Returns ``True`` if peercert is valid according to the configured validation mode and hostname. The ssl handshake already tested the certificate for a valid CA signature; the only thing that remains is to check the hostname.
(self, peercert: Any)
| 1445 | future_set_result_unless_cancelled(future, self) |
| 1446 | |
| 1447 | def _verify_cert(self, peercert: Any) -> bool: |
| 1448 | """Returns ``True`` if peercert is valid according to the configured |
| 1449 | validation mode and hostname. |
| 1450 | |
| 1451 | The ssl handshake already tested the certificate for a valid |
| 1452 | CA signature; the only thing that remains is to check |
| 1453 | the hostname. |
| 1454 | """ |
| 1455 | if isinstance(self._ssl_options, dict): |
| 1456 | verify_mode = self._ssl_options.get("cert_reqs", ssl.CERT_NONE) |
| 1457 | elif isinstance(self._ssl_options, ssl.SSLContext): |
| 1458 | verify_mode = self._ssl_options.verify_mode |
| 1459 | assert verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED, ssl.CERT_OPTIONAL) |
| 1460 | if verify_mode == ssl.CERT_NONE or self._server_hostname is None: |
| 1461 | return True |
| 1462 | cert = self.socket.getpeercert() |
| 1463 | if cert is None and verify_mode == ssl.CERT_REQUIRED: |
| 1464 | gen_log.warning("No SSL certificate given") |
| 1465 | return False |
| 1466 | try: |
| 1467 | ssl.match_hostname(peercert, self._server_hostname) |
| 1468 | except ssl.CertificateError as e: |
| 1469 | gen_log.warning("Invalid SSL certificate: %s" % e) |
| 1470 | return False |
| 1471 | else: |
| 1472 | return True |
| 1473 | |
| 1474 | def _handle_read(self) -> None: |
| 1475 | if self._ssl_accepting: |