Repository navigation
TLSv1.3 should be among possible return values of ssl.SSLSocket.version #154727
Description
Documentation
Currently the https://docs.python.org/3.15/library/ssl.html#ssl.SSLSocket.version doc states:
Return the actual SSL protocol version negotiated by the connection as a string, or None if no secure connection is established. As of this writing, possible return values include "SSLv2", "SSLv3", "TLSv1", "TLSv1.1" and "TLSv1.2". Recent OpenSSL versions may define more return values.
I got TLSv1.3:
>>> import socket
... import ssl
...
... hostname = 'lebihan.pl'
... context = ssl.create_default_context()
...
... with socket.create_connection((hostname, 443)) as sock:
... with context.wrap_socket(sock, server_hostname=hostname) as ssock:
... print(ssock.version())
...
TLSv1.3
Activity
StanFromIreland commentedon Jul 26, 2026
Note that it says "possible" return values, not "all" return values, and it explicitly adds that "recent OpenSSL versions may define more return values." I don't think we need to enumerate every possible return value here.
mimi89999 commentedon Jul 26, 2026
I get not wanting a full list, but TLSv1.3 isn't just another possible value. It's the only one missing for full coverage, and adding it removes any ambiguity.
picnixz commentedon Jul 27, 2026
We require OpenSSL 1.1.1 dor the minimum requirement. If TLSv1.3 is present there (i do not remember) we can add it otherwise we do not.
mimi89999 commentedon Jul 27, 2026
It is: https://github.com/openssl/openssl/wiki/TLS1.3
picnixz commentedon Jul 27, 2026
I guess we can add it then!
picnixz commentedon Jul 27, 2026
However in OSSL 4, IIRC some are removed so we should way "more recent may define more or less"
Export wave-2 docs-quick patches (pythongh-154727/148216/138352/101332)
nightcityblade commentedon Jul 27, 2026
Hi, I'd like to work on this. I'll submit a PR shortly.
picnixz commentedon Jul 27, 2026
Let's first ask if the OP wants to, this is the minimal courtesy. cc @mimi89999
mimi89999 commentedon Jul 27, 2026
Thanks. I added it in #154785
mimi89999 commentedon Jul 28, 2026
I've thought about this more and I'd like to walk back my suggestion.
SSLSocket.version()just forwards toSSL_get_version(), so the string isn't defined by CPython at all. It comes from whatever TLS library Python is linked against, which can vary by distribution and version. That means the docs can't really pin down the set of values.So instead of adding TLSv1.3 to the list, it might be better to say the value is produced by the underlying library and link to its docs:
https://docs.openssl.org/master/man3/SSL_get_version/#return-values
Listing the values is what made me assume they were exhaustive in the first place 😅, so making the indirection visible seems more useful than keeping a list.
pythongh-154727: Document that SSLSocket.version() comes from the TLS…