all Python 3until 3.12Removed from the standard libraryfunction

ssl.wrap_socket()

removed

Wrapped a socket in TLS without checking the certificate or server name. Removed in Python 3.12; use ssl.create_default_context() and context.wrap_socket().

Syntax

ssl.wrap_socket(sock, keyfile=None, certfile=None, server_side=False)  # до 3.12

The function built a throwaway context with dangerous defaults: it sent no SNI and checked neither the certificate nor the server name, leaving the connection open to spoofing (CWE-295). It was deprecated in Python 3.7 and removed in 3.12. How to rewrite: ctx = ssl.create_default_context() gives a context that verifies the certificate and hostname; then tls = ctx.wrap_socket(sock, server_hostname='example.org'). For a server: ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER), ctx.load_cert_chain(certfile, keyfile), then ctx.wrap_socket(sock, server_side=True).

Examples

# Python 3.12+
import ssl
try:
    ssl.wrap_socket
except AttributeError as e:
    print(type(e).__name__)  # → AttributeError

# Python 3.12+
import socket, ssl
ctx = ssl.create_default_context()
print(ctx.check_hostname, ctx.verify_mode == ssl.CERT_REQUIRED)  # → True True
with socket.socket() as raw:
    tls = ctx.wrap_socket(raw, server_hostname='example.org')
    print(tls.server_hostname)  # → example.org

import socket, ssl
with socket.socket() as raw:
    tls = ssl.wrap_socket(raw)
    print(type(tls).__name__)  # → SSLSocket

Common errors

Open in the full glossarydocs.python.orgReport an inaccuracy