Original patch by Jeff McNeil.

Issue #14837: SSL errors now have `library` and `reason` attributes describing precisely what happened and in which OpenSSL submodule.
The str() of a SSLError is also enhanced accordingly.

NOTE: this commit creates a reference leak.  The leak seems tied to the
use of PyType_FromSpec() to create the SSLError type.  The leak is on the
type object when it is instantiated:

>>> e = ssl.SSLError()
>>> sys.getrefcount(ssl.SSLError)
35
>>> e = ssl.SSLError()
>>> sys.getrefcount(ssl.SSLError)
36
>>> e = ssl.SSLError()
>>> sys.getrefcount(ssl.SSLError)
37

The certificate has changed and the test now needs SNI to pass.

Issue #14204: The ssl module now has support for the Next Protocol Negotiation extension, if available in the underlying OpenSSL library.
Patch by Colin Marc.

(except when SSLv2 is explicitly asked for).

SSLContext.load_dh_params() method and the ssl.OP_SINGLE_DH_USE option.

(followup to issue #13627)

key exchange, through the SSLContext.set_ecdh_curve() method and the
ssl.OP_SINGLE_ECDH_USE option.

choose the cipher based on their own preferences, rather than on the
client's.

you don't have to inspect the exception's attributes in the common case.

Issue #13034: When decoding some SSL certificates, the subjectAltName extension could be unreported.

Fix #12835: prevent use of the unencrypted sendmsg/recvmsg APIs on SSL wrapped sockets (Patch by David Watson)

to be used if the private key is encrypted.  Patch by Adam Simpkins.

Remove the SSLSocket versions of sendmsg/recvmsg due to lack of proper tests and documentation in conjunction with lack of any known use cases (see issue #6560 for details)

Add support for the send/recvmsg API to the socket module. Patch by David Watson and Heiko Wundram. (Closes #6560)

to get channel binding data for the current SSL session (only the
"tls-unique" channel binding is implemented).  This allows the
implementation of certain authentication mechanisms such as SCRAM-SHA-1-PLUS.

Patch by Jacek Konieczny.

reset, check the version of the OpenSSL headers Python was compiled against,
rather than the runtime version of the OpenSSL library.

there is not enough entropy.

module.

when the socket's timeout expires (it used to return None).

OpenSSL is now compiled with OPENSSL_NO_SSL2 defined (without the SSLv2
protocol) on Debian: fix the ssl module on Debian Testing and Debian Sid.

Optimize also ssl.get_protocol_name(): speed does matter!

OpenSSL is now compiled with OPENSSL_NO_SSL2 defined (without the SSLv2
protocol) on Debian: fix the ssl module on Debian Testing and Debian Sid.

Optimize also ssl.get_protocol_name(): speed does matter!

dNSName entry, ssl.match_hostname() should use the subject's commonName.
Patch by Nicolas Bareil.

by Charles-François Natali.

svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r88671 | antoine.pitrou | 2011-02-27 16:44:12 +0100 (dim., 27 févr. 2011) | 3 lines

  Follow up to r88664: non-blocking connect-ex() can return EWOULDBLOCK under Windows
........

svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r88664 | antoine.pitrou | 2011-02-27 00:24:06 +0100 (dim., 27 févr. 2011) | 4 lines

  Issue #11326: Add the missing connect_ex() implementation for SSL sockets,
  and make it work for non-blocking connects.
........

and make it work for non-blocking connects.

Patch reviewed by Antoine Pitrou, okayed by Georg Brandl.

svn+ssh://pythondev@svn.python.org/python/branches/py3k

........
  r87861 | antoine.pitrou | 2011-01-08 11:23:29 +0100 (sam., 08 janv. 2011) | 3 lines

  Fix test_ssl after r87849
........
  r87863 | antoine.pitrou | 2011-01-08 11:28:11 +0100 (sam., 08 janv. 2011) | 3 lines

  Add EHOSTUNREACH ('No route to host') to the errnos trapped by transient_internet().
........