ssl

not WASI

This module provides some more Pythonic support for SSL.

Object types:

  SSLSocket -- subtype of socket.socket which does SSL over the socket

Exceptions:

  SSLError -- exception raised for I/O errors

Functions:

  get_sigalgs          -- return a list of all available TLS signature
                          algorithms (requires OpenSSL 3.4 or later)

  cert_time_to_seconds -- convert time string used for certificate
                          notBefore and notAfter functions to integer
                          seconds past the Epoch (the time values
                          returned from time.time())

  get_server_certificate (addr, ssl_version, ca_certs, timeout) -- Retrieve the
                          certificate from the server at the specified
                          address and return it as a PEM-encoded string


Integer constants:

SSL_ERROR_ZERO_RETURN
SSL_ERROR_WANT_READ
SSL_ERROR_WANT_WRITE
SSL_ERROR_WANT_X509_LOOKUP
SSL_ERROR_SYSCALL
SSL_ERROR_SSL
SSL_ERROR_WANT_CONNECT

SSL_ERROR_EOF
SSL_ERROR_INVALID_ERROR_CODE

The following group define certificate requirements that one side is
allowing/requiring from the other side:

CERT_NONE - no certificates from the other side are required (or will
            be looked at if provided)
CERT_OPTIONAL - certificates are not required, but if provided will be
                validated, and if validation fails, the connection will
                also fail
CERT_REQUIRED - certificates are required, and will be validated, and
                if validation fails, the connection will also fail

The following constants identify various SSL protocol variants:

PROTOCOL_SSLv2
PROTOCOL_SSLv3
PROTOCOL_SSLv23
PROTOCOL_TLS
PROTOCOL_TLS_CLIENT
PROTOCOL_TLS_SERVER
PROTOCOL_TLSv1
PROTOCOL_TLSv1_1
PROTOCOL_TLSv1_2

The following constants identify various SSL alert message descriptions as per
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6

ALERT_DESCRIPTION_CLOSE_NOTIFY
ALERT_DESCRIPTION_UNEXPECTED_MESSAGE
ALERT_DESCRIPTION_BAD_RECORD_MAC
ALERT_DESCRIPTION_RECORD_OVERFLOW
ALERT_DESCRIPTION_DECOMPRESSION_FAILURE
ALERT_DESCRIPTION_HANDSHAKE_FAILURE
ALERT_DESCRIPTION_BAD_CERTIFICATE
ALERT_DESCRIPTION_UNSUPPORTED_CERTIFICATE
ALERT_DESCRIPTION_CERTIFICATE_REVOKED
ALERT_DESCRIPTION_CERTIFICATE_EXPIRED
ALERT_DESCRIPTION_CERTIFICATE_UNKNOWN
ALERT_DESCRIPTION_ILLEGAL_PARAMETER
ALERT_DESCRIPTION_UNKNOWN_CA
ALERT_DESCRIPTION_ACCESS_DENIED
ALERT_DESCRIPTION_DECODE_ERROR
ALERT_DESCRIPTION_DECRYPT_ERROR
ALERT_DESCRIPTION_PROTOCOL_VERSION
ALERT_DESCRIPTION_INSUFFICIENT_SECURITY
ALERT_DESCRIPTION_INTERNAL_ERROR
ALERT_DESCRIPTION_USER_CANCELLED
ALERT_DESCRIPTION_NO_RENEGOTIATION
ALERT_DESCRIPTION_UNSUPPORTED_EXTENSION
ALERT_DESCRIPTION_CERTIFICATE_UNOBTAINABLE
ALERT_DESCRIPTION_UNRECOGNIZED_NAME
ALERT_DESCRIPTION_BAD_CERTIFICATE_STATUS_RESPONSE
ALERT_DESCRIPTION_BAD_CERTIFICATE_HASH_VALUE
ALERT_DESCRIPTION_UNKNOWN_PSK_IDENTITY

Symbols in ssl

a

ALERT_DESCRIPTION_HANDSHAKE_FAILURE: Alert Descriptions from RFC 5246 and others.
ALERT_DESCRIPTION_INTERNAL_ERROR: Alert Descriptions from RFC 5246 and others.
AlertDescription: An enumeration.

