[issue18233] SSLSocket.getpeercertchain()

[Kent Watsen]

Kent Watsen <kent+python at watsen.net> added the comment:

I agree that having both would be best, but there is a world of difference between a must-have (peer_cert_chain) and what seems to be a nice-to-have (authed_peer_cert_chain).

My request for clarification was not that I don't understand bags, etc. (see my first message), but that I don't understand the concrete use case in mind.  That is, when is it that the app-logic would differ because the EE cert validated using one path versus another?

To explain the 'must-have' better, imagine one peer sending [A, B, C], where 'A' is the EE cert, and the other peer having TA [F, E, D], where 'F' is the self-signed root TA and 'D' is the Issuer that signed 'C'.  The complete chain is [A-F] and this is what the SSL-level code will use during the handshake.  But post-handshake, without peer_chain_cert(), there is NO WAY for the app-logic to create a valid chain.  This is broken, for the reason mentioned in my first message.

----------

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue18233>
_______________________________________