René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"[doc] Explain TLS/SSL gotchas","articleBody":"TLS/SSL and X.509 are tricky. OpenLDAP adds some additional gotchas to the stack. We should document them so users don't run into issues like https://github.com/pyldap/pyldap/issues/53\r\n\r\n* ``start_tls_s()`` requires protocol version 3. It does not work with protocol version 2.\r\n* Several, perhaps all ``set_option(OPT_X_TLS_*, ...)`` calls require a final ``set_option(ldap.OPT_X_TLS_NEWCTX, 0)`` call to submit all previous ``set_option()`` calls. Without ``OPT_X_TLS_NEWCTX``, settings are effectively ignored. \r\n\r\n```\r\n        l.set_option(ldap.OPT_PROTOCOL_VERSION, ldap.VERSION3)\r\n        l.set_option(ldap.OPT_X_TLS_CACERTFILE, 'path/to/ca.pem')\r\n        l.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap. OPT_X_TLS_NEVER)\r\n        l.set_option(ldap.OPT_X_TLS_NEWCTX, 0)\r\n```\r\n\r\n* [ ] emit warning when ``OPT_X_TLS_NEWCTX`` is required\r\n* [ ] emit warning when connection is already established and ``OPT_X_TLS_*`` are useless.","author":{"url":"https://github.com/tiran","@type":"Person","name":"tiran"},"datePublished":"2017-11-29T10:38:38.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":15},"url":"https://github.com/55/python-ldap/issues/55"}