// _startSSL_pyOpenSSL [python]
    def _startSSL_pyOpenSSL(self):
        log.debug("_startSSL_pyOpenSSL called")
        tcpsock = self._owner
        # NonBlockingHTTPBOSH instance has no attribute _owner
        if hasattr(tcpsock, '_owner') and tcpsock._owner._caller.client_cert \
        and os.path.exists(tcpsock._owner._caller.client_cert):
            conn = tcpsock._owner._caller
            # FIXME make a checkbox for Client Cert / SSLv23 / TLSv1
            # If we are going to use a client cert/key pair for authentication,
            # we choose TLSv1* method.
            tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
            flags = (OpenSSL.SSL.OP_NO_SSLv2 | OpenSSL.SSL.OP_NO_SSLv3
                | OpenSSL.SSL.OP_SINGLE_DH_USE)
            tcpsock._sslContext.set_options(flags)
            log.debug('Using client cert and key from %s' % conn.client_cert)
            try:
                p12 = OpenSSL.crypto.load_pkcs12(open(conn.client_cert).read(),
                    conn.client_cert_passphrase)
            except OpenSSL.crypto.Error as exception_obj:
                log.warning('Unable to load client pkcs12 certificate from '
                    'file %s: %s ... Is it a valid PKCS12 cert?' % \
                (conn.client_cert, exception_obj.args))
            except:
                log.warning('Unknown error while loading certificate from file '
                    '%s' % conn.client_cert)
            else:
                log.info('PKCS12 Client cert loaded OK')
                try:
                    tcpsock._sslContext.use_certificate(p12.get_certificate())
                    tcpsock._sslContext.use_privatekey(p12.get_privatekey())
                    log.info('p12 cert and key loaded')
                except OpenSSL.crypto.Error as exception_obj:
                    log.warning('Unable to extract client certificate from '
                        'file %s' % conn.client_cert)
                except Exception as msg:
                    log.warning('Unknown error extracting client certificate '
                        'from file %s: %s' % (conn.client_cert, msg))
                else:
                    log.info('client cert and key loaded OK')
        else:
            # See http://docs.python.org/dev/library/ssl.html
            tcpsock._sslContext = OpenSSL.SSL.Context(OpenSSL.SSL.SSLv23_METHOD)
            flags = OpenSSL.SSL.OP_NO_SSLv2 | OpenSSL.SSL.OP_SINGLE_DH_USE
            try:
                flags |= OpenSSL.SSL.OP_NO_TICKET
            except AttributeError as e:
                # py-OpenSSL < 0.9 or old OpenSSL
                flags |= 16384
            tcpsock._sslContext.set_options(flags)

        tcpsock.ssl_errnum = []
        tcpsock._sslContext.set_verify(OpenSSL.SSL.VERIFY_PEER,
            self._ssl_verify_callback)
        tcpsock._sslContext.set_cipher_list('HIGH:!aNULL:!eNULL:RC4-SHA')
        store = tcpsock._sslContext.get_cert_store()
        self._load_cert_file(self.cacerts, store)
        self._load_cert_file(self.mycerts, store)
        if os.path.isdir('/etc/ssl/certs'):
            for f in os.listdir('/etc/ssl/certs'):
                # We don't logg because there is a lot a duplicated certs in this
                # folder
                self._load_cert_file(os.path.join('/etc/ssl/certs', f), store,
                        logg=False)

        tcpsock._sslObj = OpenSSL.SSL.Connection(tcpsock._sslContext,
                tcpsock._sock)
        tcpsock._sslObj.set_connect_state() # set to client mode
        wrapper = PyOpenSSLWrapper(tcpsock._sslObj)
        tcpsock._recv = wrapper.recv
        tcpsock._send = wrapper.send

        log.debug("Initiating handshake...")
        try:
            tcpsock._sslObj.do_handshake()
        except (OpenSSL.SSL.WantReadError, OpenSSL.SSL.WantWriteError) as e:
            pass
        except:
            log.error('Error while TLS handshake: ', exc_info=True)
            return False
        self._owner.ssl_lib = PYOPENSSL
        return True