GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-161503: Check hostname in `ssl.get_server_certificate` with custom `ca_certs` by brettcs · Pull Request #161507 · python/cpython

Conversation

@brettcs

@brettcs brettcs commented Nov 6, 2026 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

This branch implements the suggested fix along with a test that fails on current main. CC @sethmlarson @StanFromIreland

  • Issue: ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity #161503

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@brettcs
pythonGH-161503: Check hostname in ssl.get_server_certificate with cu…
6d61b82 
…stom ca_certs (python#161503)
@brettcs
brettcs requested review from gpshead and picnixz as code owners November 6, 2026 16:58
@bedevere-app bedevere-app Bot added the awaiting review label Nov 6, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Nov 6, 2026
ssl.get_server_certificate(addr, ca_certs=...) verifies the chain but never the identity #161503
Open
StanFromIreland
StanFromIreland reviewed Nov 6, 2026
View reviewed changes
Comment thread Lib/ssl.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@brettcs
pythonGH-161503: Update documentation for the new check
2530d72
StanFromIreland
StanFromIreland reviewed Nov 6, 2026
View reviewed changes
Comment thread Doc/library/ssl.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
StanFromIreland
StanFromIreland reviewed Nov 6, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2026-11-06-16-22-47.gh-issue-161503.FkIl87.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
StanFromIreland
StanFromIreland reviewed Nov 6, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2026-11-06-16-22-47.gh-issue-161503.FkIl87.rst Resolved

Uh oh!

There was an error while loading. Please reload this page.
@read-the-docs-community

read-the-docs-community Bot commented Nov 6, 2026 •
edited
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #35707548 | 📁 Comparing e05d003 against main (2781ffe)

  🔍 Preview build  

2 files changed
± library/ssl.html
± whatsnew/changelog.html
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@brettcs
pythonGH-161503: Refine documentation per review
e05d003
@brettcs
brettcs requested a review from StanFromIreland November 6, 2026 20:33
sethmlarson
sethmlarson approved these changes Nov 6, 2026
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting review labels Nov 6, 2026
gpshead
gpshead approved these changes Nov 7, 2026
View reviewed changes
@gpshead gpshead added needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 bugs and security fixes release-blocker labels Nov 7, 2026
@github-project-automation github-project-automation Bot added this to Release and Deferred blockers 🚫 Nov 7, 2026
@github-project-automation github-project-automation Bot moved this to Todo in Release and Deferred blockers 🚫 Nov 7, 2026
Eclips4
Eclips4 approved these changes Nov 7, 2026
View reviewed changes
StanFromIreland
StanFromIreland approved these changes Nov 7, 2026
View reviewed changes
@StanFromIreland StanFromIreland changed the title gh-161503: Check hostname in ssl.get_server_certificate with custom ca_certs gh-161503: Check hostname in ssl.get_server_certificate with custom ca_certs Nov 7, 2026
@StanFromIreland
StanFromIreland merged commit 8dde46e into python:main Nov 7, 2026
69 checks passed

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the awaiting merge label Nov 7, 2026
@github-project-automation github-project-automation Bot moved this from Todo to Done in Release and Deferred blockers 🚫 Nov 7, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 7, 2026

Copy link
Copy Markdown

Thanks @brettcs for the PR, and @StanFromIreland for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖 I'm not a witch! I'm not a witch!
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Nov 7, 2026

Copy link
Copy Markdown

GH-161574 is a backport of this pull request to the 3.15 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.15 bugs and security fixes label Nov 7, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 7, 2026

Copy link
Copy Markdown

Sorry, @brettcs and @StanFromIreland, I could not cleanly backport this to 3.12 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 8dde46eaa6baf5f027a7234845b20d50b509624e 3.12
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@miss-islington-app miss-islington-app Bot assigned StanFromIreland Nov 7, 2026
@bedevere-app

bedevere-app Bot commented Nov 7, 2026

Copy link
Copy Markdown

GH-161575 is a backport of this pull request to the 3.14 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Nov 7, 2026
@miss-islington-app

miss-islington-app Bot commented Nov 7, 2026

Copy link
Copy Markdown

Sorry, @brettcs and @StanFromIreland, I could not cleanly backport this to 3.11 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker 8dde46eaa6baf5f027a7234845b20d50b509624e 3.11
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app

bedevere-app Bot commented Nov 7, 2026

Copy link
Copy Markdown

GH-161576 is a backport of this pull request to the 3.13 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Nov 7, 2026
@bedevere-app

bedevere-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

GH-161670 is a backport of this pull request to the 3.12 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Nov 9, 2026
@bedevere-app

bedevere-app Bot commented Nov 9, 2026

Copy link
Copy Markdown

GH-161671 is a backport of this pull request to the 3.11 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Nov 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes
@sethmlarson sethmlarson sethmlarson approved these changes
@Eclips4 Eclips4 Eclips4 approved these changes
@StanFromIreland StanFromIreland StanFromIreland approved these changes
@picnixz picnixz Awaiting requested review from picnixz picnixz is a code owner

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@StanFromIreland StanFromIreland

Labels

release-blocker

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

5 participants

@brettcs @gpshead @sethmlarson @Eclips4 @StanFromIreland
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.