SSLContext
- SSLContext(protocol=None)
Deprecated since 3.10. SSLContext without protocol argument is deprecated. The context class will either require PROTOCOL_TLS_CLIENT or PROTOCOL_TLS_SERVER protocol in the future.
An SSLContext holds various SSL-related configuration options and data, such as certificates and possibly a private key.
© Python Software Foundation. PSF License Version 2 · Official docs ↗
Changed in 3.6, 3.10
- 3.6: The context is created with secure default values. The options OP_NO_COMPRESSION, OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE, OP_SINGLE_ECDH_USE, OP_NO_SSLv2, and OP_NO_SSLv3 (except for PROTOCOL_SSLv3) are set by default. The initial cipher suite list contains only HIGH ciphers, no NULL ciphers and no MD5 ciphers.
- 3.10: The default cipher suites now include only secure AES and ChaCha20 ciphers with forward secrecy and security level 2. RSA and DH keys with less than 2048 bits and ECC keys with less than 224 bits are prohibited. PROTOCOL_TLS, PROTOCOL_TLS_CLIENT, and PROTOCOL_TLS_SERVER use TLS 1.2 as minimum TLS version.
Members of SSLContext
c
- cert_store_stats
- Returns quantities of loaded X.509 certificates.
- check_hostname
- Whether to match the peer cert’s hostname in SSLSocket.do_handshake().
g
- get_ca_certs
- Returns a list of dicts with information of loaded CA certs.
- get_ciphers
- Get a list of enabled ciphers.
- get_groups
- Get a list of groups implemented for key agreement, taking into account the current TLS minimum_version and maximum_version values.
h
- hostname_checks_common_name
- Whether check_hostname falls back to verify the cert’s subject common name in the absence of a subject alternative name extension (default: true).
k
- keylog_filename
- Write TLS keys to a keylog file, whenever key material is generated or received.
l
- load_cert_chain
- Load a private key and the corresponding certificate.
- load_default_certs
- Load a set of default “certification authority” (CA) certificates from default locations.
- load_dh_params
- Load the key generation parameters for Diffie-Hellman (DH) key exchange.
- load_verify_locations
- Load a set of “certification authority” (CA) certificates used to validate other peers’ certificates when verify_mode is other than CERT_NONE.
m
- maximum_version
- A TLSVersion enum member representing the highest supported TLS version.
- minimum_version
- Like SSLContext.maximum_version except it is the lowest supported version or TLSVersion.MINIMUM_SUPPORTED.
n
- num_tickets
- Control the number of TLSv1.3 session tickets.
o
- options
- An integer representing the set of SSL options enabled on this context.
p
- post_handshake_auth
- Enable TLS 1.3 post-handshake client authentication.
- protocol
- The protocol version chosen when constructing the context.
s
- security_level
- The current security level.
- session_stats
- Get statistics about the SSL sessions created or managed by this context.
- set_alpn_protocols
- Specify which protocols the socket should advertise during the SSL/TLS handshake.
- set_ciphers
- Set the allowed ciphers for sockets created with this context when connecting using TLS 1.2 and earlier.
- set_ciphersuites
- Set the allowed ciphers for sockets created with this context when connecting using TLS 1.3.
- set_client_sigalgs
- Set the signature algorithms allowed for certificate-based client authentication.
- set_default_verify_paths
- Load a set of default “certification authority” (CA) certificates from a filesystem path defined when building the OpenSSL library.
- set_ecdh_curve
- Set the curve name for Elliptic Curve-based Diffie-Hellman (ECDH) key exchange.
- set_groups
- Set the groups allowed for key agreement for sockets created with this context.
- set_npn_protocols
- Specify which protocols the socket should advertise during the SSL/TLS handshake.
- set_psk_client_callback
- Enables TLS-PSK (pre-shared key) authentication on a client-side connection.
- set_psk_server_callback
- Enables TLS-PSK (pre-shared key) authentication on a server-side connection.
- set_server_sigalgs
- Set the signature algorithms allowed for the server to complete the TLS handshake.
- set_servername_callback
- This is a legacy API retained for backwards compatibility.
- sni_callback
- Set a callback that will be called when a server name is provided by the SSL/TLS client in the SNI extension.
- sslobject_class
- This class implements an interface on top of a low-level SSL object as implemented by OpenSSL.
- sslsocket_class
- This class implements a subtype of socket.socket that wraps the underlying OS socket in an SSL context when necessary, and provides read and write methods over that channel.
v
- verify_flags
- The flags for certificate verification operations.
- verify_mode
- Whether to try to verify other peers’ certificates and how to behave if verification fails.
w
- wrap_bio
- Wrap the BIO objects incoming and outgoing and return an instance of SSLContext.sslobject_class (default SSLObject).
- wrap_socket
- Wrap an existing Python socket sock and return an instance of SSLContext.sslsocket_class (default SSLSocket).
