Added some verification flags suggested by Julien Muchembled

zopefoundation · Jun 24, 2016 · 5727c7a · 5727c7a
1 parent fdfc924
commit 5727c7a
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/src/ZEO/zconfig.py b/src/ZEO/zconfig.py
@@ -1,6 +1,7 @@
 """SSL configuration support
 """
 import os
+import sys
 
 def ssl_config(section, server):
     import ssl
@@ -26,6 +27,10 @@ def ssl_config(section, server):
 
     context.verify_mode = ssl.CERT_REQUIRED
 
+    if sys.version_info >= (3, 4):
+        context.verify_flags |= ssl.VERIFY_X509_STRICT | (
+            context.cert_store_stats()['crl'] and ssl.VERIFY_CRL_CHECK_LEAF)
+
     if server:
         context.check_hostname = False
         return context