diff options
| author | stratakis <cstratak@redhat.com> | 2019-02-15 13:17:12 (GMT) |
|---|---|---|
| committer | Victor Stinner <vstinner@redhat.com> | 2019-02-15 13:17:12 (GMT) |
| commit | c49f63c1761ce03df7850b9e0b31a18c432dac64 (patch) | |
| tree | d0ae2fa232a81a69c71f1c2fbfe842d2c09c127a /Doc | |
| parent | 826a8b708165796151ad4135b0ddbd79da6d39f1 (diff) | |
| download | cpython-c49f63c1761ce03df7850b9e0b31a18c432dac64.zip cpython-c49f63c1761ce03df7850b9e0b31a18c432dac64.tar.gz cpython-c49f63c1761ce03df7850b9e0b31a18c432dac64.tar.bz2 | |
[2.7] bpo-33570: TLS 1.3 ciphers for OpenSSL 1.1.1 (GH-6976) (GH-8760) (GH-10607)
Change TLS 1.3 cipher suite settings for compatibility with OpenSSL
1.1.1-pre6 and newer. OpenSSL 1.1.1 will have TLS 1.3 cipers enabled by
default.
Also update multissltests to test with latest OpenSSL.
Signed-off-by: Christian Heimes <christian@python.org>.
(cherry picked from commit 3e630c541b35c96bfe5619165255e559f577ee71)
Co-authored-by: Christian Heimes <christian@python.org>
Diffstat (limited to 'Doc')
| -rw-r--r-- | Doc/library/ssl.rst | 8 |
1 files changed, 3 insertions, 5 deletions
diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 0421031..7c7c85b 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -294,11 +294,6 @@ purposes. 3DES was dropped from the default cipher string. - .. versionchanged:: 2.7.15 - - TLS 1.3 cipher suites TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, - and TLS_CHACHA20_POLY1305_SHA256 were added to the default cipher string. - .. function:: _https_verify_certificates(enable=True) Specifies whether or not server certificates are verified when creating @@ -1179,6 +1174,9 @@ to speed up repeated connections from the same clients. when connected, the :meth:`SSLSocket.cipher` method of SSL sockets will give the currently selected cipher. + OpenSSL 1.1.1 has TLS 1.3 cipher suites enabled by default. The suites + cannot be disabled with :meth:`~SSLContext.set_ciphers`. + .. method:: SSLContext.set_alpn_protocols(protocols) Specify which protocols the socket should advertise during the SSL/TLS |