> Alternatively all SSLSocket methods should take care not to dereference 
> self._sslobj and they should respond properly - preferably with a
> socket/ssl exception.

In getpeercert()'s case, I think None would be the right thing to return (as cipher() and compression() already do).
But, yes, this deserves fixing.

> One good(?) reason to wrap connected sockets is to be able to use
> socket.create_connection which tries all IP adresses of a fqdn before
> it fails. (Btw: That isn't described in the documentation! That
> confused me while debugging this.)

Which documentation? create_connection's? Feel free to propose an improved wording.