Issue 28043: Sane defaults for SSLContext options and ciphers (original) (raw)

Created on 2016-09-09 11:18 by christian.heimes, last changed 2022-04-11 14:58 by admin. This issue is now closed.

Messages (6)
msg275310 - (view)	Author: Christian Heimes (christian.heimes) *	Date: 2016-09-09 11:18
I like to introduce sane defaults for SSLContext options and ciphers: Changed in version 3.6: The context is created with more secure default values. PROTOCOL_TLS is the default protocol. The options OP_NO_COMPRESSION, OP_CIPHER_SERVER_PREFERENCE, OP_SINGLE_DH_USE, OP_SINGLE_ECDH_USE, OP_NO_SSLv2 (except for PROTOCOL_SSLv2), and OP_NO_SSLv3 (except for PROTOCOL_SSLv3) are set by default. The initial cipher suite list contains only HIGH ciphers, no NULL ciphers and MD5 ciphers (except for PROTOCOL_SSLv2).
msg275604 - (view)	Author: Alyssa Coghlan (ncoghlan) *	Date: 2016-09-10 09:20
+1 from me for a model where ssl.get_default_context() can change in maintenance releases, while the ssl.SSLContext defaults get updated for feature releases.
msg275637 - (view)	Author: Christian Heimes (christian.heimes) *	Date: 2016-09-10 13:57
I'm planning to remove PROTOCOL_TLS again and replace it with something more sensible.
msg275694 - (view)	Author: Roundup Robot (python-dev)	Date: 2016-09-10 20:43
New changeset 1b4c5d06c028 by Christian Heimes in branch 'default': Issue 28043: SSLContext has improved default settings https://hg.python.org/cpython/rev/1b4c5d06c028
msg301419 - (view)	Author: Christian Heimes (christian.heimes) *	Date: 2017-09-06 00:53
3.6 and master are looking good. Should I backport the fix to 2.7, too?
msg335615 - (view)	Author: STINNER Victor (vstinner) *	Date: 2019-02-15 14:24
New changeset b8eaec697a2b5d9d2def2950a0aa50e8ffcf1059 by Victor Stinner (stratakis) in branch '2.7': [2.7] bpo-28043: improved default settings for SSLContext (GH-10608) https://github.com/python/cpython/commit/b8eaec697a2b5d9d2def2950a0aa50e8ffcf1059