QSslSocket¶
The
QSslSocket
class provides an SSL encrypted socket for both clients and servers. More…
Synopsis¶
Functions¶
def
abort
()def
addCaCertificate
(certificate)def
addCaCertificates
(certificates)def
addCaCertificates
(path[, format=QSsl.Pem[, syntax=QRegExp.FixedString]])def
caCertificates
()def
ciphers
()def
connectToHostEncrypted
(hostName, port, sslPeerName[, mode=QIODevice.ReadWrite[, protocol=AnyIPProtocol]])def
connectToHostEncrypted
(hostName, port[, mode=QIODevice.ReadWrite[, protocol=AnyIPProtocol]])def
encryptedBytesAvailable
()def
encryptedBytesToWrite
()def
flush
()def
ignoreSslErrors
(errors)def
isEncrypted
()def
localCertificate
()def
localCertificateChain
()def
mode
()def
ocspResponses
()def
peerCertificate
()def
peerCertificateChain
()def
peerVerifyDepth
()def
peerVerifyMode
()def
peerVerifyName
()def
privateKey
()def
protocol
()def
sessionCipher
()def
sessionProtocol
()def
setCaCertificates
(certificates)def
setCiphers
(ciphers)def
setCiphers
(ciphers)def
setLocalCertificate
(certificate)def
setLocalCertificate
(fileName[, format=QSsl.Pem])def
setLocalCertificateChain
(localChain)def
setPeerVerifyDepth
(depth)def
setPeerVerifyMode
(mode)def
setPeerVerifyName
(hostName)def
setPrivateKey
(fileName[, algorithm=QSsl.Rsa[, format=QSsl.Pem[, passPhrase=QByteArray()]]])def
setPrivateKey
(key)def
setProtocol
(protocol)def
setSslConfiguration
(config)def
sslConfiguration
()def
sslErrors
()def
sslHandshakeErrors
()def
waitForEncrypted
([msecs=30000])
Slots¶
def
ignoreSslErrors
()def
startClientEncryption
()def
startServerEncryption
()
Signals¶
def
encrypted
()def
encryptedBytesWritten
(totalBytes)def
modeChanged
(newMode)def
newSessionTicketReceived
()def
peerVerifyError
(error)def
preSharedKeyAuthenticationRequired
(authenticator)def
sslErrors
(errors)
Static functions¶
def
addDefaultCaCertificate
(certificate)def
addDefaultCaCertificates
(certificates)def
addDefaultCaCertificates
(path[, format=QSsl.Pem[, syntax=QRegExp.FixedString]])def
defaultCaCertificates
()def
defaultCiphers
()def
setDefaultCaCertificates
(certificates)def
setDefaultCiphers
(ciphers)def
sslLibraryBuildVersionNumber
()def
sslLibraryBuildVersionString
()def
sslLibraryVersionNumber
()def
sslLibraryVersionString
()def
supportedCiphers
()def
supportsSsl
()def
systemCaCertificates
()
Detailed Description¶
QSslSocket
establishes a secure, encrypted TCP connection you can use for transmitting encrypted data. It can operate in both client and server mode, and it supports modern SSL protocols, including SSL 3 and TLS 1.2. By default,QSslSocket
uses only SSL protocols which are considered to be secure (SecureProtocols
), but you can change the SSL protocol by callingsetProtocol()
as long as you do it before the handshake has started.SSL encryption operates on top of the existing TCP stream after the socket enters the
ConnectedState
. There are two simple ways to establish a secure connection usingQSslSocket
: With an immediate SSL handshake, or with a delayed SSL handshake occurring after the connection has been established in unencrypted mode.The most common way to use
QSslSocket
is to construct an object and start a secure connection by callingconnectToHostEncrypted()
. This method starts an immediate SSL handshake once the connection has been established.socket = QSslSocket(self) QObject.connect(socket, SIGNAL("encrypted()"), self, SLOT("ready()")) socket.connectToHostEncrypted("imap.example.com", 993)As with a plain
QTcpSocket
,QSslSocket
enters theHostLookupState
,ConnectingState
, and finally theConnectedState
, if the connection is successful. The handshake then starts automatically, and if it succeeds, theencrypted()
signal is emitted to indicate the socket has entered the encrypted state and is ready for use.Note that data can be written to the socket immediately after the return from
connectToHostEncrypted()
(i.e., before theencrypted()
signal is emitted). The data is queued inQSslSocket
until after theencrypted()
signal is emitted.An example of using the delayed SSL handshake to secure an existing connection is the case where an SSL server secures an incoming connection. Suppose you create an SSL server class as a subclass of
QTcpServer
. You would overrideincomingConnection()
with something like the example below, which first constructs an instance ofQSslSocket
and then callssetSocketDescriptor()
to set the new socket’s descriptor to the existing one passed in. It then initiates the SSL handshake by callingstartServerEncryption()
