Check_hostname error, for Http.requestUrl()

[supergeoff]

Http.requestUrl() result in error:
ValueError: check_hostname requires server_hostname
If targeting Python with python_version>=3.4 flag.
Ssl.context created in python.net.SslSocket uses SERVER_AUTH by default, it sets
context.verify_mode to CERT_REQUIRED and context.check_hostname to True.

Several infos i found in python.net.SslSocket

package python.net;

import python.lib.Ssl;
import python.lib.socket.Socket as PSocket;
import python.lib.ssl.Purpose;

class SslSocket extends sys.net.Socket {
	var hostName:String;

	override function __initSocket():Void {
		#if (python_version >= 3.4)
		var context = Ssl.create_default_context(Purpose.SERVER_AUTH);
		#else
		// hopefully these options are good enough
		var context = new python.lib.ssl.SSLContext(Ssl.PROTOCOL_SSLv23);
		context.verify_mode = Ssl.CERT_REQUIRED;
		context.set_default_verify_paths();
		context.options |= Ssl.OP_NO_SSLv2;
		context.options |= Ssl.OP_NO_SSLv3;
		context.options |= Ssl.OP_NO_COMPRESSION;
		#end
		context.options |= Ssl.OP_NO_TLSv1 #if (python_version >= 3.4) | Ssl.OP_NO_TLSv1_1 #end; // python 3.4 | Ssl.OP_NO_TLSv1_1;
		__s = new PSocket();
		__s = context.wrap_socket(__s, false, true, true, this.hostName);
	}
}

I'm guessing it has to do with REST API that requires CLIENT side certificate authentication.

My thoughts (Keep in mind I'm a beginner and I do not understand much of TLS encryption stuff...)

Add a flag in the Http.requestUrl() to specify the side of authentication.
Set the value of hostname that seems to be lost somewhere?

Also:

Disable check_hostname solve the issue...
Set Purpose.CLIENT_AUTH for create_default_context solve the issue...

Is it an issue related to Haxe? Is it an issue related to Python, is it an issue with how I use the Http.requestUrl stuff?

Best regards;

[RealyUniqueName]

To me it looks like an issue of the python target.

[theJenix]

I just ran into this in Haxe 4.2.5 and traced it down to an issue with the order in which the various sockets/ssl methods are called. I just issued a pull request for a fix; happy to adjust it as needed to make that fix acceptable.