SIGN IN SIGN UP
python / cpython UNCLAIMED

The Python programming language

0 0 0 Python

gh-138252: Add support in SSL module for getting and setting TLS signature algorithms (#138269)

The signature algorithms allowed for certificate-based client authentication or
for the server to complete the TLS handshake can be defined on a SSL context via
`ctx.set_client_sigalgs()` and `ctx.set_server_sigalgs()`.

With OpenSSL 3.4 or later, the list of available TLS algorithms can be retrieved
by `ssl.get_sigalgs()`.

With OpenSSL 3.5 or later, the selected signature algorithms can be retrieved from
SSL sockets via `socket.client_sigalg()` and `socket.server_sigalg()`.

This commit also partially amends 377b78761814e7d848361e642d376881739d5a29
by using `PyUnicode_DecodeFSDefault` instead of `PyUnicode_DecodeASCII` in
`_ssl._SSLContext.get_groups`, so that functions consistently decode strings
obtained from OpenSSL.

---------

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
R
Ron Frederick committed
6401823db3fb9549352da8c1d487725828dbdeff
Parent: 919c7e8
Committed by GitHub <noreply@github.com> on 9/8/2025, 8:36:12 AM