Fb 001 #4
Fb 001 #4
Conversation
enabled TLSv1_2 and TLSv1_3 enabled perfect forward secrecy ciphers
bumped version to 0.8.8
Changes - Force TLS1.2+ - Force perfect forward secrecy
|
addresses open issue #3 |
removed change to _query method to simplify code review
To work around missing SSLContext.minimum_version logic.
|
@aaront This looks like a false positive. Can you please review and/or update the 2.7 test suite? |
|
Hi @aaront. Your test case appears to be failing trying to establish an SSLv3 session. This is a false positive. The test should fail. Please advise. |
Reduced the number of touched files.
Downgraded from P-521 to P-384. secp521r1 : NIST/SECG curve over a 521 bit prime field secp384r1 : NIST/SECG curve over a 384 bit prime field
|
@aaront. I could be wrong but it looks like the test suite is still borken. requests.exceptions.SSLError: HTTPSConnectionPool(host='my.geotab.com', port=443): Max retries exceeded with url: /apiv1 (Caused by SSLError(SSLError(1, '[SSL: SSLV3_ALERT_HANDSHAKE_FAILURE] sslv3 alert handshake failure (_ssl.c:1131)'))) |
|
@B3K7 not sure it's the test suite, I made some changes that work in c0f71cd and seems to handle the recommendation from the Python SSL docs to not specify a version of TLS, but rather use I'm a bit hesitant specifying ciphers in the API call itself. It was under my impression that the server and client will use the best available, and maybe by no longer specifying TLS 1.2 as the SSL protocol, it may be more strict if you're using TLS 1.3. |
Why what was enabled/disabled.
Changes