The common SSL model is that you verify someone's good nature bychecking to see that their certificate is signed by an approved CA.For example, if you are verifying that hosts you are connecting toare approved you would make up a CA certificate, then make up a bunchof host certificates and sign them with the CA certificate. When youconnect to a machine, you verify that its certificate is signed by yourCA certificate.

(Except that that's a simplification; you actually need to verify that

It is nice that Python's socket module has simple SSL support (although it has some limitations ). My grump is that it doesn't giveyou any good way of checking the identity of the server'scertificate, which is especially annoying as the SSL codedoesn't do any certificate verification.

(This matters to me because I have recently become quiteinterested in being able to verify machines by checkingthat they have a specific SSL certificate.)

What SSL objects have is .issuer( ) and