.def incomingConnection(socketDescriptor): serverSocket = QSslSocket() if serverSocket.setSocketDescriptor(socketDescriptor): QObject.connect(serverSocket, SIGNAL("encrypted()"), self, SLOT("ready()")) serverSocket.startServerEncryption()If an error occurs,
QSslSocket
emits thesslErrors()
signal. In this case, if no action is taken to ignore the error(s), the connection is dropped. To continue, despite the occurrence of an error, you can callignoreSslErrors()
, either from within this slot after the error occurs, or any time after construction of theQSslSocket
and before the connection is attempted. This will allowQSslSocket
to ignore the errors it encounters when establishing the identity of the peer. Ignoring errors during an SSL handshake should be used with caution, since a fundamental characteristic of secure connections is that they should be established with a successful handshake.Once encrypted, you use
QSslSocket
as a regularQTcpSocket
. WhenreadyRead()
is emitted, you can callread()
,canReadLine()
andreadLine()
, orgetChar()
to read decrypted data fromQSslSocket
‘s internal buffer, and you can callwrite()
orputChar()
to write data back to the peer.QSslSocket
will automatically encrypt the written data for you, and emitencryptedBytesWritten()
once the data has been written to the peer.As a convenience,
QSslSocket
supportsQTcpSocket
‘s blocking functionswaitForConnected()
,waitForReadyRead()
,waitForBytesWritten()
, andwaitForDisconnected()
. It also provideswaitForEncrypted()
, which will block the calling thread until an encrypted connection has been established.socket = QSslSocket() socket.connectToHostEncrypted("http.example.com", 443) if not socket.waitForEncrypted(): print socket.errorString() return false socket.write("GET / HTTP/1.0\r\n\r\n") while socket.waitForReadyRead(): print socket.readAll().data()
QSslSocket
provides an extensive, easy-to-use API for handling cryptographic ciphers, private keys, and local, peer, and Certification Authority (CA) certificates. It also provides an API for handling errors that occur during the handshake phase.The following features can also be customized:
The socket’s cryptographic cipher suite can be customized before the handshake phase with
setCiphers()
and QSslConfiguration::setDefaultCiphers().The socket’s local certificate and private key can be customized before the handshake phase with
setLocalCertificate()
andsetPrivateKey()
.The CA certificate database can be extended and customized with
addCaCertificate()
,addCaCertificates()
.To extend the list of default CA certificates used by the SSL sockets during the SSL handshake you must update the default configuration, as in the snippet below:
QList<QSslCertificate> certificates = getCertificates(); QSslConfiguration configuration = QSslConfiguration::defaultConfiguration(); configuration.addCaCertificates(certificates); QSslConfiguration::setDefaultConfiguration(configuration);Note
If available, root certificates on Unix (excluding macOS) will be loaded on demand from the standard certificate directories. If you do not want to load root certificates on demand, you need to call either
defaultConfiguration()
.setCaCertificates()
before the first SSL handshake is made in your application (for example, via passingsystemCaCertificates()
to it), or calldefaultConfiguration()
::setCaCertificates() on yourQSslSocket
instance prior to the SSL handshake.For more information about ciphers and certificates, refer to
QSslCipher
andQSslCertificate
.This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit ( http://www.openssl.org/ ).
Note
Be aware of the difference between the
bytesWritten()
signal and theencryptedBytesWritten()
signal. For aQTcpSocket
,bytesWritten()
will get emitted as soon as data has been written to the TCP socket. For aQSslSocket
,bytesWritten()
will get emitted when the data is being encrypted andencryptedBytesWritten()
will get emitted as soon as data has been written to the TCP socket.See also
- class PySide2.QtNetwork.QSslSocket([parent=None])¶
- param parent:
Constructs a
QSslSocket
object.parent
is passed toQObject
‘s constructor. The new socket’scipher
suite is set to the one returned by the static methoddefaultCiphers()
.
- PySide2.QtNetwork.QSslSocket.SslMode¶
Describes the connection modes available for
QSslSocket
.Constant
Description
QSslSocket.UnencryptedMode
The socket is unencrypted. Its behavior is identical to
QTcpSocket
.QSslSocket.SslClientMode
The socket is a client-side SSL socket. It is either already encrypted, or it is in the SSL handshake phase (see
isEncrypted()
).QSslSocket.SslServerMode
The socket is a server-side SSL socket. It is either already encrypted, or it is in the SSL handshake phase (see
isEncrypted()
).