c

CERT_NONE: Possible value for SSLContext.verify_mode.
CERT_OPTIONAL: Possible value for SSLContext.verify_mode.
CERT_REQUIRED: Possible value for SSLContext.verify_mode.
cert_time_to_seconds: Return the time in seconds since the Epoch, given the timestring representing the "notBefore" or "notAfter" date from a certificate in ``"%b %d %H:%M:%S %Y %Z"`` strptime format (C locale).
CertificateError: A certificate could not be verified.
CHANNEL_BINDING_TYPES: List of supported TLS channel binding types.
create_default_context: Create a SSLContext object with default settings.

d

DER_cert_to_PEM_cert: Takes a certificate in binary DER format and returns the PEM version of it as a string.

e

enum_certificates: Retrieve certificates from Windows’ system cert store.
enum_crls: Retrieve CRLs from Windows’ system cert store.

g

get_default_verify_paths: Return paths to default cafile and capath.
get_server_certificate: Retrieve the certificate from the server at the specified address, and return it as a PEM-encoded string.
get_sigalgs: Return a list of available TLS signature algorithm names used by servers to complete the TLS handshake or clients requesting certificate-based authentication.

h

HAS_ALPN: Whether the OpenSSL library has built-in support for the Application-Layer Protocol Negotiation TLS extension as described in RFC 7301.
HAS_ECDH: Whether the OpenSSL library has built-in support for the Elliptic Curve-based Diffie-Hellman key exchange.
HAS_NEVER_CHECK_COMMON_NAME: Whether the OpenSSL library has built-in support not checking subject common name and SSLContext.hostname_checks_common_name is writeable.
HAS_NPN: Whether the OpenSSL library has built-in support for the Next Protocol Negotiation as described in the Application Layer Protocol Negotiation.
HAS_PHA: Whether the OpenSSL library has built-in support for TLS-PHA.
HAS_PSK: Whether the OpenSSL library has built-in support for TLS-PSK.
HAS_PSK_TLS13: Whether the OpenSSL library has built-in support for External PSKs in TLS 1.3 as described in RFC 9258.
HAS_SNI: Whether the OpenSSL library has built-in support for the Server Name Indication extension (as defined in RFC 6066).
HAS_SSLv2: Whether the OpenSSL library has built-in support for the SSL 2.0 protocol.
HAS_SSLv3: Whether the OpenSSL library has built-in support for the SSL 3.0 protocol.
HAS_TLSv1: Whether the OpenSSL library has built-in support for the TLS 1.0 protocol.
HAS_TLSv1_1: Whether the OpenSSL library has built-in support for the TLS 1.1 protocol.
HAS_TLSv1_2: Whether the OpenSSL library has built-in support for the TLS 1.2 protocol.
HAS_TLSv1_3: Whether the OpenSSL library has built-in support for the TLS 1.3 protocol.

m

MemoryBIO: A memory buffer that can be used to pass data between Python and an SSL protocol instance.

o

OP_ALL: Enables workarounds for various bugs present in other SSL implementations.
OP_CIPHER_SERVER_PREFERENCE: Use the server’s cipher ordering preference, rather than the client’s.
OP_ENABLE_KTLS: Enable the use of the kernel TLS.
OP_ENABLE_MIDDLEBOX_COMPAT: Send dummy Change Cipher Spec (CCS) messages in TLS 1.3 handshake to make a TLS 1.3 connection look more like a TLS 1.2 connection.
OP_IGNORE_UNEXPECTED_EOF: Ignore unexpected shutdown of TLS connections.
OP_LEGACY_SERVER_CONNECT: Allow legacy insecure renegotiation between OpenSSL and unpatched servers only.
OP_NO_COMPRESSION: Disable compression on the SSL channel.
OP_NO_RENEGOTIATION: Disable all renegotiation in TLSv1.2 and earlier.
OP_NO_SSLv2: Prevents an SSLv2 connection.
OP_NO_SSLv3: Prevents an SSLv3 connection.
OP_NO_TICKET: Prevent client side from requesting a session ticket.
OP_NO_TLSv1: Prevents a TLSv1 connection.
OP_NO_TLSv1_1: Prevents a TLSv1.1 connection.
OP_NO_TLSv1_2: Prevents a TLSv1.2 connection.
OP_NO_TLSv1_3: Prevents a TLSv1.3 connection.
OP_SINGLE_DH_USE: Prevents reuse of the same DH key for distinct SSL sessions.
OP_SINGLE_ECDH_USE: Prevents reuse of the same ECDH key for distinct SSL sessions.
OPENSSL_VERSION: The version string of the OpenSSL library loaded by the interpreter:
OPENSSL_VERSION_INFO: A tuple of five integers representing version information about the OpenSSL library:
OPENSSL_VERSION_NUMBER: The raw version number of the OpenSSL library, as a single integer:
Options: An enumeration.

