@@ -381,6 +381,11 @@ def match_hostname(cert, hostname):
381381 CertificateError is raised on failure. On success, the function
382382 returns nothing.
383383 """
384+warnings.warn(
385+"ssl module: match_hostname() is deprecated",
386+category=DeprecationWarning,
387+stacklevel=2
388+ )
384389ifnotcert:
385390raiseValueError("empty or no certificate, match_hostname needs a "
386391"SSL socket or SSL context with either "
@@ -479,7 +484,15 @@ class SSLContext(_SSLContext):
479484sslsocket_class=None# SSLSocket is assigned later.
480485sslobject_class=None# SSLObject is assigned later.
481486482-def__new__(cls, protocol=PROTOCOL_TLS, *args, **kwargs):
487+def__new__(cls, protocol=None, *args, **kwargs):
488+ifprotocolisNone:
489+warnings.warn(
490+"ssl module: "
491+"SSLContext() without protocol argument is deprecated.",
492+category=DeprecationWarning,
493+stacklevel=2
494+ )
495+protocol=PROTOCOL_TLS
483496self=_SSLContext.__new__(cls, protocol)
484497returnself
485498@@ -518,6 +531,7 @@ def wrap_bio(self, incoming, outgoing, server_side=False,
518531 )
519532520533defset_npn_protocols(self, npn_protocols):
534+warnings.warn("NPN is deprecated, use ALPN instead", stacklevel=2)
521535protos=bytearray()
522536forprotocolinnpn_protocols:
523537b=bytes(protocol, 'ascii')
@@ -734,12 +748,15 @@ def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
734748# SSLContext sets OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_COMPRESSION,
735749# OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE and OP_SINGLE_ECDH_USE
736750# by default.
737-context=SSLContext(PROTOCOL_TLS)
738-739751ifpurpose==Purpose.SERVER_AUTH:
740752# verify certs and host name in client mode
753+context=SSLContext(PROTOCOL_TLS_CLIENT)
741754context.verify_mode=CERT_REQUIRED
742755context.check_hostname=True
756+elifpurpose==Purpose.CLIENT_AUTH:
757+context=SSLContext(PROTOCOL_TLS_SERVER)
758+else:
759+raiseValueError(purpose)
743760744761ifcafileorcapathorcadata:
745762context.load_verify_locations(cafile, capath, cadata)
@@ -755,7 +772,7 @@ def create_default_context(purpose=Purpose.SERVER_AUTH, *, cafile=None,
755772context.keylog_filename=keylogfile
756773returncontext
757774758-def_create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=CERT_NONE,
775+def_create_unverified_context(protocol=None, *, cert_reqs=CERT_NONE,
759776check_hostname=False, purpose=Purpose.SERVER_AUTH,
760777certfile=None, keyfile=None,
761778cafile=None, capath=None, cadata=None):
@@ -772,10 +789,18 @@ def _create_unverified_context(protocol=PROTOCOL_TLS, *, cert_reqs=CERT_NONE,
772789# SSLContext sets OP_NO_SSLv2, OP_NO_SSLv3, OP_NO_COMPRESSION,
773790# OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE and OP_SINGLE_ECDH_USE
774791# by default.
775-context=SSLContext(protocol)
792+ifpurpose==Purpose.SERVER_AUTH:
793+# verify certs and host name in client mode
794+ifprotocolisNone:
795+protocol=PROTOCOL_TLS_CLIENT
796+elifpurpose==Purpose.CLIENT_AUTH:
797+ifprotocolisNone:
798+protocol=PROTOCOL_TLS_SERVER
799+else:
800+raiseValueError(purpose)
776801777-ifnotcheck_hostname:
778-context.check_hostname=False
802+context=SSLContext(protocol)
803+context.check_hostname=check_hostname
779804ifcert_reqsisnotNone:
780805context.verify_mode=cert_reqs
781806ifcheck_hostname:
@@ -909,6 +934,9 @@ def selected_npn_protocol(self):
909934"""Return the currently selected NPN protocol as a string, or ``None``
910935 if a next protocol was not negotiated or if NPN is not supported by one
911936 of the peers."""
937+warnings.warn(
938+"ssl module: NPN is deprecated, use ALPN instead", stacklevel=2
939+ )
912940913941defselected_alpn_protocol(self):
914942"""Return the currently selected ALPN protocol as a string, or ``None``
@@ -1123,6 +1151,9 @@ def getpeercert(self, binary_form=False):
11231151@_sslcopydoc
11241152defselected_npn_protocol(self):
11251153self._checkClosed()
1154+warnings.warn(
1155+"ssl module: NPN is deprecated, use ALPN instead", stacklevel=2
1156+ )
11261157returnNone
1127115811281159@_sslcopydoc
@@ -1382,7 +1413,11 @@ def wrap_socket(sock, keyfile=None, certfile=None,
13821413do_handshake_on_connect=True,
13831414suppress_ragged_eofs=True,
13841415ciphers=None):
1385-1416+warnings.warn(
1417+"ssl module: wrap_socket is deprecated, use SSLContext.wrap_socket()",
1418+category=DeprecationWarning,
1419+stacklevel=2
1420+ )
13861421ifserver_sideandnotcertfile:
13871422raiseValueError("certfile must be specified for server-side "
13881423"operations")
@@ -1460,7 +1495,7 @@ def PEM_cert_to_DER_cert(pem_cert_string):
14601495d=pem_cert_string.strip()[len(PEM_HEADER):-len(PEM_FOOTER)]
14611496returnbase64.decodebytes(d.encode('ASCII', 'strict'))
146214971463-defget_server_certificate(addr, ssl_version=PROTOCOL_TLS, ca_certs=None):
1498+defget_server_certificate(addr, ssl_version=PROTOCOL_TLS_CLIENT, ca_certs=None):
14641499"""Retrieve the certificate from the server at the specified address,
14651500 and return it as a PEM-encoded string.
14661501 If 'ca_certs' is specified, validate the server cert against it.