- PySide2.QtNetwork.QSslSocket.PeerVerifyMode¶
Describes the peer verification modes for
QSslSocket
. The default mode is , which selects an appropriate mode depending on the socket’s QSocket::SslMode.Constant
Description
QSslSocket.VerifyNone
QSslSocket
will not request a certificate from the peer. You can set this mode if you are not interested in the identity of the other side of the connection. The connection will still be encrypted, and your socket will still send its local certificate to the peer if it’s requested.QSslSocket.QueryPeer
QSslSocket
will request a certificate from the peer, but does not require this certificate to be valid. This is useful when you want to display peer certificate details to the user without affecting the actual SSL handshake. This mode is the default for servers. Note: In Schannel this value acts the same as .QSslSocket.VerifyPeer
QSslSocket
will request a certificate from the peer during the SSL handshake phase, and requires that this certificate is valid. On failure,QSslSocket
will emit thesslErrors()
signal. This mode is the default for clients.QSslSocket.AutoVerifyPeer
QSslSocket
will automatically use for server sockets and for client sockets.See also
- PySide2.QtNetwork.QSslSocket.abort()¶
Aborts the current connection and resets the socket. Unlike
disconnectFromHost()
, this function immediately closes the socket, clearing any pending data in the write buffer.See also
disconnectFromHost()
close()
- PySide2.QtNetwork.QSslSocket.addCaCertificate(certificate)¶
- Parameters:
certificate –
PySide2.QtNetwork.QSslCertificate
Note
This function is deprecated.
Use
addCaCertificate()
instead.Adds the
certificate
to this socket’s CA certificate database. The CA certificate database is used by the socket during the handshake phase to validate the peer’s certificate.To add multiple certificates, use
addCaCertificates()
.See also
- PySide2.QtNetwork.QSslSocket.addCaCertificates(certificates)¶
- Parameters:
certificates –
Note
This function is deprecated.
Use
addCaCertificates()
instead.Adds the
certificates
to this socket’s CA certificate database. The CA certificate database is used by the socket during the handshake phase to validate the peer’s certificate.For more precise control, use
addCaCertificate()
.
- PySide2.QtNetwork.QSslSocket.addCaCertificates(path[, format=QSsl.Pem[, syntax=QRegExp.FixedString]])
- Parameters:
path – str
format –
EncodingFormat
syntax –
PatternSyntax
- Return type:
bool
Note
This function is deprecated.
Use
addCaCertificates()
instead.Searches all files in the
path
for certificates encoded in the specifiedformat
and adds them to this socket’s CA certificate database.path
must be a file or a pattern matching one or more files, as specified bysyntax
. Returnstrue
if one or more certificates are added to the socket’s CA certificate database; otherwise returnsfalse
.The CA certificate database is used by the socket during the handshake phase to validate the peer’s certificate.
For more precise control, use
addCaCertificate()
.See also
- static PySide2.QtNetwork.QSslSocket.addDefaultCaCertificate(certificate)¶
- Parameters:
certificate –
PySide2.QtNetwork.QSslCertificate
Note
This function is deprecated.
Use
addCaCertificate()
on the defaultQSslConfiguration
instead.Adds
certificate
to the default CA certificate database. Each SSL socket’s CA certificate database is initialized to the default CA certificate database.See also
- static PySide2.QtNetwork.QSslSocket.addDefaultCaCertificates(certificates)¶
- Parameters:
certificates –
Note
This function is deprecated.
Use
addCaCertificates()
on the defaultQSslConfiguration
instead.Adds
certificates
to the default CA certificate database. Each SSL socket’s CA certificate database is initialized to the default CA certificate database.See also
- static PySide2.QtNetwork.QSslSocket.addDefaultCaCertificates(path[, format=QSsl.Pem[, syntax=QRegExp.FixedString]])
- Parameters:
path – str
format –
EncodingFormat
syntax –
PatternSyntax
- Return type:
bool
Note
This function is deprecated.
Use
addCaCertificates()
on the defaultQSslConfiguration
instead.Searches all files in the
path
for certificates with the specifiedencoding
and adds them to the default CA certificate database.path
can be an explicit file, or it can contain wildcards in the format specified bysyntax
. Returnstrue
if any CA certificates are added to the default database.Each SSL socket’s CA certificate database is initialized to the default CA certificate database.
- PySide2.QtNetwork.QSslSocket.caCertificates()¶
- Return type:
Note
This function is deprecated.
Use
caCertificates()
instead.Returns this socket’s CA certificate database. The CA certificate database is used by the socket during the handshake phase to validate the peer’s certificate. It can be moodified prior to the handshake with
addCaCertificate()
,addCaCertificates()
, andsetCaCertificates()
.Note
On Unix, this method may return an empty list if the root certificates are loaded on demand.
- PySide2.QtNetwork.QSslSocket.ciphers()¶
- Return type:
Note
This function is deprecated.
Use
ciphers()
instead.Returns this socket’s current cryptographic cipher suite. This list is used during the socket’s handshake phase for choosing a session cipher. The returned list of ciphers is ordered by descending preference. (i.e., the first cipher in the list is the most preferred cipher). The session cipher will be the first one in the list that is also supported by the peer.
