use. Typically, the server chooses a particular protocol version, and the

client must adapt to the server's choice. Most of the versions are not

interoperable with the other versions. If not specified, the default is

versions.

Here's a table showing which versions in a client (down the side) can connect

.. table::

*SSLv2* yes no yes no no no

*SSLv3* no yes yes no no no

*TLSv1* no no yes yes no no

*TLSv1.1* no no yes no yes no

*TLSv1.2* no no yes no no yes

:const:`None`, this function can choose to trust the system's default

CA certificates instead.

:data:`OP_NO_SSLv3` with high encryption cipher suites without RC4 and

without unauthenticated cipher suites. Passing :data:`~Purpose.SERVER_AUTH`

as *purpose* sets :data:`~SSLContext.verify_mode` to :data:`CERT_REQUIRED`

.. versionadded:: 3.3

.. function:: RAND_status()

Return ``True`` if the SSL pseudo-random number generator has been seeded

See http://egd.sourceforge.net/ or http://prngd.sourceforge.net/ for sources

of entropy-gathering daemons.

.. function:: RAND_add(bytes, entropy)

previously. Return an integer (no fractions of a second in the

input format)

Given the address ``addr`` of an SSL-protected server, as a (*hostname*,

*port-number*) pair, fetches the server's certificate, and returns it as a

.. versionchanged:: 3.5

The default *ssl_version* is changed from :data:`PROTOCOL_SSLv3` to

.. function:: DER_cert_to_PEM_cert(DER_cert_bytes)

* :attr:`openssl_capath_env` - OpenSSL's environment key that points to a capath,

* :attr:`openssl_capath` - hard coded path to a capath directory

.. versionadded:: 3.4

.. function:: enum_certificates(store_name)

.. versionadded:: 3.4.4

Selects the highest protocol version that both the client and server support.

Despite the name, this option can select "TLS" protocols as well as "SSL".

.. data:: PROTOCOL_SSLv2

Selects SSL version 2 as the channel encryption protocol.

SSL version 2 is insecure. Its use is highly discouraged.

.. data:: PROTOCOL_SSLv3

Selects SSL version 3 as the channel encryption protocol.

SSL version 3 is insecure. Its use is highly discouraged.

.. data:: PROTOCOL_TLSv1

Selects TLS version 1.0 as the channel encryption protocol.

.. data:: PROTOCOL_TLSv1_1

Selects TLS version 1.1 as the channel encryption protocol.

Available only with openssl version 1.0.1+.

.. versionadded:: 3.4

.. data:: PROTOCOL_TLSv1_2

Selects TLS version 1.2 as the channel encryption protocol. This is the

.. versionadded:: 3.4

.. data:: OP_ALL

Enables workarounds for various bugs present in other SSL implementations.

.. data:: OP_NO_SSLv2

Prevents an SSLv2 connection. This option is only applicable in

choosing SSLv2 as the protocol version.

.. versionadded:: 3.2

.. data:: OP_NO_SSLv3

Prevents an SSLv3 connection. This option is only applicable in

choosing SSLv3 as the protocol version.

.. versionadded:: 3.2

.. data:: OP_NO_TLSv1

Prevents a TLSv1 connection. This option is only applicable in

choosing TLSv1 as the protocol version.

.. versionadded:: 3.2

.. data:: OP_NO_TLSv1_1

Prevents a TLSv1.1 connection. This option is only applicable in conjunction

the protocol version. Available only with openssl version 1.0.1+.

.. versionadded:: 3.4

.. data:: OP_NO_TLSv1_2

Prevents a TLSv1.2 connection. This option is only applicable in conjunction

the protocol version. Available only with openssl version 1.0.1+.

.. versionadded:: 3.4

It also manages a cache of SSL sessions for server-side sockets, in order

to speed up repeated connections from the same clients.

of the ``PROTOCOL_*`` constants defined in this module.

.. seealso::

:func:`create_default_context` lets the :mod:`ssl` module choose

security settings for a given purpose.

:class:`SSLContext` objects have the following methods and attributes:

This method will raise :exc:`NotImplementedError` if :data:`HAS_ALPN` is

False.

.. versionadded:: 3.5

.. method:: SSLContext.set_npn_protocols(protocols)

a context from scratch (but beware that you might not get the settings

right)::

SSL versions 2 and 3 are considered insecure and are therefore dangerous to

use. If you want maximum compatibility between clients and servers, it is

disable SSLv2 and SSLv3 explicitly using the :data:`SSLContext.options`

attribute::

supported by your system) connections.

Cipher selection

_IntEnum._convert(

'_SSLMethod', __name__,

source=_ssl)

_PROTOCOL_NAMES = {value: name for name, value in _SSLMethod.__members__.items()}

try:

__slots__ = ('protocol', '__weakref__')

_windows_cert_stores = ("CA", "ROOT")

self = _SSLContext.__new__(cls, protocol)

if protocol != _SSLv2_IF_EXISTS:

self.set_ciphers(_DEFAULT_CIPHERS)

return self

self.protocol = protocol

def wrap_socket(self, sock, server_side=False,

if not isinstance(purpose, _ASN1Object):

raise TypeError(purpose)

# SSLv2 considered harmful.

context.options |= OP_NO_SSLv2

context.load_default_certs(purpose)

return context

check_hostname=False, purpose=Purpose.SERVER_AUTH,

certfile=None, keyfile=None,

cafile=None, capath=None, cadata=None):

def __init__(self, sock=None, keyfile=None, certfile=None,

server_side=False, cert_reqs=CERT_NONE,

do_handshake_on_connect=True,

family=AF_INET, type=SOCK_STREAM, proto=0, fileno=None,

suppress_ragged_eofs=True, npn_protocols=None, ciphers=None,

def wrap_socket(sock, keyfile=None, certfile=None,

server_side=False, cert_reqs=CERT_NONE,

do_handshake_on_connect=True,

suppress_ragged_eofs=True,

ciphers=None):

d = pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)]

return base64.decodebytes(d.encode('ASCII', 'strict'))

"""Retrieve the certificate from the server at the specified address,