> None isn't helpful as it could mean other things.

This is another story but yes, it's true. API-wise, None should be returned in one situation only - we're on server side, ca_certs is non-CERT_NONE, do_handshake has been called yet there is no client certificate. And no other checks should be applied.

But the current behavior of returning None is documented and people depend on it so straightening it out would break backward compatibility - it's up to you to decide. I wouldn't mind it personally. 

But as far as this ticket goes - I'm on 2.7 and it's set in stone so for 2.7 - can you please change copy only? If you decide that for 3.x an exception will be raised then such a caveat would be included in 2.7 docs as well.

Thanks again.