Skip to content

gh-150898: Assume OpenSSL supports keylogging#150870

Open
robsdedude wants to merge 3 commits into
python:mainfrom
robsdedude:ssl-keylogfile-always-supported
Open

gh-150898: Assume OpenSSL supports keylogging#150870
robsdedude wants to merge 3 commits into
python:mainfrom
robsdedude:ssl-keylogfile-always-supported

Conversation

@robsdedude
Copy link
Copy Markdown
Contributor

@robsdedude robsdedude commented Jun 3, 2026

Since version 3.10, CPython requires OpenSSL 1.1.1 or higher.
Therefore, support for keylogging is always available.

Initially I was confused by the docs for create_default_context stating

When keylog_filename is supported [...]

but the docs for keylog_filename not mentioning why or how it could be
unsupported.

Looking at the C code also confirms that keylog_filename is always defined:

cpython/Modules/_ssl.c

Lines 5733 to 5734 in 7a468a1

{"keylog_filename", _PySSLContext_get_keylog_filename,
_PySSLContext_set_keylog_filename, NULL},

vs in 3.9 where it was not always present:

cpython/Modules/_ssl.c

Lines 4891 to 4894 in 0bbaf5d

#ifdef HAVE_OPENSSL_KEYLOG
{"keylog_filename", (getter) _PySSLContext_get_keylog_filename,
(setter) _PySSLContext_set_keylog_filename, NULL},
#endif

Closes: gh-150898

Since version 3.10, CPython requires OpenSSL 1.1.1 or higher.
Therefore, support for keylogging can be assumed.
@read-the-docs-community
Copy link
Copy Markdown

read-the-docs-community Bot commented Jun 3, 2026

Documentation build overview

📚 cpython-previews | 🛠️ Build #32986427 | 📁 Comparing 7776cf1 against main (7a468a1)

  🔍 Preview build  

2 files changed
± library/ssl.html
± whatsnew/changelog.html

@robsdedude robsdedude marked this pull request as ready for review June 3, 2026 19:50
@picnixz
Copy link
Copy Markdown
Member

picnixz commented Jun 3, 2026

Yes please create an issue and a NEWS entry. I will not backport this though.

@robsdedude robsdedude changed the title Assume OpenSSL supports keylogging gh-150898: Assume OpenSSL supports keylogging Jun 4, 2026
Comment thread Lib/test/test_ssl.py
@robsdedude
Copy link
Copy Markdown
Contributor Author

Issue created and linked. For the news-entry, I'm not so sure what to put in there. Nothing of this really concerns the user (besides the docs). https://devguide.python.org/getting-started/pull-request-lifecycle/#updating-news-and-what-s-new-in-python says about this:

Most changes made to the codebase deserve an entry in Misc/NEWS.d, except for the following:

  • documentation changes
  • test changes
  • strictly internal changes with no user-visible effects
  • [...]

This PR is exactly all of those 3. I've drafted a news entry anyway. Let me know what you think.

@picnixz
Copy link
Copy Markdown
Member

picnixz commented Jun 4, 2026

I would prefer having it for those who use an alternative implementation, just in case. Idk if all AWS-LC versions support this or if BoringSSL does. So for a NEWS entry, just say that it is now unconditionally assumed to exist.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Pre-OpenSSL 1.1.1 left-overs for keylog_filename

3 participants