enable more ssl socket options with get_server_certificate

[underrun]

BPO	18616
Nosy	@pitrou, @giampaolo, @tiran, @dstufft
Files	ssl_get_server_certificate_kwargs.patch

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = None
created_at = <Date 2013-08-01.15:56:02.888>
labels = ['extension-modules', 'type-feature', '3.7']
title = 'enable more ssl socket options with get_server_certificate'
updated_at = <Date 2016-09-08.14:55:00.955>
user = 'https://bugs.python.org/underrun'

bugs.python.org fields:

activity = <Date 2016-09-08.14:55:00.955>
actor = 'christian.heimes'
assignee = 'none'
closed = False
closed_date = None
closer = None
components = ['Extension Modules']
creation = <Date 2013-08-01.15:56:02.888>
creator = 'underrun'
dependencies = []
files = ['31111']
hgrepos = []
issue_num = 18616
keywords = ['patch']
message_count = 4.0
messages = ['194083', '205728', '217448', '275030']
nosy_count = 6.0
nosy_names = ['janssen', 'pitrou', 'giampaolo.rodola', 'christian.heimes', 'underrun', 'dstufft']
pr_nums = []
priority = 'normal'
resolution = None
stage = None
status = 'pending'
superseder = None
type = 'enhancement'
url = 'https://bugs.python.org/issue18616'
versions = ['Python 3.6', 'Python 3.7']

[underrun]

ssl.get_server_certificate does not allow advanced options like what ciphers to use (for ssl2 for instance) or SNI for virtual hosts with multiple ssl sites on one IP address.

Adding **kwargs enables any current and future SSLSocket options to be passed along to the underlying connection. wrap_socket doesn't include all the options (npn and sni for instance), so I use SSLSocket instead.

[underrun]

any thoughts on this? there's a lot of room for improvement in python ssl...

[pitrou]

To be frank, it's quite easy to open the connection and read the cert yourself, so I don't think complicating this API is very useful.
Still, I'm leaving this open so that other developers can chime in.

[tiran]

I would accept a patch that adds a ssl_context argument to get_server_certificate().