René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Add ssl.HAS_PHA to detect libssl PHA support","articleBody":"# Feature or enhancement\n\n### Proposal:\n\n[TLSv1.3 post-handshake client authentication](https://datatracker.ietf.org/doc/html/rfc8446#section-4.2.6) (PHA), often referred to as \"mutual TLS\" or \"mTLS\", allows TLS servers to authenticate client identities using digital certificates. Some TLS libraries do not implement PHA, including actively maintained and widely used libraries such as [AWS-LC](https://github.com/aws/aws-lc/) and [BoringSSL](https://github.com/google/boringssl/).\n\nThis issue proposes the addition of a boolean property `ssl.HAS_PHA` to indicate whether the crypto library CPython is built against supports PHA, allowing python's test suite and consuming modules to branch accordingly.\n\nThis feature has precedent in the `ssl.HAS_PSK` flag indicating support for another TLS feature that is not universally implemented across TLS libraries.\n\n### Has this already been discussed elsewhere?\n\nThis is a minor feature, which does not need previous discussion elsewhere\n\n### Links to previous discussion of this feature:\n\nRelated changes to increase libcrypto/libssl compatibility (specifically with AWS-LC) have been discussed with the community [here](https://discuss.python.org/t/support-building-ssl-and-hashlib-modules-against-aws-lc/44505/2).\n\n\u003c!-- gh-linked-prs --\u003e\n### Linked PRs\n* gh-128036\n\u003c!-- /gh-linked-prs --\u003e\n","author":{"url":"https://github.com/WillChilds-Klein","@type":"Person","name":"WillChilds-Klein"},"datePublished":"2024-12-17T16:29:33.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":1},"url":"https://github.com/128035/cpython/issues/128035"}