From: R David Murray <rdmurray@bitdance.com>
Date: Sun, 9 Mar 2014 21:01:34 +0000 (-0400)
Subject: whatsnew: SSLContext.verify_flags and constants. (#8813)
X-Git-Tag: v3.4.1rc1~233^2~102
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=6978722828b5be0ad1ce562acf660033c93e034e;p=python

whatsnew: SSLContext.verify_flags and constants. (#8813)
---

diff --git a/Doc/whatsnew/3.4.rst b/Doc/whatsnew/3.4.rst
index d63d7690e3..dac452549c 100644
--- a/Doc/whatsnew/3.4.rst
+++ b/Doc/whatsnew/3.4.rst
@@ -1305,6 +1305,14 @@ The dictionary returned by :meth:`.SSLSocket.getpeercert` contains additional
 ``X509v3`` extension items: ``crlDistributionPoints``, ``calIssuers``, and
 ``OCSP`` URIs.  (Contributed by Christian Heimes in :issue:`18379`.)
 
+If OpenSSL 0.9.8 or later is available, :class:`~ssl.SSLContext` has an new
+attribute :attr:`~ssl.SSLContext.verify_flags` that can be used to control the
+certificate verification process by setting it to some combination of the new
+constants :data:`~ssl.VERIFY_DEFAULT`, :data:`~ssl.VERIFY_CRL_CHECK_LEAF`,
+:data:`~ssl.VERIFY_CRL_CHECK_CHAIN`, or :data:`~ssl.VERIFY_X509_STRICT`.
+OpenSSL does not do any CRL verification by default.  (Contributed by
+Christien Heimes in :issue:`8813`.)
+
 
 stat
 ----