diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 852091c02ec9a4..a210cae9d7a993 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -642,6 +642,17 @@ Constants .. versionadded:: 3.4.4 +.. data:: VERIFY_X509_PARTIAL_CHAIN + + Possible value for :attr:`SSLContext.verify_flags`. It instructs OpenSSL to + accept intermediate CAs in the trust store to be treated as trust-anchors, + in the same way as the self-signed root CA certificates. This makes it + possible to trust certificates issued by an intermediate CA without having + to trust its ancestor root CA. + + .. versionadded:: 3.10 + + .. class:: VerifyFlags :class:`enum.IntFlag` collection of VERIFY_* constants. diff --git a/Misc/ACKS b/Misc/ACKS index a505a3d7840369..ec27a6bc507f38 100644 --- a/Misc/ACKS +++ b/Misc/ACKS @@ -153,6 +153,7 @@ Michel Van den Bergh Julian Berman Brice Berna Olivier Bernard +Vivien Bernet-Rollande Maxwell Bernstein Eric Beser Steven Bethard diff --git a/Misc/NEWS.d/next/Library/2020-06-02-21-32-33.bpo-40849.zpeKx3.rst b/Misc/NEWS.d/next/Library/2020-06-02-21-32-33.bpo-40849.zpeKx3.rst new file mode 100644 index 00000000000000..032a65d9963b7b --- /dev/null +++ b/Misc/NEWS.d/next/Library/2020-06-02-21-32-33.bpo-40849.zpeKx3.rst @@ -0,0 +1 @@ +Expose X509_V_FLAG_PARTIAL_CHAIN ssl flag diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 5fe65a8a1d6dff..a2e96399317192 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -6112,6 +6112,11 @@ PyInit__ssl(void) X509_V_FLAG_TRUSTED_FIRST); #endif +#ifdef X509_V_FLAG_PARTIAL_CHAIN + PyModule_AddIntConstant(m, "VERIFY_X509_PARTIAL_CHAIN", + X509_V_FLAG_PARTIAL_CHAIN); +#endif + /* Alert Descriptions from ssl.h */ /* note RESERVED constants no longer intended for use have been removed */ /* http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6 */