By default, the handshake phase can choose any of the ciphers supported by this system’s SSL libraries, which may vary from system to system. The list of ciphers supported by this system’s SSL libraries is returned by
supportedCiphers()
. You can restrict the list of ciphers used for choosing the session cipher for this socket by callingsetCiphers()
with a subset of the supported ciphers. You can revert to using the entire set by callingsetCiphers()
with the list returned bysupportedCiphers()
.You can restrict the list of ciphers used for choosing the session cipher for all sockets by calling
setDefaultCiphers()
with a subset of the supported ciphers. You can revert to using the entire set by callingsetCiphers()
with the list returned bysupportedCiphers()
.
- PySide2.QtNetwork.QSslSocket.connectToHostEncrypted(hostName, port[, mode=QIODevice.ReadWrite[, protocol=AnyIPProtocol]])¶
- Parameters:
hostName – str
port –
quint16
mode –
OpenMode
protocol –
NetworkLayerProtocol
Starts an encrypted connection to the device
hostName
onport
, usingmode
as theOpenMode
. This is equivalent to callingconnectToHost()
to establish the connection, followed by a call tostartClientEncryption()
. Theprotocol
parameter can be used to specify which network protocol to use (eg. IPv4 or IPv6).QSslSocket
first enters theHostLookupState
. Then, after entering either the event loop or one of the waitFor…() functions, it enters theConnectingState
, emitsconnected()
, and then initiates the SSL client handshake. At each state change,QSslSocket
emits signalstateChanged()
.After initiating the SSL client handshake, if the identity of the peer can’t be established, signal
sslErrors()
is emitted. If you want to ignore the errors and continue connecting, you must callignoreSslErrors()
, either from inside a slot function connected to thesslErrors()
signal, or prior to entering encrypted mode. IfignoreSslErrors()
is not called, the connection is dropped, signaldisconnected()
is emitted, andQSslSocket
returns to theUnconnectedState
.If the SSL handshake is successful,
QSslSocket
emitsencrypted()
.socket = QSslSocket() QObject.connect(socket, SIGNAL("encrypted()"), receiver, SLOT("socketEncrypted()")) socket.connectToHostEncrypted("imap", 993) socket.write("1 CAPABILITY\r\n")
Note
The example above shows that text can be written to the socket immediately after requesting the encrypted connection, before the
encrypted()
signal has been emitted. In such cases, the text is queued in the object and written to the socket after the connection is established and theencrypted()
signal has been emitted.The default for
mode
isReadWrite
.If you want to create a
QSslSocket
on the server side of a connection, you should instead callstartServerEncryption()
upon receiving the incoming connection throughQTcpServer
.See also
connectToHost()
startClientEncryption()
waitForConnected()
waitForEncrypted()
- PySide2.QtNetwork.QSslSocket.connectToHostEncrypted(hostName, port, sslPeerName[, mode=QIODevice.ReadWrite[, protocol=AnyIPProtocol]])
- Parameters:
hostName – str
port –
quint16
sslPeerName – str
mode –
OpenMode
protocol –
NetworkLayerProtocol
This is an overloaded function.
In addition to the original behaviour of
connectToHostEncrypted
, this overloaded method enables the usage of a different hostname (sslPeerName
) for the certificate validation instead of the one used for the TCP connection (hostName
).See also
- static PySide2.QtNetwork.QSslSocket.defaultCaCertificates()¶
- Return type:
Note
This function is deprecated.
Use
caCertificates()
on the defaultQSslConfiguration
instead.Returns the current default CA certificate database. This database is originally set to your system’s default CA certificate database. If no system default database is found, an empty database will be returned. You can override the default CA certificate database with your own CA certificate database using
setDefaultCaCertificates()
.Each SSL socket’s CA certificate database is initialized to the default CA certificate database.
Note
On Unix, this method may return an empty list if the root certificates are loaded on demand.
- static PySide2.QtNetwork.QSslSocket.defaultCiphers()¶
- Return type:
Note
This function is deprecated.
Use
ciphers()
on the defaultQSslConfiguration
instead.Returns the default cryptographic cipher suite for all sockets in this application. This list is used during the socket’s handshake phase when negotiating with the peer to choose a session cipher. The list is ordered by preference (i.e., the first cipher in the list is the most preferred cipher).
By default, the handshake phase can choose any of the ciphers supported by this system’s SSL libraries, which may vary from system to system. The list of ciphers supported by this system’s SSL libraries is returned by
supportedCiphers()
.See also
- PySide2.QtNetwork.QSslSocket.encrypted()¶
- PySide2.QtNetwork.QSslSocket.encryptedBytesAvailable()¶
- Return type:
int
Returns the number of encrypted bytes that are awaiting decryption. Normally, this function will return 0 because
QSslSocket
decrypts its incoming data as soon as it can.
- PySide2.QtNetwork.QSslSocket.encryptedBytesToWrite()¶
- Return type:
int
Returns the number of encrypted bytes that are waiting to be written to the network.
