Pyjo.IOLoop.TLS - Non-blocking TLS handshake

import Pyjo.IOLoop.TLS

# Negotiate TLS
tls = Pyjo.IOLoop.TLS.new(old_handle)
tls.on('upgrade', lambda tls, new_handle: ...)
tls.on('error', lambda tls, err: ...)
tls.negotiate(server=True)

# Start reactor if necessary
if not tls.reactor.is_running:
    tls.reactor.start()

Pyjo.IOLoop.TLS negotiates TLS for Pyjo.IOLoop, with the ssl module of the standard library.

The end of a with block closes the connection of the handshake.

Events

Pyjo.IOLoop.TLS inherits all events from Pyjo.EventEmitter and can emit the following new ones.

upgrade

tls.on('upgrade', lambda tls, handle: ...)

Emitted once TLS has been negotiated, with the ssl.SSLSocket.

error

tls.on('error', lambda tls, err: ...)

Emitted if an error occurs during negotiation, fatal if unhandled.

See also

Pyjoyment, https://mojolicious.org.

Ported from Mojo::IOLoop::TLS of Mojolicious 9.49.

class Pyjo.IOLoop.TLS.Pyjo_IOLoop_TLS(handle: Any = None)

Pyjo.IOLoop.TLS inherits all methods from Pyjo.EventEmitter and implements the following new ones.

classmethod can_tls() → bool

boolean = Pyjo.IOLoop.TLS.object.can_tls()

True if TLS support is enabled, as it is unless the PYJO_NO_TLS environment variable is set.

close() → None

tls.close()

Close the connection of the handshake, as the end of a with block does.

negotiate(**options: Any) → None

tls.negotiate(server=True)
tls.negotiate(tls_ca='/etc/tls/ca.crt')

Negotiate TLS.

These options are currently available:

address

address='mojolicious.org'

Name of the server, for SNI and the verification of its certificate on the client-side.

server

server=True

Negotiate TLS from the server-side, defaults to the client-side.

tls_ca

tls_ca='/etc/tls/ca.crt'

Path to TLS certificate authority file. On the server-side, a client certificate is then required.

tls_cert

tls_cert='/etc/tls/server.crt'
tls_cert={'mojolicious.org': '/etc/tls/mojo.crt'}

Path to the TLS cert file, defaults to a built-in test certificate on the server-side.

tls_context

tls_context=ssl.create_default_context()

The ssl.SSLContext to use instead of the one that the other options make.

tls_hostname

tls_hostname='mojolicious.org'
tls_hostname=''

Name of the server for SNI and the verification of its certificate on the client-side instead of address, an empty one for no SNI.

tls_key

tls_key='/etc/tls/server.key'
tls_key={'mojolicious.org': '/etc/tls/mojo.key'}

Path to the TLS key file, defaults to a built-in test key on the server-side.

property reactor: Pyjo_Reactor

reactor = tls.reactor
tls.reactor = Pyjo.Reactor.Poll.new()

Low-level event reactor, defaults to the reactor attribute value of the global Pyjo.IOLoop singleton. Note that this attribute is weakened.

Pyjo.IOLoop.TLS.context(**options: Any) → SSLContext

context = context(server=True, tls_cert='/etc/tls/server.crt', tls_key='/etc/tls/server.key')

The ssl.SSLContext that Pyjo_IOLoop_TLS.negotiate() makes of its options. A context of a server sends no session tickets of TLS 1.3 on Windows, where a client that closes the connection right after its handshake would make the handshake of the server fail.