[issue38036] ssl docs say that ssl.SSLContext() is secure-by-default since 3.6, but it isn't

[Christian Heimes]

Christian Heimes <lists at cheimes.de> added the comment:

Indeed, the text is misleading. "secure default values" refers to SSLContext.options only (no compression, "good" TLS versions) and not to cert and host name verification.

----------

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue38036>
_______________________________________