Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ssl.HAS_PHA to detect libssl PHA support #128035

Closed
WillChilds-Klein opened this issue Dec 17, 2024 · 1 comment
Closed

Add ssl.HAS_PHA to detect libssl PHA support #128035

WillChilds-Klein opened this issue Dec 17, 2024 · 1 comment
Labels
extension-modules C modules in the Modules dir topic-SSL type-feature A feature request or enhancement

Comments

@WillChilds-Klein
Copy link
Contributor

WillChilds-Klein commented Dec 17, 2024 •
edited by bedevere-app bot
Loading

Feature or enhancement

Proposal:

TLSv1.3 post-handshake client authentication (PHA), often referred to as "mutual TLS" or "mTLS", allows TLS servers to authenticate client identities using digital certificates. Some TLS libraries do not implement PHA, including actively maintained and widely used libraries such as AWS-LC and BoringSSL.

This issue proposes the addition of a boolean property ssl.HAS_PHA to indicate whether the crypto library CPython is built against supports PHA, allowing python's test suite and consuming modules to branch accordingly.

This feature has precedent in the ssl.HAS_PSK flag indicating support for another TLS feature that is not universally implemented across TLS libraries.

Has this already been discussed elsewhere?

This is a minor feature, which does not need previous discussion elsewhere

Links to previous discussion of this feature:

Related changes to increase libcrypto/libssl compatibility (specifically with AWS-LC) have been discussed with the community here.

Linked PRs
@WillChilds-Klein WillChilds-Klein added the type-feature A feature request or enhancement label Dec 17, 2024
@WillChilds-Klein WillChilds-Klein mentioned this issue Dec 17, 2024
Merged
@picnixz picnixz added extension-modules C modules in the Modules dir topic-SSL labels Dec 17, 2024
gpshead pushed a commit that referenced this issue Dec 24, 2024
@WillChilds-Klein @tomasr8 @picnixz
gh-128035: Add ssl.HAS_PHA to detect libssl PHA support (GH-128036)
418114c 
* Add ssl.HAS_PHA to detect libssl Post-Handshake-Auth support

Co-authored-by: Tomas R. <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>
@gpshead
Copy link
Member

gpshead commented Dec 24, 2024

thanks, merged!

@gpshead gpshead closed this as completed Dec 24, 2024
srinivasreddy pushed a commit to srinivasreddy/cpython that referenced this issue Jan 8, 2025
@WillChilds-Klein @tomasr8
@picnixz @srinivasreddy
pythongh-128035: Add ssl.HAS_PHA to detect libssl PHA support (python…
8ad4e87 
…GH-128036)

* Add ssl.HAS_PHA to detect libssl Post-Handshake-Auth support

Co-authored-by: Tomas R. <[email protected]>
Co-authored-by: Bénédikt Tran <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
extension-modules C modules in the Modules dir topic-SSL type-feature A feature request or enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@gpshead @WillChilds-Klein @picnixz