[issue28043] Sane defaults for SSLContext options and ciphers

Change by Cheryl Sabella : -- resolution: -> fixed stage: patch review -> resolved status: open -> closed ___ Python tracker ___ __

[issue28043] Sane defaults for SSLContext options and ciphers

STINNER Victor added the comment: New changeset b8eaec697a2b5d9d2def2950a0aa50e8ffcf1059 by Victor Stinner (stratakis) in branch '2.7': [2.7] bpo-28043: improved default settings for SSLContext (GH-10608) https://github.com/python/cpython/commit/b8eaec697a2b5d9d2def2950a0aa50e8ffcf1059

[issue28043] Sane defaults for SSLContext options and ciphers

Change by Charalampos Stratakis : -- pull_requests: +9851 stage: commit review -> patch review ___ Python tracker ___ ___ Python-bug

[issue28043] Sane defaults for SSLContext options and ciphers

Christian Heimes added the comment: 3.6 and master are looking good. Should I backport the fix to 2.7, too? -- status: pending -> open ___ Python tracker ___

[issue28043] Sane defaults for SSLContext options and ciphers

Roundup Robot added the comment: New changeset 1b4c5d06c028 by Christian Heimes in branch 'default': Issue 28043: SSLContext has improved default settings https://hg.python.org/cpython/rev/1b4c5d06c028 -- nosy: +python-dev ___ Python tracker

[issue28043] Sane defaults for SSLContext options and ciphers

Changes by Christian Heimes : -- assignee: -> christian.heimes stage: patch review -> commit review status: open -> pending ___ Python tracker ___ __

[issue28043] Sane defaults for SSLContext options and ciphers

Christian Heimes added the comment: I'm planning to remove PROTOCOL_TLS again and replace it with something more sensible. -- ___ Python tracker ___

[issue28043] Sane defaults for SSLContext options and ciphers

Nick Coghlan added the comment: +1 from me for a model where ssl.get_default_context() can change in maintenance releases, while the ssl.SSLContext defaults get updated for feature releases. -- ___ Python tracker

[issue28043] Sane defaults for SSLContext options and ciphers

New submission from Christian Heimes: I like to introduce sane defaults for SSLContext options and ciphers: Changed in version 3.6: The context is created with more secure default values. PROTOCOL_TLS is the default protocol. The options OP_NO_COMPRESSION, OP_CIPHER_SERVER_PREFERENCE, OP_SINGL