diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2014-04-16 18:56:28 +0200 |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2014-04-16 18:56:28 +0200 |
| commit | 94a5b663bf39a130fcd8b437aded6e7a7c396cff (patch) | |
| tree | 01b283bc5fdd84e1855aa20d6ac409197faf1173 | |
| parent | 0fba0c3ebfc8f5feed517783231bdff1e4a3e1a7 (diff) | |
| download | cpython-git-94a5b663bf39a130fcd8b437aded6e7a7c396cff.tar.gz | |
Issue #20896: ssl.get_server_certificate() now uses PROTOCOL_SSLv23, not PROTOCOL_SSLv3, for maximum compatibility.
| -rw-r--r-- | Doc/library/ssl.rst | 6 | ||||
| -rw-r--r-- | Lib/ssl.py | 2 | ||||
| -rw-r--r-- | Lib/test/test_ssl.py | 5 | ||||
| -rw-r--r-- | Misc/NEWS | 3 |
4 files changed, 10 insertions, 6 deletions
diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 94a0c81904..422cf569bb 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -387,7 +387,7 @@ Certificate handling >>> time.ctime(ssl.cert_time_to_seconds("May 9 00:00:00 2007 GMT")) 'Wed May 9 00:00:00 2007' -.. function:: get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None) +.. function:: get_server_certificate(addr, ssl_version=PROTOCOL_SSLv23, ca_certs=None) Given the address ``addr`` of an SSL-protected server, as a (*hostname*, *port-number*) pair, fetches the server's certificate, and returns it as a @@ -401,6 +401,10 @@ Certificate handling .. versionchanged:: 3.3 This function is now IPv6-compatible. + .. versionchanged:: 3.5 + The default *ssl_version* is changed from :data:`PROTOCOL_SSLv3` to + :data:`PROTOCOL_SSLv23` for maximum compatibility with modern servers. + .. function:: DER_cert_to_PEM_cert(DER_cert_bytes) Given a certificate as a DER-encoded blob of bytes, returns a PEM-encoded diff --git a/Lib/ssl.py b/Lib/ssl.py index d3c18ed1b7..d2be3ce5ac 100644 --- a/Lib/ssl.py +++ b/Lib/ssl.py @@ -922,7 +922,7 @@ def PEM_cert_to_DER_cert(pem_cert_string): d = pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)] return base64.decodebytes(d.encode('ASCII', 'strict')) -def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None): +def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv23, ca_certs=None): """Retrieve the certificate from the server at the specified address, and return it as a PEM-encoded string. If 'ca_certs' is specified, validate the server cert against it. diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 2b3de1f477..9f5bd09b99 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -1371,14 +1371,12 @@ class NetworkedTests(unittest.TestCase): def test_get_server_certificate(self): def _test_get_server_certificate(host, port, cert=None): with support.transient_internet(host): - pem = ssl.get_server_certificate((host, port), - ssl.PROTOCOL_SSLv23) + pem = ssl.get_server_certificate((host, port)) if not pem: self.fail("No server certificate on %s:%s!" % (host, port)) try: pem = ssl.get_server_certificate((host, port), - ssl.PROTOCOL_SSLv23, ca_certs=CERTFILE) except ssl.SSLError as x: #should fail @@ -1388,7 +1386,6 @@ class NetworkedTests(unittest.TestCase): self.fail("Got server certificate %s for %s:%s!" % (pem, host, port)) pem = ssl.get_server_certificate((host, port), - ssl.PROTOCOL_SSLv23, ca_certs=cert) if not pem: self.fail("No server certificate on %s:%s!" % (host, port)) @@ -50,6 +50,9 @@ Core and Builtins Library ------- +- Issue #20896: ssl.get_server_certificate() now uses PROTOCOL_SSLv23, not + PROTOCOL_SSLv3, for maximum compatibility. + - Issue #21239: patch.stopall() didn't work deterministically when the same name was patched more than once. |