From 099c8e433f24b45b2d83bad65df8a4ec589e9e64 Mon Sep 17 00:00:00 2001 From: Michele Angrisano Date: Thu, 13 Aug 2026 14:46:44 +0200 Subject: [PATCH] gh-149679: Document that cadata does not accept CRLs --- Doc/library/ssl.rst | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Doc/library/ssl.rst b/Doc/library/ssl.rst index 66fe6c7aee48626..3a2d4a31116a578 100644 --- a/Doc/library/ssl.rst +++ b/Doc/library/ssl.rst @@ -1617,7 +1617,8 @@ to speed up repeated connections from the same clients. :data:`CERT_NONE`. At least one of *cafile* or *capath* must be specified. This method can also load certification revocation lists (CRLs) in PEM or - DER format. In order to make use of CRLs, :attr:`SSLContext.verify_flags` + DER format, but only through *cafile* or *capath* (not *cadata*). + In order to make use of CRLs, :attr:`SSLContext.verify_flags` must be configured properly. The *cafile* string, if present, is the path to a file of concatenated @@ -1634,6 +1635,8 @@ to speed up repeated connections from the same clients. PEM-encoded certificates or a :term:`bytes-like object` of DER-encoded certificates. Like with *capath* extra lines around PEM-encoded certificates are ignored but at least one certificate must be present. + Unlike *cafile* and *capath*, *cadata* accepts certificates only; CRLs + supplied through *cadata* are rejected. .. versionchanged:: 3.4 New optional argument *cadata*