nss.ssl

This module implements the SSL functionality in NSS

SSL Version Range API

This API should be used to control SSL 3.0 & TLS support instead of the older SSLSocket.set_ssl_option() API; however, SSLSocket.set_ssl_option() API MUST still be used to control SSL 2.0 support. In this version of libssl, SSL 3.0 and TLS 1.0 are enabled by default. Future versions of libssl may change which versions of the protocol are enabled by default.

The protocol_variant enums (SSL_VARIANT_STREAM, SSL_VARIANT_DATAGRAM) indicates whether the protocol is of type stream or datagram. This must be provided to the functions that do not take an fd. Functions which take an fd will get the variant from the fd.

Using the new version range API in conjunction with the older SSLSocket.set_ssl_option() API for controlling the enabled protocol versions may cause unexpected results. Going forward, we guarantee only the following:

SSLSocket.get_ssl_option(ssl.SSL_ENABLE_TLS) will return True if ANY versions of TLS are enabled.

SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, False) will disable ALL versions of TLS, including TLS 1.0 and later.

The above two properties provide compatibility for applications that use SSLSocket.set_ssl_option() to implement the insecure fallback from TLS 1.x to SSL 3.0.

SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True) will enable TLS 1.0, and may also enable some later versions of TLS, if it is necessary to do so in order to keep the set of enabled versions contiguous. For example, if TLS 1.2 is enabled, then after SSLSocket.set_ssl_option(ss.SSL_ENABLE_TLS, True), TLS 1.0, TLS 1.1, and TLS 1.2 will be enabled, and the call will have no effect on whether SSL 3.0 is enabled. If no later versions of TLS are enabled at the time SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True) is called, then no later versions of TLS will be enabled by the call.

SSLSocket.set_ssl_option(ssl.SSL_ENABLE_SSL3, False) will disable SSL 3.0, and will not change the set of TLS versions that are enabled.

SSLSocket.set_ssl_option(ssl.SSL_ENABLE_SSL3, True) will enable SSL 3.0, and may also enable some versions of TLS if TLS 1.1 or later is enabled at the time of the call, the same way SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True) works, in order to keep the set of enabled versions contiguous.

Functions

clear_session_cache()

You must call ssl.clear_session_cache() after you use one of the SSL Export Policy Functions to change cipher suite policy settings or use ssl.set_default_cipher_pref() to enable or disable any cipher suite.

config_mp_server_sid_cache([...])

config_server_session_id_cache([...])

config_server_session_id_cache_with_opt([...])

get_cipher_policy(cipher)

get_cipher_suite_info(suite)

get_default_cipher_pref(cipher)

get_default_ssl_version_range([...])

get_max_server_cache_locks()

Get the configured maximum number of mutexes used for the server's store of SSL sessions.

get_ssl_default_option(value)

Gets the default value of a specified SSL option for all subsequently opened sockets as long as the current application program is running.

get_ssl_version_from_major_minor(major, minor)

get_supported_ssl_version_range([...])

set_cipher_policy

set_cipher_pref(cipher, enabled)

set_default_cipher_pref

set_cipher_pref(cipher, enabled)

set_default_ssl_version_range(min_version, ...)

set_domestic_policy()

Configures cipher suites to conform with current U.S.

set_export_policy()

Configures the SSL cipher suites to conform with current U.S.

set_france_policy()

Configures the SSL cipher suites to conform with French import regulations related to software products with encryption features.

set_max_server_cache_locks(max_locks)

set_ssl_default_option(option, value)

Changes the default value of a specified SSL option for all subsequently opened sockets as long as the current application program is running.

shutdown_server_session_id_cache()

ssl_cipher_suite_from_name(name)

ssl_cipher_suite_name(cipher)

ssl_library_version_from_name(name)

ssl_library_version_name(ssl_library_version)

Classes

SSLChannelInfo

SSLChannelInformation(obj)

SSLCipherSuiteInfo

SSLCipherSuiteInformation(obj)

SSLSocket([family, type])