This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

Author christian.heimes
Recipients EA, christian.heimes
Date 2019-03-31.19:46:18
SpamBayes Score -1.0
Marked as misclassified Yes
Message-id <1554061578.65.0.735068349993.issue36484@roundup.psfhosted.org>
In-reply-to
Content
I don't have plans to implement cipher suite selection for TLS 1.3 any time soon, maybe not at all. TLS 1.3 changed cipher selection a lot, making the API more complicated. The signature algorithm and key agreement groups are handled as separate extensions, resulting in three additional APIs.

Applications shouldn't modify the cipher suites any more. These days TLS libraries provide a good and safe selection of suites. Weak ciphers should be disabled by either a security update of the TLS library or system-wide settings. 

There is one workaround: You can influence connection parameters with an OpenSSL config file [1][2] by setting OPENSSL_CONF env var. OpenSSL parses the file only once, so you have to set it before you start Python.

[1] https://www.openssl.org/docs/manmaster/man5/config.html
[2] https://fedoraproject.org/wiki/Changes/CryptoPolicy
History
Date User Action Args
2019-03-31 19:46:18christian.heimessetrecipients: + christian.heimes, EA
2019-03-31 19:46:18christian.heimessetmessageid: <1554061578.65.0.735068349993.issue36484@roundup.psfhosted.org>
2019-03-31 19:46:18christian.heimeslinkissue36484 messages
2019-03-31 19:46:18christian.heimescreate