Julien00859/config certchain truststore

src/tlslib/stdlib.py

@@ -81,15 +81,7 @@ def _remove_path(ts_cert_priv: TrustStore | Certificate | PrivateKey) -> None:
     ts_cert_priv._path = None
 
 
-def _is_system_trust_store(trust_store: TrustStore | None) -> bool:
-    return trust_store is None or (
-        trust_store._path is None and trust_store._buffer is None and trust_store._id is None
-    )
-
-
-def _get_path_from_trust_store(
-    context: _SSLContext, trust_store: TrustStore | None
-) -> os.PathLike | None:
+def _get_path_from_trust_store(context: _SSLContext, trust_store: TrustStore) -> os.PathLike | None:
     assert trust_store is not None
     if trust_store._path is not None:
         return trust_store._path
@@ -109,10 +101,10 @@ def _get_path_from_trust_store(
         return None
 
 
-def _create_client_context_with_trust_store(trust_store: TrustStore | None) -> _SSLContext:
+def _create_client_context_with_trust_store(trust_store: TrustStore) -> _SSLContext:
     some_context: _SSLContext
 
-    if _is_system_trust_store(trust_store):
+    if trust_store.is_system():
         some_context = truststore.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
     else:
         some_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)

src/tlslib/tlslib.py

@@ -60,6 +60,9 @@ def system(cls) -> TrustStore:
         """
         return cls()
 
+    def is_system(self):
+        return self._buffer is None and self._path is None and self._id is None
+
     @classmethod
     def from_buffer(cls, buffer: bytes) -> TrustStore:
         """
@@ -235,7 +238,7 @@ class TLSClientConfiguration:
 
     :param trust_store TrustStore:
         The trust store that connections using this configuration will use
-        to validate certificates. None means that the system store is used.
+        to validate certificates.
     """
 
     __slots__ = (
@@ -254,7 +257,7 @@ def __init__(
         inner_protocols: Sequence[NextProtocol | bytes] | None = None,
         lowest_supported_version: TLSVersion | None = None,
         highest_supported_version: TLSVersion | None = None,
-        trust_store: TrustStore | None = None,
+        trust_store: TrustStore = TrustStore.system(),
     ) -> None:
         """Initialize TLS client configuration."""
 
@@ -311,7 +314,7 @@ def highest_supported_version(self) -> TLSVersion | None:
         return self._highest_supported_version
 
     @property
-    def trust_store(self) -> TrustStore | None:
+    def trust_store(self) -> TrustStore:
         """
         The trust store that connections using this configuration will use
         to validate certificates. None means that the system store is used.
@@ -329,7 +332,7 @@ class TLSServerConfiguration:
         where each signing chain comprises a leaf certificate including
         its corresponding private key and optionally a list of intermediate
         certificates. These certificates will be offered to the client during
-        the handshake if required.
+        the handshake.
 
     :param ciphers Sequence[CipherSuite | int] | None:
         The available ciphers for TLS connections created with this
@@ -367,7 +370,7 @@ class TLSServerConfiguration:
 
     def __init__(
         self,
-        certificate_chain: Sequence[SigningChain] | None = None,
+        certificate_chain: Sequence[SigningChain],
         ciphers: Sequence[CipherSuite | int] | None = None,
         inner_protocols: Sequence[NextProtocol | bytes] | None = None,
         lowest_supported_version: TLSVersion | None = None,
@@ -379,6 +382,10 @@ def __init__(
         if inner_protocols is None:
             inner_protocols = []
 
+        if not certificate_chain:
+            e = "certificate_chain cannot be empty"
+            raise ValueError(e)
+
         self._certificate_chain = certificate_chain
         self._ciphers = ciphers
         self._inner_protocols = inner_protocols