Documentation

Python 3.15 added SSLContext.set_groups(), SSLContext.get_groups() and SSLSocket.group() for choosing and inspecting the groups used for TLS key agreement. This is also how you reach the post-quantum hybrid key exchange that OpenSSL 3.5 now offers by default, such as X25519MLKEM768. The same release added ssl.get_sigalgs(), SSLSocket.client_sigalg() and SSLSocket.server_sigalg() for signature algorithms.

The reference documentation for both sets of methods is thinner than it could be.

Five of them need a specific OpenSSL version and raise NotImplementedError when linked against an older one, but the reference docs don't say so:

• SSLSocket.group() needs OpenSSL 3.2 or later
• SSLContext.get_groups() needs OpenSSL 3.5 or later
• ssl.get_sigalgs() needs OpenSSL 3.4 or later
• SSLSocket.client_sigalg() needs OpenSSL 3.5 or later
• SSLSocket.server_sigalg() needs OpenSSL 3.5 or later

Each requirement is already stated in the What's New in 3.15 entries and enforced in Modules/_ssl.c, so this is only about the reference pages.

There are a few other gaps around the group API. set_groups() has no example and never mentions that it supports post-quantum groups, even though the What's New in 3.15 does. set_ecdh_curve() doesn't point readers at the newer and more general set_groups(). And the TLS 1.3 section says nothing about key agreement groups or the post-quantum hybrids that are now enabled by default.

Linked PRs

• gh-154517: Document OpenSSL version requirements and post-quantum groups for the ssl group and signature algorithm APIs #154518