[issue28695] Add SSL_CTX_set_client_cert_engine

Change by Bryan Hunt : -- nosy: +bryguy ___ Python tracker ___ ___ Python-bugs-list mailing list Unsubscribe:

[issue28695] Add SSL_CTX_set_client_cert_engine

Change by Christian Heimes : -- versions: +Python 3.8 -Python 3.7 ___ Python tracker ___

[issue28695] Add SSL_CTX_set_client_cert_engine

Gennady Kovalev added the comment: Ok, thank you. -- ___ Python tracker ___ ___ Python-bugs-list mailing list

[issue28695] Add SSL_CTX_set_client_cert_engine

Christian Heimes added the comment: I haven't started to design the new feature yet. Since it is going to be a new feature and feature freeze of 3.7 is 2018-01-29, I'm going to start working on new stuff around in April or May for PyCon. -- ___

[issue28695] Add SSL_CTX_set_client_cert_engine

Gennady Kovalev added the comment: Is there any news? -- ___ Python tracker ___ ___ Python-bugs-list mailing

[issue28695] Add SSL_CTX_set_client_cert_engine

Andrea Grandi added the comment: What about using OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL) instead of OPENSSL_config()? -- nosy: +Andrea Grandi ___ Python tracker

[issue28695] Add SSL_CTX_set_client_cert_engine

Christian Heimes added the comment: OPENSSL_config() is deprecated. I'm going to wrap CONF_modules_load_file(), CONF_modules_load() and NCONF_load_bio(). -- ___ Python tracker

[issue28695] Add SSL_CTX_set_client_cert_engine

Gennady Kovalev added the comment: Why not to call OPENSSL_config() to use openssl.cnf? --- ./Modules/_ssl.c.orig 2016-12-21 23:30:36.277184891 +0300 +++ ./Modules/_ssl.c2016-12-21 23:35:18.488508435 +0300 @@ -4514,6 +4514,8 @@ PySocketModule = *socket_api; /* Init OpenSSL

[issue28695] Add SSL_CTX_set_client_cert_engine

Changes by Christian Heimes : -- versions: +Python 3.7 ___ Python tracker ___ ___

[issue28695] Add SSL_CTX_set_client_cert_engine

New submission from Christian Heimes: Python's ssl module does not support smartcard authentication of clients. In order to use an external engine like OpenSC's engine_pkcs11, SSLContext must be configured to use a loaded engine for client cert auth. It's really simple. Pseudo code without