nss.ssl

This module implements the SSL functionality in NSS

SSL Version Range API

This API should be used to control SSL 3.0 & TLS support instead of the older SSLSocket.set_ssl_option() API; however, SSLSocket.set_ssl_option() API MUST still be used to control SSL 2.0 support. In this version of libssl, SSL 3.0 and TLS 1.0 are enabled by default. Future versions of libssl may change which versions of the protocol are enabled by default.

The protocol_variant enums (SSL_VARIANT_STREAM, SSL_VARIANT_DATAGRAM) indicates whether the protocol is of type stream or datagram. This must be provided to the functions that do not take an fd. Functions which take an fd will get the variant from the fd.

Using the new version range API in conjunction with the older SSLSocket.set_ssl_option() API for controlling the enabled protocol versions may cause unexpected results. Going forward, we guarantee only the following:

SSLSocket.get_ssl_option(ssl.SSL_ENABLE_TLS) will return True if ANY versions of TLS are enabled.

SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, False) will disable ALL versions of TLS, including TLS 1.0 and later.

The above two properties provide compatibility for applications that use SSLSocket.set_ssl_option() to implement the insecure fallback from TLS 1.x to SSL 3.0.

SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True) will enable TLS 1.0, and may also enable some later versions of TLS, if it is necessary to do so in order to keep the set of enabled versions contiguous. For example, if TLS 1.2 is enabled, then after SSLSocket.set_ssl_option(ss.SSL_ENABLE_TLS, True), TLS 1.0, TLS 1.1, and TLS 1.2 will be enabled, and the call will have no effect on whether SSL 3.0 is enabled. If no later versions of TLS are enabled at the time SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True) is called, then no later versions of TLS will be enabled by the call.

SSLSocket.set_ssl_option(ssl.SSL_ENABLE_SSL3, False) will disable SSL 3.0, and will not change the set of TLS versions that are enabled.

SSLSocket.set_ssl_option(ssl.SSL_ENABLE_SSL3, True) will enable SSL 3.0, and may also enable some versions of TLS if TLS 1.1 or later is enabled at the time of the call, the same way SSLSocket.set_ssl_option(ssl.SSL_ENABLE_TLS, True) works, in order to keep the set of enabled versions contiguous.

Functions

clear_session_cache()

You must call ssl.clear_session_cache() after you use one of the SSL Export Policy Functions to change cipher suite policy settings or use ssl.set_default_cipher_pref() to enable or disable any cipher suite.

config_mp_server_sid_cache([...])

Parameters

config_server_session_id_cache([...])

Parameters

config_server_session_id_cache_with_opt([...])

Parameters

get_cipher_policy(cipher)

Parameters

get_cipher_suite_info(suite)

Parameters

get_default_cipher_pref(cipher)

Parameters

get_default_ssl_version_range([...])

Parameters

get_max_server_cache_locks()

Get the configured maximum number of mutexes used for the server's store of SSL sessions.

get_ssl_default_option(value)

Gets the default value of a specified SSL option for all subsequently opened sockets as long as the current application program is running.

get_ssl_version_from_major_minor(major, minor)

Parameters

get_supported_ssl_version_range([...])

Parameters

set_cipher_policy

set_cipher_pref(cipher, enabled)

set_default_cipher_pref

set_cipher_pref(cipher, enabled)

set_default_ssl_version_range(min_version, ...)

Parameters

set_domestic_policy()

Configures cipher suites to conform with current U.S.

set_export_policy()

Configures the SSL cipher suites to conform with current U.S.

set_france_policy()

Configures the SSL cipher suites to conform with French import regulations related to software products with encryption features.

set_max_server_cache_locks(max_locks)

Parameters

set_ssl_default_option(option, value)

Changes the default value of a specified SSL option for all subsequently opened sockets as long as the current application program is running.

shutdown_server_session_id_cache()

ssl_cipher_suite_from_name(name)

Parameters

ssl_cipher_suite_name(cipher)

Parameters

ssl_library_version_from_name(name)

Parameters

ssl_library_version_name(ssl_library_version)

Parameters

Classes

SSLChannelInfo

SSLChannelInformation(obj)

SSLCipherSuiteInfo

SSLCipherSuiteInformation(obj)

SSLSocket([family, type])

Parameters