p

PEM_cert_to_DER_cert: Takes a certificate in ASCII PEM format and returns the DER-encoded version of it as a byte sequence
PROTOCOL_SSLv23: Alias for PROTOCOL_TLS.
PROTOCOL_SSLv3: Selects SSL version 3 as the channel encryption protocol.
PROTOCOL_TLS: Selects the highest protocol version that both the client and server support.
PROTOCOL_TLS_CLIENT: Auto-negotiate the highest protocol version that both the client and server support, and configure the context client-side connections.
PROTOCOL_TLS_SERVER: Auto-negotiate the highest protocol version that both the client and server support, and configure the context server-side connections.
PROTOCOL_TLSv1: Selects TLS version 1.0 as the channel encryption protocol.
PROTOCOL_TLSv1_1: Selects TLS version 1.1 as the channel encryption protocol.
PROTOCOL_TLSv1_2: Selects TLS version 1.2 as the channel encryption protocol.
Purpose.CLIENT_AUTH: Option for create_default_context() and SSLContext.load_default_certs().
Purpose.SERVER_AUTH: Option for create_default_context() and SSLContext.load_default_certs().

r

RAND_add: Mix string into the OpenSSL PRNG state.
RAND_bytes: Generate n cryptographically strong pseudo-random bytes.
RAND_status: Returns True if the OpenSSL PRNG has been seeded with enough data and False if not.

s

SSLCertVerificationError: A certificate could not be verified.
SSLContext: An SSLContext holds various SSL-related configuration options and data, such as certificates and possibly a private key.
SSLEOFError: SSL/TLS connection terminated abruptly.
SSLError: An error occurred in the SSL implementation.
SSLErrorNumber: An enumeration.
SSLObject: This class implements an interface on top of a low-level SSL object as implemented by OpenSSL.
SSLSession: Session object used by session.
SSLSocket: This class implements a subtype of socket.socket that wraps the underlying OS socket in an SSL context when necessary, and provides read and write methods over that channel.
SSLSyscallError: System error when attempting SSL operation.
SSLWantReadError: Non-blocking SSL socket needs to read more data before the requested operation can be completed.
SSLWantWriteError: Non-blocking SSL socket needs to write more data before the requested operation can be completed.
SSLZeroReturnError: SSL/TLS session closed cleanly.

t

TLSVersion: An enumeration.

v

VERIFY_ALLOW_PROXY_CERTS: Possible value for SSLContext.verify_flags to enables proxy certificate verification.
VERIFY_CRL_CHECK_CHAIN: Possible value for SSLContext.verify_flags.
VERIFY_CRL_CHECK_LEAF: Possible value for SSLContext.verify_flags.
VERIFY_DEFAULT: Possible value for SSLContext.verify_flags.
VERIFY_X509_PARTIAL_CHAIN: Possible value for SSLContext.verify_flags.
VERIFY_X509_STRICT: Possible value for SSLContext.verify_flags to disable workarounds for broken X.509 certificates.
VERIFY_X509_TRUSTED_FIRST: Possible value for SSLContext.verify_flags.
VerifyFlags: An enumeration.
VerifyMode: An enumeration.

PyDocs

Networking and Interprocess Communication

Networking and Interprocess Communication

All modules

ssl

Symbols in ssl

a

c

d

e

g

h

m

o

p

r

s

t

v