[TLS 1.3] Add post-handshake auth support
Open
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 944
- Forks
- 440
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 6
Description
TLS 1.3 introduced post-handshake authentication for TLS client certs. The feature is required for e.g. HTTP servers that require TLS client cert authentication depending on HTTP method and/or path.
- https://bugs.python.org/issue34670
- https://www.openssl.org/docs/manmaster/man3/SSL_CTX_set_post_handshake_auth.html
PyCA cryptography needs to expose:
int SSL_verify_client_post_handshake(SSL *ssl)void SSL_CTX_set_post_handshake_auth(SSL_CTX *ctx, int val)void SSL_set_post_handshake_auth(SSL *ssl, int val)SSL_VERIFY_POST_HANDSHAKE
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reading the linked Python issue 34670 and the OpenSSL SSL_CTX_set_post_handshake_auth documentation. Locate the existing OpenSSL TLS wrapper entry points for SSL and SSL_CTX, then compare their exposure of the four requested symbols. Done means the requested functions and SSL_VERIFY_POST_HANDSHAKE are available through the Python API with coverage for the supported OpenSSL versions.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100