- PySide2.QtNetwork.QSslSocket.encryptedBytesWritten(totalBytes)¶
- Parameters:
totalBytes – int
- PySide2.QtNetwork.QSslSocket.flush()¶
- Return type:
bool
This function writes as much as possible from the internal write buffer to the underlying network socket, without blocking. If any data was written, this function returns
true
; otherwise false is returned.Call this function if you need
QSslSocket
to start sending buffered data immediately. The number of bytes successfully written depends on the operating system. In most cases, you do not need to call this function, becauseQAbstractSocket
will start sending data automatically once control goes back to the event loop. In the absence of an event loop, callwaitForBytesWritten()
instead.See also
write()
waitForBytesWritten()
- PySide2.QtNetwork.QSslSocket.ignoreSslErrors()¶
This slot tells
QSslSocket
to ignore errors duringQSslSocket
‘s handshake phase and continue connecting. If you want to continue with the connection even if errors occur during the handshake phase, then you must call this slot, either from a slot connected tosslErrors()
, or before the handshake phase. If you don’t call this slot, either in response to errors or before the handshake, the connection will be dropped after thesslErrors()
signal has been emitted.If there are no errors during the SSL handshake phase (i.e., the identity of the peer is established with no problems),
QSslSocket
will not emit thesslErrors()
signal, and it is unnecessary to call this function.Warning
Be sure to always let the user inspect the errors reported by the
sslErrors()
signal, and only call this method upon confirmation from the user that proceeding is ok. If there are unexpected errors, the connection should be aborted. Calling this method without inspecting the actual errors will most likely pose a security risk for your application. Use it with great care!See also
- PySide2.QtNetwork.QSslSocket.ignoreSslErrors(errors)
- Parameters:
errors –
This is an overloaded function.
This method tells
QSslSocket
to ignore only the errors given inerrors
.Note
Because most SSL errors are associated with a certificate, for most of them you must set the expected certificate this SSL error is related to. If, for instance, you want to connect to a server that uses a self-signed certificate, consider the following snippet:
QList<QSslCertificate> cert = QSslCertificate::fromPath(QLatin1String("server-certificate.pem")); QSslError error(QSslError::SelfSignedCertificate, cert.at(0)); QList<QSslError> expectedSslErrors; expectedSslErrors.append(error); QSslSocket socket; socket.ignoreSslErrors(expectedSslErrors); socket.connectToHostEncrypted("server.tld", 443);
Multiple calls to this function will replace the list of errors that were passed in previous calls. You can clear the list of errors you want to ignore by calling this function with an empty list.
See also
- PySide2.QtNetwork.QSslSocket.isEncrypted()¶
- Return type:
bool
Returns
true
if the socket is encrypted; otherwise, false is returned.An encrypted socket encrypts all data that is written by calling
write()
orputChar()
before the data is written to the network, and decrypts all incoming data as the data is received from the network, before you callread()
,readLine()
orgetChar()
.QSslSocket
emitsencrypted()
when it enters encrypted mode.You can call
sessionCipher()
to find which cryptographic cipher is used to encrypt and decrypt your data.See also
- PySide2.QtNetwork.QSslSocket.localCertificate()¶
- Return type:
Returns the socket’s local
certificate
, or an empty certificate if no local certificate has been assigned.See also
- PySide2.QtNetwork.QSslSocket.localCertificateChain()¶
- Return type:
Returns the socket’s local
certificate
chain, or an empty list if no local certificates have been assigned.See also
- PySide2.QtNetwork.QSslSocket.mode()¶
- Return type:
Returns the current mode for the socket; either
UnencryptedMode
, whereQSslSocket
behaves identially toQTcpSocket
, or one ofSslClientMode
orSslServerMode
, where the client is either negotiating or in encrypted mode.When the mode changes,
QSslSocket
emitsmodeChanged()
See also
SslMode
- PySide2.QtNetwork.QSslSocket.newSessionTicketReceived()¶
- PySide2.QtNetwork.QSslSocket.ocspResponses()¶
- Return type:
This function returns Online Certificate Status Protocol responses that a server may send during a TLS handshake using OCSP stapling. The vector is empty if no definitive response or no response at all was received.
See also
- PySide2.QtNetwork.QSslSocket.peerCertificate()¶
- Return type:
Returns the peer’s digital certificate (i.e., the immediate certificate of the host you are connected to), or a null certificate, if the peer has not assigned a certificate.
The peer certificate is checked automatically during the handshake phase, so this function is normally used to fetch the certificate for display or for connection diagnostic purposes. It contains information about the peer, including its host name, the certificate issuer, and the peer’s public key.
Because the peer certificate is set during the handshake phase, it is safe to access the peer certificate from a slot connected to the
sslErrors()
signal or theencrypted()
signal.If a null certificate is returned, it can mean the SSL handshake failed, or it can mean the host you are connected to doesn’t have a certificate, or it can mean there is no connection.
