@@ -1330,7 +1330,7 @@ to speed up repeated connections from the same clients.
13301330
13311331 import socket, ssl
13321332
1333- context = ssl.SSLContext(ssl.PROTOCOL_TLSv1 )
1333+ context = ssl.SSLContext(ssl.PROTOCOL_TLS )
13341334 context.verify_mode = ssl.CERT_REQUIRED
13351335 context.check_hostname = True
13361336 context.load_default_certs()
@@ -1536,7 +1536,7 @@ If you prefer to tune security settings yourself, you might create
15361536a context from scratch (but beware that you might not get the settings
15371537right)::
15381538
1539- >>> context = ssl.SSLContext(ssl.PROTOCOL_SSLv23 )
1539+ >>> context = ssl.SSLContext(ssl.PROTOCOL_TLS )
15401540 >>> context.verify_mode = ssl.CERT_REQUIRED
15411541 >>> context.check_hostname = True
15421542 >>> context.load_verify_locations("/etc/ssl/certs/ca-bundle.crt")
@@ -1808,6 +1808,23 @@ successful call of :func:`~ssl.RAND_add`, :func:`~ssl.RAND_bytes` or
18081808:func: `~ssl.RAND_pseudo_bytes ` is sufficient.
18091809
18101810
1811+ .. ssl-libressl:
1812+
1813+ LibreSSL support
1814+ ----------------
1815+
1816+ LibreSSL is a fork of OpenSSL 1.0.1. The ssl module has limited support for
1817+ LibreSSL. Some features are not available when the ssl module is compiled
1818+ with LibreSSL.
1819+
1820+ * LibreSSL >= 2.6.1 no longer supports NPN. The methods
1821+ :meth: `SSLContext.set_npn_protocols ` and
1822+ :meth: `SSLSocket.selected_npn_protocol ` are not available.
1823+ *:meth: `SSLContext.set_default_verify_paths ` ignores the env vars
1824+ :envvar: `SSL_CERT_FILE ` and:envvar: `SSL_CERT_PATH ` although
1825+ :func: `get_default_verify_paths ` still reports them.
1826+
1827+
18111828..seealso ::
18121829
18131830 Class:class: `socket.socket `