nss.ssl¶
This module implements the SSL functionality in NSS
SSL Version Range API¶
This API should be used to control SSL 3.0 & TLS support instead of the older SSLSocket.set_ssl_option() API; however, SSLSocket.set_ssl_option() API MUST still be used to control SSL 2.0 support. In this version of libssl, SSL 3.0 and TLS 1.0 are enabled by default. Future versions of libssl may change which versions of the protocol are enabled by default.
The protocol_variant enums (SSL_VARIANT_STREAM, SSL_VARIANT_DATAGRAM) indicates whether the protocol is of type stream or datagram. This must be provided to the functions that do not take an fd. Functions which take an fd will get the variant from the fd.
Using the new version range API in conjunction with the older SSLSocket.set_ssl_option() API for controlling the enabled protocol versions may cause unexpected results. Going forward, we guarantee only the following:
SSLSocket.get_ssl_option(ssl.SSL_ENABLE_TLS)
will return True if
ANY versions of TLS are enabled.
SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, False)
will disable
ALL versions of TLS, including TLS 1.0 and later.
The above two properties provide compatibility for applications that use SSLSocket.set_ssl_option() to implement the insecure fallback from TLS 1.x to SSL 3.0.
SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True)
will enable TLS
1.0, and may also enable some later versions of TLS, if it is
necessary to do so in order to keep the set of enabled versions
contiguous. For example, if TLS 1.2 is enabled, then after
SSLSocket.set_ssl_option(ss.SSL_ENABLE_TLS, True)
, TLS 1.0, TLS
1.1, and TLS 1.2 will be enabled, and the call will have no effect on
whether SSL 3.0 is enabled. If no later versions of TLS are enabled at
the time SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True)
is
called, then no later versions of TLS will be enabled by the call.
SSLSocket.set_ssl_option(ssl.SSL_ENABLE_SSL3, False)
will disable
SSL 3.0, and will not change the set of TLS versions that are enabled.
SSLSocket.set_ssl_option(ssl.SSL_ENABLE_SSL3, True)
will enable SSL
3.0, and may also enable some versions of TLS if TLS 1.1 or later is
enabled at the time of the call, the same way
SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True)
works, in order
to keep the set of enabled versions contiguous.
Functions
|
You must call ssl.clear_session_cache() after you use one of the SSL Export Policy Functions to change cipher suite policy settings or use ssl.set_default_cipher_pref() to enable or disable any cipher suite. |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Get the configured maximum number of mutexes used for the server's store of SSL sessions. |
|
Gets the default value of a specified SSL option for all subsequently opened sockets as long as the current application program is running. |
|
|
|
|
|
set_cipher_pref(cipher, enabled) |
|
set_cipher_pref(cipher, enabled) |
|
|
|
Configures cipher suites to conform with current U.S. |
|
Configures the SSL cipher suites to conform with current U.S. |
|
Configures the SSL cipher suites to conform with French import regulations related to software products with encryption features. |
|
|
|
Changes the default value of a specified SSL option for all subsequently opened sockets as long as the current application program is running. |
|
|
|
|
|
|
|
|
|
Classes
|
SSLChannelInformation(obj) |
|
SSLCipherSuiteInformation(obj) |
|