upstream/certbot
1
0
Fork 0
mirror of https://github.com/certbot/certbot.git synced 2026-05-28 04:34:11 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add comment about _DEFAULT_DVSNI_SSL_METHOD.

Browse source
This commit is contained in:
Jakub Warmuz 2015-07-18 07:33:46 +00:00
parent 33d7f205fa
commit f3538cd114
No known key found for this signature in database
GPG key ID: 2A7BAD3A489B52EA
1 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

17
acme/acme/crypto_util.py
View file

@ -13,11 +13,20 @@ from acme import errors
logger = logging.getLogger(__name__)
_DEFAULT_SSL_METHOD = OpenSSL.SSL.SSLv23_METHOD
# DVSNI certificate serving and probing is not affected by SSL
# vulnerabilities: prober needs to check certificate for expected
# contents anyway. Working SNI is the only thing that's necessary for
# the challenge and thus scoping down SSL/TLS method (version) would
# cause interoperability issues: TLSv1_METHOD is only compatible with
# TLSv1_METHOD, while SSLv23_METHOD is compatible with all other
# methods, including TLSv2_METHOD (read more at
# https://www.openssl.org/docs/ssl/SSLv23_method.html). _serve_sni
# should be changed to use "set_options" to disable SSLv2 and SSLv3,
# in case it's used for things other than probing/serving!
_DEFAULT_DVSNI_SSL_METHOD = OpenSSL.SSL.SSLv23_METHOD
def _serve_sni(certs, sock, reuseaddr=True, method=_DEFAULT_SSL_METHOD,
def _serve_sni(certs, sock, reuseaddr=True, method=_DEFAULT_DVSNI_SSL_METHOD,
accept=None):
"""Start SNI-enabled server, that drops connection after handshake.
@ -61,7 +70,7 @@ def _serve_sni(certs, sock, reuseaddr=True, method=_DEFAULT_SSL_METHOD,
def _probe_sni(name, host, port=443, timeout=300,
method=_DEFAULT_SSL_METHOD, source_address=('0', 0)):
method=_DEFAULT_DVSNI_SSL_METHOD, source_address=('0', 0)):
"""Probe SNI server for SSL certificate.
:param bytes name: Byte string to send as the server name in the