GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — `ssl.get_server_certificate(addr, ca_certs=...)` verifies the chain but never the identity · Issue #161503 · python/cpython

ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity #161503

New issue
Copy link
New issue
Copy link
Open
Open
ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity#161503
Copy link
Labels
3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytopic-SSLtype-securityA security issueA security issue

Description

@brettcs
brettcs
opened on Nov 6, 2026
Issue body actions

Bug report

Doc/library/ssl.rst:411-413 says of ca_certs that "the call will attempt to validate the server certificate against that set of root certificates, and will fail if the validation attempt fails". It validates the chain and never checks that the certificate is for the host contacted.

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Linked PRs

  • gh-161503: Check hostname in ssl.get_server_certificate with custom ca_certs #161507
  • [3.15] gh-161503: Check hostname in ssl.get_server_certificate with custom ca_certs (GH-161507) #161574
  • [3.14] gh-161503: Check hostname in ssl.get_server_certificate with custom ca_certs (GH-161507) #161575
  • [3.13] gh-161503: Check hostname in ssl.get_server_certificate with custom ca_certs (GH-161507) #161576
  • [3.12] gh-161503: Check hostname in ssl.get_server_certificate with custom ca_certs (GH-161507) #161670
  • [3.11] gh-161503: Check hostname in ssl.get_server_certificate with custom ca_certs (GH-161507) #161671

Activity

  1. brettcs
    added
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Nov 6, 2026
  2. brettcs
    added 2 commits that reference this issue on Nov 6, 2026

    pythonGH-161503: Check hostname in ssl.get_server_certificate with cu…

    1784d7c

    pythonGH-161503: Check hostname in ssl.get_server_certificate with cu…

    6d61b82
  3. StanFromIreland
    added
    type-securityA security issueA security issue
    stdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directory
    3.11only security fixesonly security fixes
    topic-SSL
    3.12only security fixesonly security fixes
    3.13only security fixesonly security fixes
    3.14bugs and security fixesbugs and security fixes
    3.15bugs and security fixesbugs and security fixes
    3.16new features, bugs and security fixesnew features, bugs and security fixes
    and removed
    type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error
    on Nov 6, 2026
  4. brettcs
    added 2 commits that reference this issue on Nov 6, 2026

    pythonGH-161503: Update documentation for the new check

    2530d72

    pythonGH-161503: Refine documentation per review

    e05d003
  5. StanFromIreland
    added a commit that references this issue on Nov 7, 2026

    gh-161503: Check hostname in `ssl.get_server_certificate` with custom…

    8dde46e
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.11only security fixesonly security fixes3.12only security fixesonly security fixes3.13only security fixesonly security fixes3.14bugs and security fixesbugs and security fixes3.15bugs and security fixesbugs and security fixes3.16new features, bugs and security fixesnew features, bugs and security fixesstdlibStandard Library Python modules in the Lib/ directoryStandard Library Python modules in the Lib/ directorytopic-SSLtype-securityA security issueA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions

      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.