Hello,

I'd like to suggest adding a simple note to SSLSocket.getpeercert stating that it will always return None if do_handshake has never been called.

This is not the default behaviour, by default SSLSocket.__init__'s do_handshake_on_connect is True so .getpeercert nicely returns a cert (assuming the usual caveats - the other side offers a certificate and cert_reqs is not CERT_NONE).

However, I've just been debugging a someone else's server and I spent some time figuring out why client certificates weren't available - turned out this was because do_handshake was never called (PySSL_SSLdo_handshake in _ssl.c).

Adding a single-sentence line will certainly be very helpful.

Many thanks!

To be honest I'd rather have it raise an exception in that case. None isn't helpful as it could mean other things.

> None isn't helpful as it could mean other things.

This is another story but yes, it's true. API-wise, None should be returned in one situation only - we're on server side, ca_certs is non-CERT_NONE, do_handshake has been called yet there is no client certificate. And no other checks should be applied.

But the current behavior of returning None is documented and people depend on it so straightening it out would break backward compatibility - it's up to you to decide. I wouldn't mind it personally. 

But as far as this ticket goes - I'm on 2.7 and it's set in stone so for 2.7 - can you please change copy only? If you decide that for 3.x an exception will be raised then such a caveat would be included in 2.7 docs as well.

Thanks again.

> But the current behavior of returning None is documented and people
> depend on it so straightening it out would break backward
> compatibility - it's up to you to decide. I wouldn't mind it
> personally.

I'm not sure people depend on getpeercert() returning None before the
handshake is done, or perhaps by accident?

> But as far as this ticket goes - I'm on 2.7 and it's set in stone so
> for 2.7 - can you please change copy only? If you decide that for
> 3.x an exception will be raised then such a caveat would be included
> in 2.7 docs as well.

Yes, if we change behaviour it will only be in 3.4.

> I'm not sure people depend on getpeercert() returning None before the
> handshake is done, or perhaps by accident?

Ah, no, I meant that people may depend on the documented behaviour of .getpeercert's returning an empty dict (which I mixed up with returning None) if the certificate was not validated.

That this dictionary's contents depends on the validation is a bit quirky but it's documented so changing that one would surely break existing code.

New changeset ddcdf7f7eac8 by Antoine Pitrou in branch 'default':
Issue #19095: SSLSocket.getpeercert() now raises ValueError when the SSL handshake hasn't been done.
http://hg.python.org/cpython/rev/ddcdf7f7eac8

Change committed in 3.4. Thanks for reporting!