Can I use TLS version 1.1 or 1.2 in python 2?

Question

I read a document that says that Python 2 only has ssl.PROTOCOL_TLSv1 constant, and that ssl.PROTOCOL_TLSv1_1 and ssl.PROTOCOL_TLSv1_2 were added in Python 3.4. So how can I use TLS 1.1 and 1.2 in Python 2?

PS. I don't want to use TLS 1.0 because it has some security flaws. TLS 1.2 is the newest version now, so I want to make my program use TLS 1.2 only; if the server doesn't support TLS 1.2 then just make the connection failed.

Answer 1

我很抱歉复活了一个旧问题，似乎对于计划于2014年12月左右发布的Python 2.7.9将引入对TLS1.1和TLS1.2的支持。

Answer 2

I recently had to terminate a TLSv1.2 connection with mutually authenticated SSL and this was no go on vanilla 2.7.8. I was about to begin painfully porting my network i/o intensive application to Python 3, changing every string to bytes and back for recv/send. It was going to suck.

Then I found PEP466. You can apply the patch from PEP466 (Google it) to 2.7.7 or 2.7.8 pretty easily to get TLS 1.1 and TLS 1.2 working.

The patch for PEP 466 is @ http://bugs.python.org/file36423/ssl-backport.diff

Also, you will need the following patch to fix a Unicode related bug that causes a segfault when constructing errors in the SSL code:

this patch is @ http://bugs.python.org/file36017/unicode_fromformat.patch

Also, once you apply the patch, you should technically do the following before configuring and compiling:

~/Python-2.7.8$ python3 ./Tools/ssl/make_ssl_data.py /usr/include/openssl/ _ssl_data.h
~/Python-2.7.8$ mv _ssl_data.h Modules/_ssl_data.h

You can then configure && make && make install and should be good to go w/TLSv1.1 and TLSv1.2.

~/Python-2.7.8$ ./configure --enable-unicode=ucs2 --prefix=/opt/Python-2.7.8/ --with-pth && make -j && sudo make install

TLS 1.2 is now working fine for me, so I don't have to port a gigantic app to Python 3.

Anyway, the wording on the PEP page is confusing, it makes it sound like 2.7.9 in December is supposed to have this support included (?) but I'm not sure if that is acccurate or if this is just a manual workaround until you port your code to Python 3. I suppose it doesn't really matter.

Answer 3

No there is no support planned for TLS 1.1 or 1.2 in Python 2, see:

http://bugs.python.org/issue16692

It states clearly that TLS > 1.0 won't be backported to Python 2.7, and Python maintainers stated several times that Python 2.8 is not going to happen.

Please note that few servers support TLS 1.2 for now. Hopefully it will change in the future.