| 179 | self._certfile = certfile |
| 180 | |
| 181 | def _wrap_socket(self, sock): |
| 182 | if self._has_ssl_context: |
| 183 | if not self._custom_context: |
| 184 | self.ssl_context.verify_mode = self.cert_reqs |
| 185 | if self.certfile: |
| 186 | self.ssl_context.load_cert_chain(self.certfile, |
| 187 | self.keyfile) |
| 188 | if self.ciphers: |
| 189 | self.ssl_context.set_ciphers(self.ciphers) |
| 190 | if self.ca_certs: |
| 191 | self.ssl_context.load_verify_locations(self.ca_certs) |
| 192 | return self.ssl_context.wrap_socket( |
| 193 | sock, server_side=self._server_side, |
| 194 | server_hostname=self._server_hostname) |
| 195 | else: |
| 196 | ssl_opts = { |
| 197 | 'ssl_version': self._ssl_version, |
| 198 | 'server_side': self._server_side, |
| 199 | 'ca_certs': self.ca_certs, |
| 200 | 'keyfile': self.keyfile, |
| 201 | 'certfile': self.certfile, |
| 202 | 'cert_reqs': self.cert_reqs, |
| 203 | } |
| 204 | if self.ciphers: |
| 205 | if self._has_ciphers: |
| 206 | ssl_opts['ciphers'] = self.ciphers |
| 207 | else: |
| 208 | logger.warning( |
| 209 | 'ciphers is specified but ignored due to old Python version') |
| 210 | return ssl.wrap_socket(sock, **ssl_opts) |
| 211 | |
| 212 | |
| 213 | class TSSLSocket(TSocket.TSocket, TSSLBase): |