[3.7] bpo-30622: Improve NPN support detection (GH-5859) (#5860)
The ssl module now detects missing NPN support in LibreSSL.
Co-Authored-By: Bernard Spil <brnrd@FreeBSD.org>
Signed-off-by: Christian Heimes <christian@python.org>
(cherry picked from commit 6cdb7954b0a578d899e4b78b868ea59eef08480a)
Co-authored-by: Christian Heimes <christian@python.org>
diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst
index 4cad9f6..7371024 100644
--- a/Doc/library/ssl.rst
+++ b/Doc/library/ssl.rst
@@ -2434,6 +2434,23 @@
:func:`~ssl.RAND_pseudo_bytes` is sufficient.
+.. ssl-libressl:
+
+LibreSSL support
+----------------
+
+LibreSSL is a fork of OpenSSL 1.0.1. The ssl module has limited support for
+LibreSSL. Some features are not available when the ssl module is compiled
+with LibreSSL.
+
+* LibreSSL >= 2.6.1 no longer supports NPN. The methods
+ :meth:`SSLContext.set_npn_protocols` and
+ :meth:`SSLSocket.selected_npn_protocol` are not available.
+* :meth:`SSLContext.set_default_verify_paths` ignores the env vars
+ :envvar:`SSL_CERT_FILE` and :envvar:`SSL_CERT_PATH` although
+ :func:`get_default_verify_paths` still reports them.
+
+
.. seealso::
Class :class:`socket.socket`