RSS Amplifier

menno.io · Sep 8, 2015

TLS Changes in IMAPClient 1.0

Read inOriginalenesdefrptjaittr
0
Sign in to vote or save

This page cannot be shown here. You can still read it on the original site — the toolbar below keeps your place in the directory.

IMAPClient 1.0 is really close to being done now and it's going to be one of the biggest releases in its history (thanks largely to the support of the good people at Nylas ). The headline feature of this release is the completely revamped TLS support. With 1.0, IMAPClient will perform certificate verification, certificate hostname checking, and will not use known-insecure TLS settings and…

IMAPClient 1.0 is really</strong> close to being done now and it's going to be one of the biggest releases in its history (thanks largely to the support of the good people at Nylas</a>).</p>

The headline feature of this release is the completely revamped TLS</a> support. With 1.0, IMAPClient will perform certificate verification, certificate hostname checking, and will not use known-insecure TLS settings and protocols - by default</em>. In order to work around Python historically patchy TLS support1</a></sup>, IMAPClient uses backports.ssl</a> and pyOpenSSL</a> to provide consistent TLS functionality across all supported Python versions (2.6, 2.7, 3.3 and 3.4).</p>

All this goodness doesn't come for free however. There were some compromises and compatibility breaks required to make it work:</p>

  1. Due to lack of support in some of the new dependencies, IMAPClient no longer supports Python 3.2.</li>
  2. The keyword arguments that were accepted by the IMAPClient constructor to pass through to imaplib's IMAP4 constructor are no longer supported. This was in place to provide access to imaplib's SSL arguments which are no longer relevant. Please pass a SSL context object instead.</li>
  3. When using the default SSL context that IMAPClient creates (recommended), certificate verification is enabled and various bad TLS settings are disabled. This means that IMAPClient may fail to establish TLS connections to servers that used to work with previous versions of IMAPClient (especially if a self-signed certificate is used by the server). Fortunately it's not difficult to supply your own CA certificates or disable verification if required.</li> </ol>

    There's a new section in the manual</a> which has more details and includes examples of how to tweak the SSL context for some common scenarios.</p>

    For those willing to try out the changes now please install from IMAPClient's tip. Any feedback would be hugely appreciated.</p>

Read on /posts/imapclient-1.0-tls/ ↗

Comments

Nothing yet. Say the first thing.

    Sign in to join the conversation.