title: How to prevent older versions of the TLS protocl in python openssl client
body: <p>I need my python TLS client to offer only version TLS 1.2 (disable TLS 1.0, TLS 1.1, SSLv3, SSLV2). </p>
  
  <p>I am using python 3.6.5 and the openssl library under Windows 10. According to the official documentation <a href="https://docs.python.org/3/library/ssl.html#ssl.OP_NO_SSLv3" rel="nofollow noreferrer">here</a>, these two lines should prevent TLS 1.0 and TLS 1.1:</p>
  
  <blockquote>
    <p>ssl.OP_NO_TLSv1</p>
    
    <p>Prevents a TLSv1 connection. This option is only applicable in conjunction with PROTOCOL_TLS. It prevents the peers from choosing
    TLSv1 as the protocol version.</p>
    
    <p>New in version 3.2.</p>
    
    <p>ssl.OP_NO_TLSv1_1</p>
    
    <p>Prevents a TLSv1.1 connection. This option is only applicable in conjunction with PROTOCOL_TLS. It prevents the peers from choosing
    TLSv1.1 as the protocol version. Available only with openssl version
    1.0.1+.</p>
    
    <p>New in version 3.4.</p>
  </blockquote>
  
  <p>And the above doucumentation says they are only applicable with the newly introduced:</p>
  
  <pre><code>PROTOCL_TLS
  </code></pre>
  
  <p>However, in practice, I tried to disable TLS 1.0 and TLS 1.1 and test connecting to a TLS 1.0 (ONLY version supported in the test server) and my script still able to connect to it.</p>
  
  <p>Am I doing something wrong? how the above two lines syntax in using them in conjunction with <code>PROTOCOL_TLS</code>?</p>
  
  <p>This is the script I'm running:</p>
  
  <pre><code>import socket, ssl
  
  
  context = ssl.SSLContext()
  
  context.protocol = ssl.PROTOCOL_TLS  
  context.protocol = ssl.OP_NO_TLSv1 # prevents TLS 1.0
  context.protocol = ssl.OP_NO_TLSv1_1 # prevents TLS 1.1
  
  s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
  
  #note: the IP below is for private testing server not a public address
  sslSocket = context.wrap_socket(s, server_hostname = '192.168.56.7')
  sslSocket.connect((domain, 443))
  
  print("connection succeeded")
  sslSocket.close()
  </code></pre>
  
  <p><strong>NOTE:</strong> for testing a live TLS 1.0 server, you can find any TLS 1.0 server by searching or use this <a href="https://tls-v1-0.badssl.com:1010/" rel="nofollow noreferrer">link</a> but I think they are using a different port than 443.</p>
  
  <p><strong>NOTE:</strong> I did not add:  <code>ssl.OP_NO_SSLv2</code> nor  <code>ssl.OP_NO_SSLv3</code>because they are disabled by default when using <code>context.protocol = ssl.PROTOCOL_TLS</code>  </p>