Function make_ssl_context

dns/query.py:1285–1315

Make an SSL context If *verify* is ``True``, the default, then certificate verification will occur using the standard CA roots. If *verify* is ``False``, then certificate verification will be disabled. If *verify* is a string which is a valid pathname, then if the pathname is a re

(
    verify: bool | str = True,
    check_hostname: bool = True,
    alpns: list[str] | None = None,
)

def make_ssl_context(
    verify: bool | str = True,
    check_hostname: bool = True,
    alpns: list[str] | None = None,
) -> ssl.SSLContext:
    """Make an SSL context

    If *verify* is ``True``, the default, then certificate verification will occur using
    the standard CA roots.  If *verify* is ``False``, then certificate verification will
    be disabled.  If *verify* is a string which is a valid pathname, then if the
    pathname is a regular file, the CA roots will be taken from the file, otherwise if
    the pathname is a directory roots will be taken from the directory.

    If *check_hostname* is ``True``, the default, then the hostname of the server must
    be specified when connecting and the server's certificate must authorize the
    hostname.  If ``False``, then hostname checking is disabled.

    *aplns* is ``None`` or a list of TLS ALPN (Application Layer Protocol Negotiation)
    strings to use in negotiation.  For DNS-over-TLS, the right value is `["dot"]`.
    """
    cafile, capath = dns._tls_util.convert_verify_to_cafile_and_capath(verify)
    ssl_context = ssl.create_default_context(cafile=cafile, capath=capath)
    # the pyright ignores below are because it gets confused between the
    # _no_ssl compatibility types and the real ones.
    ssl_context.minimum_version = ssl.TLSVersion.TLSv1_2  # type: ignore
    ssl_context.check_hostname = check_hostname
    if verify is False:
        ssl_context.verify_mode = ssl.CERT_NONE  # type: ignore
    if alpns is not None:
        ssl_context.set_alpn_protocols(alpns)
    return ssl_context  # type: ignore


# for backwards compatibility