Issue #20896: ssl.get_server_certificate() now uses PROTOCOL_SSLv23, not PROTOCOL_SSL...

diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
index 94a0c81904e738a388e0a12f63dad74098d31071..422cf569bb93d62666f162a53c62e770f6f14814 100644 (file)
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -387,7 +387,7 @@ Certificate handling
      >>> time.ctime(ssl.cert_time_to_seconds("May  9 00:00:00 2007 GMT"))
      'Wed May  9 00:00:00 2007'
 
-.. function:: get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None)
+.. function:: get_server_certificate(addr, ssl_version=PROTOCOL_SSLv23, ca_certs=None)
 
    Given the address ``addr`` of an SSL-protected server, as a (*hostname*,
    *port-number*) pair, fetches the server's certificate, and returns it as a
@@ -401,6 +401,10 @@ Certificate handling
    .. versionchanged:: 3.3
       This function is now IPv6-compatible.
 
+   .. versionchanged:: 3.5
+      The default *ssl_version* is changed from :data:`PROTOCOL_SSLv3` to
+      :data:`PROTOCOL_SSLv23` for maximum compatibility with modern servers.
+
 .. function:: DER_cert_to_PEM_cert(DER_cert_bytes)
 
    Given a certificate as a DER-encoded blob of bytes, returns a PEM-encoded

diff --git a/Lib/ssl.py b/Lib/ssl.py
index d3c18ed1b7936b1eea54635f05cf51c62b1d99b0..d2be3ce5acd2ad4299ffe37036fa70980a1a8b92 100644 (file)
--- a/Lib/ssl.py
+++ b/Lib/ssl.py
@@ -922,7 +922,7 @@ def PEM_cert_to_DER_cert(pem_cert_string):
     d = pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)]
     return base64.decodebytes(d.encode('ASCII', 'strict'))
 
-def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv3, ca_certs=None):
+def get_server_certificate(addr, ssl_version=PROTOCOL_SSLv23, ca_certs=None):
     """Retrieve the certificate from the server at the specified address,
     and return it as a PEM-encoded string.
     If 'ca_certs' is specified, validate the server cert against it.

diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
index 2b3de1f477e613968f93b44dfb561a4414f35507..9f5bd09b99df49b945c5b52689f4c2a7f82112e7 100644 (file)
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -1371,14 +1371,12 @@ class NetworkedTests(unittest.TestCase):
     def test_get_server_certificate(self):
         def _test_get_server_certificate(host, port, cert=None):
             with support.transient_internet(host):
-                pem = ssl.get_server_certificate((host, port),
-                                                 ssl.PROTOCOL_SSLv23)
+                pem = ssl.get_server_certificate((host, port))
                 if not pem:
                     self.fail("No server certificate on %s:%s!" % (host, port))
 
                 try:
                     pem = ssl.get_server_certificate((host, port),
-                                                     ssl.PROTOCOL_SSLv23,
                                                      ca_certs=CERTFILE)
                 except ssl.SSLError as x:
                     #should fail
@@ -1388,7 +1386,6 @@ class NetworkedTests(unittest.TestCase):
                     self.fail("Got server certificate %s for %s:%s!" % (pem, host, port))
 
                 pem = ssl.get_server_certificate((host, port),
-                                                 ssl.PROTOCOL_SSLv23,
                                                  ca_certs=cert)
                 if not pem:
                     self.fail("No server certificate on %s:%s!" % (host, port))

diff --git a/Misc/NEWS b/Misc/NEWS
index 6d4a6e4eebc9998d4f59a9de4925311152907c3a..2ebfe3f2ff44f77e819e1e2c6c9eeb690903501a 100644 (file)
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -50,6 +50,9 @@ Core and Builtins
 Library
 -------
 
+- Issue #20896: ssl.get_server_certificate() now uses PROTOCOL_SSLv23, not
+  PROTOCOL_SSLv3, for maximum compatibility.
+
 - Issue #21239: patch.stopall() didn't work deterministically when the same
   name was patched more than once.