Please sign in to comment.
[2.7] bpo-29136: Add TLS 1.3 cipher suites and OP_NO_TLSv1_3 (GH-1363) (
#3446) * bpo-29136: Add TLS 1.3 support TLS 1.3 introduces a new, distinct set of cipher suites. The TLS 1.3 cipher suites don't overlap with cipher suites from TLS 1.2 and earlier. Since Python sets its own set of permitted ciphers, TLS 1.3 handshake will fail as soon as OpenSSL 1.1.1 is released. Let's enable the common AES-GCM and ChaCha20 suites. Additionally the flag OP_NO_TLSv1_3 is added. It defaults to 0 (no op) with OpenSSL prior to 1.1.1. This allows applications to opt-out from TLS 1.3 now. Signed-off-by: Christian Heimes <email@example.com>. (cherry picked from commit cb5b68a)
- Loading branch information...
Showing with 73 additions and 2 deletions.
- +27 −1 Doc/library/ssl.rst
- +7 −1 Lib/ssl.py
- +25 −0 Lib/test/test_ssl.py
- +1 −0 Misc/NEWS.d/next/Library/2017-09-04-16-39-49.bpo-29136.vSn1oR.rst
- +13 −0 Modules/_ssl.c
|@@ -0,0 +1 @@|
|Add TLS 1.3 cipher suites and OP_NO_TLSv1_3.|