLContext()
1956
- >>> context.verify_mode = ssl.CERT_REQUIRED
1957
- >>> context.check_hostname = True
1957
+ >>> context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
1958
1958
>>> context.load_verify_locations("/etc/ssl/certs/ca-bundle.crt")
1959
1959
1960
1960
(this snippet assumes your operating system places a bundle of all CA
1961
1961
certificates in ``/etc/ssl/certs/ca-bundle.crt ``; if not, you'll get an
1962
1962
error and have to adjust the location)
1963
1963
1964
1964
When you use the context to connect to a server, :const: `CERT_REQUIRED `
1965
- validates the server certificate: it ensures that the server certificate
1966
- was signed with one of the CA certificates, and checks the signature for
1967
- correctness::
1965
+ validates the server certificate and :meth: `~SSLContext.check_hostname `
1966
+ matches the hostname. Both setting ensure that the server certificate
1967
+ was signed with one of the CA certificates and is a valid certificate
1968
+ for the given server name. The :data: `PROTOCOL_TLS_CLIENT ` protocol
1969
+ configures the context for cert and hostname verification. All
1970
+ remaining protocols are insecure by default::
1968
1971
1969
1972
>>> conn = context.wrap_socket(socket.socket(socket.AF_INET),
1970
1973
... server_hostname="www.python.org")
0 commit comments