A CertificateOptions specifies the security properties for a client or server TLS connection used with OpenSSL.

Method __init__ Create an OpenSSL context SSL connection context factory.
Method __getstate__ Undocumented
Method __setstate__ Undocumented
Method getContext Return an OpenSSL.SSL.Context object.
Instance Variable _options Any option flags to set on the OpenSSL.SSL.Context object that will be created. (type: int)
Instance Variable _cipherString An OpenSSL-specific cipher string. (type: unicode)
Method _makeContext Undocumented
_options =
Any option flags to set on the OpenSSL.SSL.Context object that will be created. (type: int)
_cipherString =
An OpenSSL-specific cipher string. (type: unicode)
@_mutuallyExclusiveArguments([['trustRoot', 'requireCertificate'], ['trustRoot', 'verify'], ['trustRoot', 'caCerts']])
def __init__(self, privateKey=None, certificate=None, method=None, verify=False, caCerts=None, verifyDepth=9, requireCertificate=True, verifyOnce=True, enableSingleUseKeys=True, enableSessions=True, fixBrokenPeers=False, enableSessionTickets=False, extraCertChain=None, acceptableCiphers=None, dhParameters=None, trustRoot=None, acceptableProtocols=None): (source)

Create an OpenSSL context SSL connection context factory.

ParametersprivateKeyA PKey object holding the private key.
certificateAn X509 object holding the certificate.
methodThe SSL protocol to use, one of SSLv23_METHOD, SSLv2_METHOD, SSLv3_METHOD, TLSv1_METHOD (or any other method constants provided by pyOpenSSL). By default, a setting will be used which allows TLSv1.0, TLSv1.1, and TLSv1.2.
verifyPlease use a trustRoot keyword argument instead, since it provides the same functionality in a less error-prone way. By default this is False.

If True, verify certificates received from the peer and fail the handshake if verification fails. Otherwise, allow anonymous sessions and sessions with certificates which fail validation.

caCertsPlease use a trustRoot keyword argument instead, since it provides the same functionality in a less error-prone way.

List of certificate authority certificate objects to use to verify the peer's certificate. Only used if verify is True and will be ignored otherwise. Since verify is False by default, this is None by default.

(type: list of OpenSSL.crypto.X509)
verifyDepthDepth in certificate chain down to which to verify. If unspecified, use the underlying default (9).
requireCertificatePlease use a trustRoot keyword argument instead, since it provides the same functionality in a less error-prone way.

If True, do not allow anonymous sessions; defaults to True.

verifyOnceIf True, do not re-verify the certificate on session resumption.
enableSingleUseKeysIf True, generate a new key whenever ephemeral DH and ECDH parameters are used to prevent small subgroup attacks and to ensure perfect forward secrecy.
enableSessionsIf True, set a session ID on each context. This allows a shortened handshake to be used when a known client reconnects.
fixBrokenPeersIf True, enable various non-spec protocol fixes for broken SSL implementations. This should be entirely safe, according to the OpenSSL documentation, but YMMV. This option is now off by default, because it causes problems with connections between peers using OpenSSL 0.9.8a.
enableSessionTicketsIf True, enable session ticket extension for session resumption per RFC 5077. Note there is no support for controlling session tickets. This option is off by default, as some server implementations don't correctly process incoming empty session ticket extensions in the hello.
extraCertChainList of certificates that complete your verification chain if the certificate authority that signed your certificate isn't widely supported. Do not add certificate to it. (type: list of OpenSSL.crypto.X509)
acceptableCiphersCiphers that are acceptable for connections. Uses a secure default if left None. (type: IAcceptableCiphers)
dhParametersKey generation parameters that are required for Diffie-Hellman key exchange. If this argument is left None, EDH ciphers are disabled regardless of acceptableCiphers. (type: DiffieHellmanParameters)
trustRootSpecification of trust requirements of peers. If this argument is specified, the peer is verified. It requires a certificate, and that certificate must be signed by one of the certificate authorities specified by this object.

Note that since this option specifies the same information as caCerts, verify, and requireCertificate, specifying any of those options in combination with this one will raise a TypeError.

(type: IOpenSSLTrustRoot)
acceptableProtocolsThe protocols this peer is willing to speak after the TLS negotation has completed, advertised over both ALPN and NPN. If this argument is specified, and no overlap can be found with the other peer, the connection will fail to be established. If the remote peer does not offer NPN or ALPN, the connection will be established, but no protocol wil be negotiated. Protocols earlier in the list are preferred over those later in the list. (type: list of bytes)
RaisesValueErrorwhen privateKey or certificate are set without setting the respective other.
ValueErrorwhen verify is True but caCerts doesn't specify any CA certificates.
ValueErrorwhen extraCertChain is passed without specifying privateKey or certificate.
ValueErrorwhen acceptableCiphers doesn't yield any usable ciphers for the current platform.
TypeErrorif trustRoot is passed in combination with caCert, verify, or requireCertificate. Please prefer trustRoot in new code, as its semantics are less tricky.
NotImplementedErrorIf acceptableProtocols were provided but no negotiation mechanism is available.
def __getstate__(self): (source)
Undocumented
def __setstate__(self, state): (source)
Undocumented
def getContext(self): (source)

Return an OpenSSL.SSL.Context object.

def _makeContext(self): (source)
Undocumented
API Documentation for Twisted, generated by pydoctor at 2016-07-06 22:44:36.