>> A simple "IOError No such file or directory 'xxx'" exception would be
>> a lot more clear.
> Agreed, but the OpenSSL error reporting system looks too convoluted (or
> braindead) to easily allow such aliasing of errors. If you have an 
> idea, don't hesitate to share :)

The only idea which comes to mind is try to open() the file before calling load_cert_chain().
That would automatically also take care of permission errors, etc..
Not very clean, but... :-\

>> If possible, the error should be more clear about what happened.
>> Something like "malformed certfile was provided" or something.
> Same as above: the error message and numeric code come from OpenSSL, not
> from us.

No ideas here. I googled for some OpenSSL API to verify the certificate, which we can even possibly expose in ssl.py, but I couldn't find any. I guess we can't do nothing about this.