Implement SSLContext factory

docs/deployment.md

@@ -122,6 +122,8 @@ Options:
   --ssl-ca-certs TEXT             CA certificates file
   --ssl-ciphers TEXT              Ciphers to use (see stdlib ssl module's)
                                   [default: TLSv1]
+  --ssl-context CALLABLE          Custom ssl_context that returns
+                                  ssl.SSLContext to set on config
   --header TEXT                   Specify custom default HTTP response headers
                                   as a Name:Value pair
   --version                       Display the uvicorn version and exit.

docs/index.md

@@ -192,6 +192,8 @@ Options:
   --ssl-ca-certs TEXT             CA certificates file
   --ssl-ciphers TEXT              Ciphers to use (see stdlib ssl module's)
                                   [default: TLSv1]
+  --ssl-context CALLABLE          Custom ssl_context that returns
+                                  ssl.SSLContext to set on config
   --header TEXT                   Specify custom default HTTP response headers
                                   as a Name:Value pair
   --version                       Display the uvicorn version and exit.

tests/test_config.py

@@ -2,6 +2,7 @@
 import logging
 import os
 import socket
+import ssl
 import sys
 import typing
 from pathlib import Path
@@ -305,10 +306,32 @@ def test_ssl_config(
         ssl_keyfile=tls_ca_certificate_private_key_path,
     )
     config.load()
-
     assert config.is_ssl is True
 
 
+# ignore
+def ssl_context():
+    context = ssl.SSLContext(int(ssl.PROTOCOL_TLS_SERVER))  # type: ignore
+    allowed_ciphers = (
+        "DEFAULT:!aNULL:!eNULL:!MD5:!3DES:!DES:!RC4:!IDEA:!SEED:!aDSS:!SRP:!PSK"
+    )
+    context.set_ciphers(allowed_ciphers)
+    list_options = [ssl.OP_NO_RENEGOTIATION]
+    for each_option in list_options:
+        context.options |= each_option
+    return context
+
+
+def test_ssl_context() -> None:
+    config = Config(app=asgi_app, ssl_context=ssl_context)
+    config.load()
+    if config.ssl_context is not None:
+        assert ssl.PROTOCOL_TLS_SERVER is config.ssl_version
+        assert "TLSv1" in config.ssl_ciphers
+    if config.ssl is not None:
+        assert ssl.OP_NO_RENEGOTIATION in config.ssl.options
+
+
 def test_ssl_config_combined(tls_certificate_key_and_chain_path: str) -> None:
     config = Config(
         app=asgi_app,

uvicorn/config.py

@@ -98,6 +98,27 @@
 logger = logging.getLogger("uvicorn.error")
 
 
+def update_ssl_context(
+    ctx: ssl.SSLContext,
+    certfile: Optional[Union[str, os.PathLike]],
+    keyfile: Optional[Union[str, os.PathLike]],
+    password: Optional[str],
+    cert_reqs: int,
+    ca_certs: Optional[Union[str, os.PathLike]],
+    ciphers: Optional[str],
+) -> ssl.SSLContext:
+    get_password = (lambda: password) if password else None
+    if certfile and keyfile:
+        ctx.load_cert_chain(certfile, keyfile, get_password)
+    if cert_reqs:
+        ctx.verify_mode = ssl.VerifyMode(cert_reqs)
+    if ca_certs:
+        ctx.load_verify_locations(ca_certs)
+    if ciphers:
+        ctx.set_ciphers(ciphers)
+    return ctx
+
+
 def create_ssl_context(
     certfile: str | os.PathLike[str],
     keyfile: str | os.PathLike[str] | None,
@@ -223,7 +244,9 @@ def __init__(
         ssl_cert_reqs: int = ssl.CERT_NONE,
         ssl_ca_certs: str | None = None,
         ssl_ciphers: str = "TLSv1",
+        ssl_context: Optional[Callable] = None,
         headers: list[tuple[str, str]] | None = None,
+
         factory: bool = False,
         h11_max_incomplete_event_size: int | None = None,
     ):
@@ -267,6 +290,7 @@ def __init__(
         self.ssl_cert_reqs = ssl_cert_reqs
         self.ssl_ca_certs = ssl_ca_certs
         self.ssl_ciphers = ssl_ciphers
+        self.ssl_context = ssl_context
         self.headers: list[tuple[str, str]] = headers or []
         self.encoded_headers: list[tuple[bytes, bytes]] = []
         self.factory = factory
@@ -416,8 +440,20 @@ def configure_logging(self) -> None:
     def load(self) -> None:
         assert not self.loaded
 
-        if self.is_ssl:
+        if self.ssl_context:
+            self.ssl: Optional[ssl.SSLContext] = update_ssl_context(
+                self.ssl_context(),
+                keyfile=self.ssl_keyfile,
+                certfile=self.ssl_certfile,
+                password=self.ssl_keyfile_password,
+                cert_reqs=self.ssl_cert_reqs,
+                ca_certs=self.ssl_ca_certs,
+                ciphers=self.ssl_ciphers,
+            )
+
+        elif self.is_ssl and not self.ssl_context:
             assert self.ssl_certfile
+
             self.ssl: ssl.SSLContext | None = create_ssl_context(
                 keyfile=self.ssl_keyfile,
                 certfile=self.ssl_certfile,
@@ -427,6 +463,7 @@ def load(self) -> None:
                 ca_certs=self.ssl_ca_certs,
                 ciphers=self.ssl_ciphers,
             )
+
         else:
             self.ssl = None
 

uvicorn/main.py

@@ -331,6 +331,13 @@ def print_version(ctx: click.Context, param: click.Parameter, value: bool) -> No
     help="Ciphers to use (see stdlib ssl module's)",
     show_default=True,
 )
+@click.option(
+    "--ssl-context",
+    type=typing.Callable,
+    default=None,
+    help="Custom ssl_context that returns ssl.SSLContext to set on config",
+    show_default=True,
+)
 @click.option(
     "--header",
     "headers",
@@ -409,6 +416,7 @@ def main(
     ssl_cert_reqs: int,
     ssl_ca_certs: str,
     ssl_ciphers: str,
+    ssl_context: typing.Callable,
     headers: list[str],
     use_colors: bool,
     app_dir: str,
@@ -458,6 +466,7 @@ def main(
         ssl_cert_reqs=ssl_cert_reqs,
         ssl_ca_certs=ssl_ca_certs,
         ssl_ciphers=ssl_ciphers,
+        ssl_context=ssl_context,
         headers=[header.split(":", 1) for header in headers],  # type: ignore[misc]
         use_colors=use_colors,
         factory=factory,
@@ -510,9 +519,11 @@ def run(
     ssl_cert_reqs: int = ssl.CERT_NONE,
     ssl_ca_certs: str | None = None,
     ssl_ciphers: str = "TLSv1",
+    ssl_context: typing.Optional[typing.Callable] = None,
     headers: list[tuple[str, str]] | None = None,
     use_colors: bool | None = None,
     app_dir: str | None = None,
+
     factory: bool = False,
     h11_max_incomplete_event_size: int | None = None,
 ) -> None:
@@ -562,6 +573,7 @@ def run(
         ssl_cert_reqs=ssl_cert_reqs,
         ssl_ca_certs=ssl_ca_certs,
         ssl_ciphers=ssl_ciphers,
+        ssl_context=ssl_context,
         headers=headers,
         use_colors=use_colors,
         factory=factory,