tornado2.py 文件源码

def _get_ssl_options(cls, cert_options):
        ssl_options = {}
        if cert_options['validate_cert']:
            ssl_options["cert_reqs"] = ssl.CERT_REQUIRED
        if cert_options['ca_certs'] is not None:
            ssl_options["ca_certs"] = cert_options['ca_certs']
        else:
            ssl_options["ca_certs"] = _default_ca_certs()
        if cert_options['client_key'] is not None:
            ssl_options["keyfile"] = cert_options['client_key']
        if cert_options['client_cert'] is not None:
            ssl_options["certfile"] = cert_options['client_cert']

        # according to REC 7540:
        # deployments of HTTP/2 that use TLS 1.2 MUST
        # support TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
        ssl_options["ciphers"] = "ECDH+AESGCM"
        ssl_options["ssl_version"] = ssl.PROTOCOL_TLSv1_2
        ssl_options = ssl_options_to_context(ssl_options)
        ssl_options.set_alpn_protocols(['h2'])
        return ssl_options