[3.15] gh-72507: Document that imaplib does not verify TLS certificates by default...

IMAP4_SSL() and IMAP4.starttls() do not verify the server certificate or
hostname unless a suitable ssl_context is passed.
(cherry picked from commit f3bf8abb8c0f4cb20bed3dc7d98eca4a2d668709)

Co-authored-by: Serhiy Storchaka <storchaka@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

diff --git a/Doc/library/imaplib.rst b/Doc/library/imaplib.rst
index cf475734636a20dad12d83eeaa470bc2c8e46848..e175dcccaf652eb79669addc2d4da309528c7b8a 100644 (file)
--- a/Doc/library/imaplib.rst
+++ b/Doc/library/imaplib.rst
@@ -89,6 +89,13 @@ There's also a subclass for secure connections:
    (potentially long-lived) structure.  Please read :ref:`ssl-security` for
    best practices.
 
+   .. note::
+
+      With the default *ssl_context*, the connection is encrypted but the
+      server certificate and hostname are not verified.
+      To verify them, pass a context created by
+      :func:`ssl.create_default_context`.
+
    The optional *timeout* parameter specifies a timeout in seconds for the
    connection attempt. If timeout is not given or is ``None``, the global default
    socket timeout is used.
@@ -581,6 +588,13 @@ An :class:`IMAP4` instance has the following methods:
    encryption on the IMAP connection.  Please read :ref:`ssl-security` for
    best practices.
 
+   .. note::
+
+      With the default *ssl_context*, the connection is encrypted but the
+      server certificate and hostname are not verified.
+      To verify them, pass a context created by
+      :func:`ssl.create_default_context`.
+
    .. versionadded:: 3.2
 
    .. versionchanged:: 3.4