ssl — 套接字对象的 TLS/SSL 包裹器

源代码： Lib/ssl.py

This module provides access to Transport Layer Security (often known as “Secure Sockets Layer”) encryption and peer authentication facilities for network sockets, both client-side and server-side. This module uses the OpenSSL library. It is available on all modern Unix systems, Windows, macOS, and probably additional platforms, as long as OpenSSL is installed on that platform.

注意

Some behavior may be platform dependent, since calls are made to the operating system socket APIs. The installed version of OpenSSL may also cause variations in behavior. For example, TLSv1.3 comes with OpenSSL version 1.1.1.

警告

不要使用此模块当未阅读 安全注意事项 . Doing so may lead to a false sense of security, as the default settings of the ssl module are not necessarily appropriate for your application.

可用性 ：非 WASI。

This module does not work or is not available on WebAssembly. See WebAssembly 平台 了解更多信息。

This section documents the objects and functions in the ssl module; for more general information about TLS, SSL, and certificates, the reader is referred to the documents in the “See Also” section at the bottom.

此模块提供类 ssl.SSLSocket ，派生自 socket.socket type, and provides a socket-like wrapper that also encrypts and decrypts the data going over the socket with SSL. It supports additional methods such as getpeercert() , which retrieves the certificate of the other side of the connection, cipher() , which retrieves the cipher being used for the secure connection or get_verified_chain() , get_unverified_chain() which retrieves certificate chain.

For more sophisticated applications, the ssl.SSLContext class helps manage settings and certificates, which can then be inherited by SSL sockets created through the SSLContext.wrap_socket() 方法。

3.5.3 版改变： 更新 OpenSSL 1.1.0 链接支持

3.6 版改变： OpenSSL 0.9.8, 1.0.0 and 1.0.1 are deprecated and no longer supported. In the future the ssl module will require at least OpenSSL 1.0.2 or 1.1.0.

3.10 版改变： PEP 644 has been implemented. The ssl module requires OpenSSL 1.1.1 or newer.

Use of deprecated constants and functions result in deprecation warnings.

函数、常量和异常

套接字创建

实例化的 SSLSocket must be created using the SSLContext.wrap_socket() method. The helper function create_default_context() returns a new context with secure default settings.

Client socket example with default context and IPv4/IPv6 dual stack: 

import socket
import ssl
hostname = 'www.python.org'
context = ssl.create_default_context()
with socket.create_connection((hostname, 443)) as sock:
    with context.wrap_socket(sock, server_hostname=hostname) as ssock:
        print(ssock.version())