If you want to check the peer’s complete chain of certificates, use
peerCertificateChain()
to get them all at once.See also
- PySide2.QtNetwork.QSslSocket.peerCertificateChain()¶
- Return type:
Returns the peer’s chain of digital certificates, or an empty list of certificates.
Peer certificates are checked automatically during the handshake phase. This function is normally used to fetch certificates for display, or for performing connection diagnostics. Certificates contain information about the peer and the certificate issuers, including host name, issuer names, and issuer public keys.
The peer certificates are set in
QSslSocket
during the handshake phase, so it is safe to call this function from a slot connected to thesslErrors()
signal or theencrypted()
signal.If an empty list is returned, it can mean the SSL handshake failed, or it can mean the host you are connected to doesn’t have a certificate, or it can mean there is no connection.
If you want to get only the peer’s immediate certificate, use
peerCertificate()
.See also
- PySide2.QtNetwork.QSslSocket.peerVerifyDepth()¶
- Return type:
int
Returns the maximum number of certificates in the peer’s certificate chain to be checked during the SSL handshake phase, or 0 (the default) if no maximum depth has been set, indicating that the whole certificate chain should be checked.
The certificates are checked in issuing order, starting with the peer’s own certificate, then its issuer’s certificate, and so on.
See also
- PySide2.QtNetwork.QSslSocket.peerVerifyError(error)¶
- Parameters:
error –
PySide2.QtNetwork.QSslError
- PySide2.QtNetwork.QSslSocket.peerVerifyMode()¶
- Return type:
Returns the socket’s verify mode. This mode decides whether
QSslSocket
should request a certificate from the peer (i.e., the client requests a certificate from the server, or a server requesting a certificate from the client), and whether it should require that this certificate is valid.The default mode is
AutoVerifyPeer
, which tellsQSslSocket
to useVerifyPeer
for clients andQueryPeer
for servers.See also
- PySide2.QtNetwork.QSslSocket.peerVerifyName()¶
- Return type:
str
Returns the different hostname for the certificate validation, as set by
setPeerVerifyName
or byconnectToHostEncrypted
.
- Parameters:
authenticator –
PySide2.QtNetwork.QSslPreSharedKeyAuthenticator
- PySide2.QtNetwork.QSslSocket.privateKey()¶
- Return type:
Returns this socket’s private key.
See also
- PySide2.QtNetwork.QSslSocket.protocol()¶
- Return type:
Returns the socket’s SSL protocol. By default,
SecureProtocols
is used.See also
- PySide2.QtNetwork.QSslSocket.sessionCipher()¶
- Return type:
Returns the socket’s cryptographic
cipher
, or a null cipher if the connection isn’t encrypted. The socket’s cipher for the session is set during the handshake phase. The cipher is used to encrypt and decrypt data transmitted through the socket.QSslSocket
also provides functions for setting the ordered list of ciphers from which the handshake phase will eventually select the session cipher. This ordered list must be in place before the handshake phase begins.
- PySide2.QtNetwork.QSslSocket.sessionProtocol()¶
- Return type:
Returns the socket’s SSL/TLS protocol or UnknownProtocol if the connection isn’t encrypted. The socket’s protocol for the session is set during the handshake phase.
See also
- PySide2.QtNetwork.QSslSocket.setCaCertificates(certificates)¶
- Parameters:
certificates –
Note
This function is deprecated.
Use
setCaCertificates()
instead.Sets this socket’s CA certificate database to be
certificates
. The certificate database must be set prior to the SSL handshake. The CA certificate database is used by the socket during the handshake phase to validate the peer’s certificate.The CA certificate database can be reset to the current default CA certificate database by calling this function with the list of CA certificates returned by
defaultCaCertificates()
.See also
- PySide2.QtNetwork.QSslSocket.setCiphers(ciphers)¶
- Parameters:
ciphers –
Note
This function is deprecated.
- PySide2.QtNetwork.QSslSocket.setCiphers(ciphers)
- Parameters:
ciphers – str
Note
This function is deprecated.
- static PySide2.QtNetwork.QSslSocket.setDefaultCaCertificates(certificates)¶
- Parameters:
certificates –
Note
This function is deprecated.
Use
setCaCertificates()
on the defaultQSslConfiguration
instead.Sets the default CA certificate database to
certificates
. The default CA certificate database is originally set to your system’s default CA certificate database. You can override the default CA certificate database with your own CA certificate database using this function.Each SSL socket’s CA certificate database is initialized to the default CA certificate database.
- static PySide2.QtNetwork.QSslSocket.setDefaultCiphers(ciphers)¶
- Parameters:
ciphers –
Note
This function is deprecated.
Use
setCiphers()
on the defaultQSslConfiguration
instead.Sets the default cryptographic cipher suite for all sockets in this application to
ciphers
, which must contain a subset of the ciphers in the list returned bysupportedCiphers()
.Restricting the default cipher suite only affects SSL sockets that perform their handshake phase after the default cipher suite has been changed.
