Create a SSLContext object with default settings. NOTE: The protocol and settings may change anytime without prior deprecation. The values represent a fair balance between maximum compatibility and security.
(purpose=Purpose.SERVER_AUTH, *, cafile=None,
capath=None, cadata=None)
| 743 | |
| 744 | |
| 745 | def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None, |
| 746 | capath=None, cadata=None): |
| 747 | """Create a SSLContext object with default settings. |
| 748 | |
| 749 | NOTE: The protocol and settings may change anytime without prior |
| 750 | deprecation. The values represent a fair balance between maximum |
| 751 | compatibility and security. |
| 752 | """ |
| 753 | if not isinstance(purpose, _ASN1Object): |
| 754 | raise TypeError(purpose) |
| 755 | |
| 756 | # SSLContext sets OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_COMPRESSION, |
| 757 | # OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE and OP_SINGLE_ECDH_USE |
| 758 | # by default. |
| 759 | if purpose == Purpose.SERVER_AUTH: |
| 760 | # verify certs and host name in client mode |
| 761 | context = SSLContext(PROTOCOL_TLS_CLIENT) |
| 762 | context.verify_mode = CERT_REQUIRED |
| 763 | context.check_hostname = True |
| 764 | elif purpose == Purpose.CLIENT_AUTH: |
| 765 | context = SSLContext(PROTOCOL_TLS_SERVER) |
| 766 | else: |
| 767 | raise ValueError(purpose) |
| 768 | |
| 769 | if cafile or capath or cadata: |
| 770 | context.load_verify_locations(cafile, capath, cadata) |
| 771 | elif context.verify_mode != CERT_NONE: |
| 772 | # no explicit cafile, capath or cadata but the verify mode is |
| 773 | # CERT_OPTIONAL or CERT_REQUIRED. Let's try to load default system |
| 774 | # root CA certificates for the given purpose. This may fail silently. |
| 775 | context.load_default_certs(purpose) |
| 776 | # OpenSSL 1.1.1 keylog file |
| 777 | if hasattr(context, 'keylog_filename'): |
| 778 | keylogfile = os.environ.get('SSLKEYLOGFILE') |
| 779 | if keylogfile and not sys.flags.ignore_environment: |
| 780 | context.keylog_filename = keylogfile |
| 781 | return context |
| 782 | |
| 783 | def _create_unverified_context(protocol=None, *, cert_reqs=CERT_NONE, |
| 784 | check_hostname=False, purpose=Purpose.SERVER_AUTH, |
nothing calls this directly
no test coverage detected