TLSv1.3 should be among possible return values of ssl.SSLSocket.version

[mimi89999]

Documentation

Currently the https://docs.python.org/3.15/library/ssl.html#ssl.SSLSocket.version doc states:

Return the actual SSL protocol version negotiated by the connection as a string, or None if no secure connection is established. As of this writing, possible return values include "SSLv2", "SSLv3", "TLSv1", "TLSv1.1" and "TLSv1.2". Recent OpenSSL versions may define more return values.

I got TLSv1.3:

>>> import socket
... import ssl
... 
... hostname = 'lebihan.pl'
... context = ssl.create_default_context()
... 
... with socket.create_connection((hostname, 443)) as sock:
...     with context.wrap_socket(sock, server_hostname=hostname) as ssock:
...         print(ssock.version())
...         
TLSv1.3

Linked PRs

• gh-154727: List TLSv1.3 among SSLSocket.version() return values #154785

[StanFromIreland]

Note that it says "possible" return values, not "all" return values, and it explicitly adds that "recent OpenSSL versions may define more return values." I don't think we need to enumerate every possible return value here.

[mimi89999]

I get not wanting a full list, but TLSv1.3 isn't just another possible value. It's the only one missing for full coverage, and adding it removes any ambiguity.

[picnixz]

We require OpenSSL 1.1.1 dor the minimum requirement. If TLSv1.3 is present there (i do not remember) we can add it otherwise we do not.

[mimi89999]

It is: https://github.com/openssl/openssl/wiki/TLS1.3

[picnixz]

I guess we can add it then!

[picnixz]

However in OSSL 4, IIRC some are removed so we should way "more recent may define more or less"

[nightcityblade]

Hi, I'd like to work on this. I'll submit a PR shortly.

[picnixz]

Let's first ask if the OP wants to, this is the minimal courtesy. cc @mimi89999