- PySide2.QtNetwork.QSslSocket.setLocalCertificate(certificate)¶
- Parameters:
certificate –
PySide2.QtNetwork.QSslCertificate
Sets the socket’s local certificate to
certificate
. The local certificate is necessary if you need to confirm your identity to the peer. It is used together with the private key; if you set the local certificate, you must also set the private key.The local certificate and private key are always necessary for server sockets, but are also rarely used by client sockets if the server requires the client to authenticate.
Note
Secure Transport SSL backend on macOS may update the default keychain (the default is probably your login keychain) by importing your local certificates and keys. This can also result in system dialogs showing up and asking for permission when your application is using these private keys. If such behavior is undesired, set the QT_SSL_USE_TEMPORARY_KEYCHAIN environment variable to a non-zero value; this will prompt
QSslSocket
to use its own temporary keychain.See also
- PySide2.QtNetwork.QSslSocket.setLocalCertificate(fileName[, format=QSsl.Pem])
- Parameters:
fileName – str
format –
EncodingFormat
This is an overloaded function.
Sets the socket’s local
certificate
to the first one found in filepath
, which is parsed according to the specifiedformat
.
- PySide2.QtNetwork.QSslSocket.setLocalCertificateChain(localChain)¶
- Parameters:
localChain –
Sets the certificate chain to be presented to the peer during the SSL handshake to be
localChain
.
- PySide2.QtNetwork.QSslSocket.setPeerVerifyDepth(depth)¶
- Parameters:
depth – int
Sets the maximum number of certificates in the peer’s certificate chain to be checked during the SSL handshake phase, to
depth
. Setting a depth of 0 means that no maximum depth is set, indicating that the whole certificate chain should be checked.The certificates are checked in issuing order, starting with the peer’s own certificate, then its issuer’s certificate, and so on.
See also
- PySide2.QtNetwork.QSslSocket.setPeerVerifyMode(mode)¶
- Parameters:
mode –
PeerVerifyMode
Sets the socket’s verify mode to
mode
. This mode decides whetherQSslSocket
should request a certificate from the peer (i.e., the client requests a certificate from the server, or a server requesting a certificate from the client), and whether it should require that this certificate is valid.The default mode is
AutoVerifyPeer
, which tellsQSslSocket
to useVerifyPeer
for clients andQueryPeer
for servers.Setting this mode after encryption has started has no effect on the current connection.
See also
- PySide2.QtNetwork.QSslSocket.setPeerVerifyName(hostName)¶
- Parameters:
hostName – str
Sets a different host name, given by
hostName
, for the certificate validation instead of the one used for the TCP connection.See also
- PySide2.QtNetwork.QSslSocket.setPrivateKey(key)¶
- Parameters:
Sets the socket’s private
key
tokey
. The private key and the localcertificate
are used by clients and servers that must prove their identity to SSL peers.Both the key and the local certificate are required if you are creating an SSL server socket. If you are creating an SSL client socket, the key and local certificate are required if your client must identify itself to an SSL server.
See also
- PySide2.QtNetwork.QSslSocket.setPrivateKey(fileName[, algorithm=QSsl.Rsa[, format=QSsl.Pem[, passPhrase=QByteArray()]]])
- Parameters:
fileName – str
algorithm –
KeyAlgorithm
format –
EncodingFormat
passPhrase –
PySide2.QtCore.QByteArray
This is an overloaded function.
Reads the string in file
fileName
and decodes it using a specifiedalgorithm
and encodingformat
to construct anSSL key
. If the encoded key is encrypted,passPhrase
is used to decrypt it.The socket’s private key is set to the constructed key. The private key and the local
certificate
are used by clients and servers that must prove their identity to SSL peers.Both the key and the local certificate are required if you are creating an SSL server socket. If you are creating an SSL client socket, the key and local certificate are required if your client must identify itself to an SSL server.
See also
- PySide2.QtNetwork.QSslSocket.setProtocol(protocol)¶
- Parameters:
protocol –
SslProtocol
Sets the socket’s SSL protocol to
protocol
. This will affect the next initiated handshake; calling this function on an already-encrypted socket will not affect the socket’s protocol.See also
- PySide2.QtNetwork.QSslSocket.setSslConfiguration(config)¶
- Parameters:
config –
PySide2.QtNetwork.QSslConfiguration
Sets the socket’s SSL configuration to be the contents of
configuration
. This function sets the local certificate, the ciphers, the private key and the CA certificates to those stored inconfiguration
.It is not possible to set the SSL-state related fields.
- PySide2.QtNetwork.QSslSocket.sslConfiguration()¶
- Return type:
Returns the socket’s SSL configuration state. The default SSL configuration of a socket is to use the default ciphers, default CA certificates, no local private key or certificate.
