Package: pyOpenSSL
Note:The Python Cryptographic Authoritystrongly suggeststhe use ofpyca/cryptographywhere possible. If you are using pyOpenSSL for anything other than making a TLS connectionyou should move to cryptography and drop your pyOpenSSL dependency.High-level wrapper around a subset of the OpenSSL library. IncludesSSL.Connectionobjects, wrapping the methods of Python’s portable socketsCallbacks written in PythonExtensive error-handling mechanism, mirroring OpenSSL’s error codes… and much more.You can find more information in thedocumentation.
Development takes place onGitHub.DiscussionIf you run into bugs, you can file them in ourissue tracker.We maintain acryptography-devmailing list for both user and development discussions.You can also join#pycaonirc.libera.chatto ask questions or get involved.Release Information24.0.0 (2024-01-22)Backward-incompatible changes:Deprecations:Changes:AddedOpenSSL.SSL.Connection.get_selected_srtp_profileto determine which SRTP profile was negotiated.#1279.23.3.0 (2023-10-25)Backward-incompatible changes:Dropped support for Python 3.6.The minimumcryptographyversion is now 41.0.5.RemovedOpenSSL.crypto.loads_pkcs7andOpenSSL.crypto.loads_pkcs12which had been deprecated for 3 years.AddedOpenSSL.SSL.OP_LEGACY_SERVER_CONNECTto allow legacy insecure renegotiation between OpenSSL and unpatched servers.#1234.Deprecations:DeprecatedOpenSSL.crypto.PKCS12(which was intended to have been deprecated at the same time asOpenSSL.crypto.load_pkcs12).DeprecatedOpenSSL.crypto.NetscapeSPKI.DeprecatedOpenSSL.crypto.CRLDeprecatedOpenSSL.crypto.RevokedDeprecatedOpenSSL.crypto.load_crlandOpenSSL.crypto.dump_crlDeprecatedOpenSSL.crypto.signandOpenSSL.crypto.verifyDeprecatedOpenSSL.crypto.X509ExtensionChanges:ChangedOpenSSL.crypto.X509Store.add_crlto also acceptcryptography’sx509.CertificateRevocationListarguments in addition
to the now deprecatedOpenSSL.crypto.CRLarguments.Fixedtest_set_default_verify_pathstest so that it is skipped if no
network connection is available.23.2.0 (2023-05-30)Backward-incompatible changes:RemovedX509StoreFlags.NOTIFY_POLICY.#1213.Deprecations:Changes:cryptographymaximum version has been increased to 41.0.x.Invalid versions are now rejected inOpenSSL.crypto.X509Req.set_version.AddedX509VerificationCodestoOpenSSL.SSL.#1202.23.1.1 (2023-03-28)Backward-incompatible changes:Deprecations:Changes:Worked around an issue in OpenSSL 3.1.0 which causedX509Extension.get_short_nameto raise an exception when no short name was known to OpenSSL.#1204.23.1.0 (2023-03-24)Backward-incompatible changes:Deprecations:Changes:cryptographymaximum version has been increased to 40.0.x.AddOpenSSL.SSL.Connection.DTLSv1_get_timeoutandOpenSSL.SSL.Connection.DTLSv1_handle_timeoutto support DTLS timeouts#1180.23.0.0 (2023-01-01)Backward-incompatible changes:Deprecations:Changes:AddOpenSSL.SSL.X509StoreFlags.PARTIAL_CHAINconstant to allow for users
to perform certificate verification on partial certificate chains.#1166cryptographymaximum version has been increased to 39.0.x.22.1.0 (2022-09-25)Backward-incompatible changes:Remove support for SSLv2 and SSLv3.The minimumcryptographyversion is now 38.0.x (and we now pin releases
againstcryptographymajor versions to prevent future breakage)TheOpenSSL.crypto.X509StoreContextErrorexception has been refactored,
changing its internal attributes.#1133Deprecations:OpenSSL.SSL.SSLeay_versionis deprecated in favor ofOpenSSL.SSL.OpenSSL_version. The constantsOpenSSL.SSL.SSLEAY_*are
deprecated in favor ofOpenSSL.SSL.OPENSSL_*.Changes:AddOpenSSL.SSL.Connection.set_verifyandOpenSSL.SSL.Connection.get_verify_modeto override the context object’s verification flags.#1073AddOpenSSL.SSL.Connection.use_certificateandOpenSSL.SSL.Connection.use_privatekeyto set a certificate per connection (and not just per context)#1121.22.0.0 (2022-01-29)Backward-incompatible changes:Drop support for Python 2.7.#1047The minimumcryptographyversion is now 35.0.Deprecations:Changes:Expose wrappers for someDTLSprimitives.#102621.0.0 (2021-09-28)Backward-incompatible changes:The minimumcryptographyversion is now 3.3.Drop support for Python 3.5Deprecations:Changes:Raise an error when an invalid ALPN value is set.#993AddedOpenSSL.SSL.Context.set_min_proto_versionandOpenSSL.SSL.Context.set_max_proto_versionto set the minimum and maximum supported TLS version#985.Updatedto_cryptographyandfrom_cryptographymethods to support an upcoming release ofcryptographywithout raising deprecation warnings.#103020.0.1 (2020-12-15)Backward-incompatible changes:Deprecations:Changes:Fixed compatibility with OpenSSL 1.1.0.20.0.0 (2020-11-27)Backward-incompatible changes:The minimumcryptographyversion is now 3.2.Remove deprecatedOpenSSL.tsafemodule.Removed deprecatedOpenSSL.SSL.Context.set_npn_advertise_callback,OpenSSL.SSL.Context.set_npn_select_callback, andOpenSSL.SSL.Connection.get_next_proto_negotiated.Drop support for Python 3.4Drop support for OpenSSL 1.0.1 and 1.0.2Deprecations:DeprecatedOpenSSL.crypto.loads_pkcs7andOpenSSL.crypto.loads_pkcs12.Changes:Added a new optionalchainparameter toOpenSSL.crypto.X509StoreContext()where additional untrusted certificates can be specified to help chain building.#948AddedOpenSSL.crypto.X509Store.load_locationsto set trusted
certificate file bundles and/or directories for verification.#943AddedContext.set_keylog_callbackto log key material.#910AddedOpenSSL.SSL.Connection.get_verified_chainto retrieve the
verified certificate chain of the peer.#894.Make verification callback optional inContext.set_verify.
If omitted, OpenSSL’s default verification is used.#933Fixed a bug that could truncate or cause a zero-length key error due to a
null byte in private key passphrase inOpenSSL.crypto.load_privatekeyandOpenSSL.crypto.dump_privatekey.#94719.1.0 (2019-11-18)Backward-incompatible changes:Removed deprecatedContextType,ConnectionType,PKeyType,X509NameType,X509ReqType,X509Type,X509StoreType,CRLType,PKCS7Type,PKCS12Type, andNetscapeSPKITypealiases.
Use the classes without theTypesuffix instead.#814The minimumcryptographyversion is now 2.8 due to issues on macOS with a transitive dependency.#875Deprecations:DeprecatedOpenSSL.SSL.Context.set_npn_advertise_callback,OpenSSL.SSL.Context.set_npn_select_callback, andOpenSSL.SSL.Connection.get_next_proto_negotiated.
ALPN should be used instead.#820Changes:SupportbytearrayinSSL.Connection.send()by using cffi’s from_buffer.#852TheOpenSSL.SSL.Context.set_alpn_select_callbackcan return a newNO_OVERLAPPING_PROTOCOLSsentinel value
to allow a TLS handshake to complete without an application protocol.Full changelog.