The SSL configuration also contains fields that can change with time without notice.
- PySide2.QtNetwork.QSslSocket.sslErrors()¶
- Return type:
Note
This function is deprecated.
Use
sslHandshakeErrors()
instead.Returns a list of the last SSL errors that occurred. This is the same list as
QSslSocket
passes via the signal. If the connection has been encrypted with no errors, this function will return an empty list.
- PySide2.QtNetwork.QSslSocket.sslErrors(errors)
- Parameters:
errors –
- PySide2.QtNetwork.QSslSocket.sslHandshakeErrors()¶
- Return type:
Returns a list of the last SSL errors that occurred. This is the same list as
QSslSocket
passes via thesslErrors()
signal. If the connection has been encrypted with no errors, this function will return an empty list.See also
- static PySide2.QtNetwork.QSslSocket.sslLibraryBuildVersionNumber()¶
- Return type:
long
Returns the version number of the SSL library in use at compile time. If no SSL support is available then this will return an undefined value.
See also
- static PySide2.QtNetwork.QSslSocket.sslLibraryBuildVersionString()¶
- Return type:
str
Returns the version string of the SSL library in use at compile time. If no SSL support is available then this will return an empty value.
See also
- static PySide2.QtNetwork.QSslSocket.sslLibraryVersionNumber()¶
- Return type:
long
Returns the version number of the SSL library in use. Note that this is the version of the library in use at run-time not compile time. If no SSL support is available then this will return an undefined value.
- static PySide2.QtNetwork.QSslSocket.sslLibraryVersionString()¶
- Return type:
str
Returns the version string of the SSL library in use. Note that this is the version of the library in use at run-time not compile time. If no SSL support is available then this will return an empty value.
- PySide2.QtNetwork.QSslSocket.startClientEncryption()¶
Starts a delayed SSL handshake for a client connection. This function can be called when the socket is in the
ConnectedState
but still in theUnencryptedMode
. If it is not yet connected, or if it is already encrypted, this function has no effect.Clients that implement STARTTLS functionality often make use of delayed SSL handshakes. Most other clients can avoid calling this function directly by using
connectToHostEncrypted()
instead, which automatically performs the handshake.
- PySide2.QtNetwork.QSslSocket.startServerEncryption()¶
Starts a delayed SSL handshake for a server connection. This function can be called when the socket is in the
ConnectedState
but still inUnencryptedMode
. If it is not connected or it is already encrypted, the function has no effect.For server sockets, calling this function is the only way to initiate the SSL handshake. Most servers will call this function immediately upon receiving a connection, or as a result of having received a protocol-specific command to enter SSL mode (e.g, the server may respond to receiving the string “STARTTLS\r\n” by calling this function).
The most common way to implement an SSL server is to create a subclass of
QTcpServer
and reimplementincomingConnection()
. The returned socket descriptor is then passed tosetSocketDescriptor()
.
- static PySide2.QtNetwork.QSslSocket.supportedCiphers()¶
- Return type:
Note
This function is deprecated.
Use
supportedCiphers()
instead.Returns the list of cryptographic ciphers supported by this system. This list is set by the system’s SSL libraries and may vary from system to system.
See also
- static PySide2.QtNetwork.QSslSocket.supportsSsl()¶
- Return type:
bool
Returns
true
if this platform supports SSL; otherwise, returns false. If the platform doesn’t support SSL, the socket will fail in the connection phase.
- static PySide2.QtNetwork.QSslSocket.systemCaCertificates()¶
- Return type:
Note
This function is deprecated.
Use QSslConfiguration::systemDefaultCaCertificates instead.
This function provides the CA certificate database provided by the operating system. The CA certificate database returned by this function is used to initialize the database returned by
defaultCaCertificates()
. You can replace that database with your own withsetDefaultCaCertificates()
.Note
: On OS X, only certificates that are either trusted for all purposes or trusted for the purpose of SSL in the keychain will be returned.
- PySide2.QtNetwork.QSslSocket.waitForEncrypted([msecs=30000])¶
- Parameters:
msecs – int
- Return type:
bool
Waits until the socket has completed the SSL handshake and has emitted
encrypted()
, ormsecs
milliseconds, whichever comes first. Ifencrypted()
has been emitted, this function returns true; otherwise (e.g., the socket is disconnected, or the SSL handshake fails), false is returned.The following example waits up to one second for the socket to be encrypted:
socket.connectToHostEncrypted("imap", 993) if socket.waitForEncrypted(1000): print "Encrypted!"
If msecs is -1, this function will not time out.
© 2022 The Qt Company Ltd. Documentation contributions included herein are the copyrights of their respective owners. The documentation provided herein is licensed under the terms of the GNU Free Documentation License version 1.3 as published by the Free Software Foundation. Qt and respective logos are trademarks of The Qt Company Ltd. in Finland and/or other countries worldwide. All other trademarks are property of their respective owners.