title: hypercorn: client-certificate verification
body: <p>I'm trying to enable client certificate validation in hypercorn.  If it matters, I'm using <a href="https://fastapi.tiangolo.com/" rel="nofollow noreferrer">FastAPI</a>.  The <a href="https://pgjones.gitlab.io/hypercorn/tutorials/usage.html" rel="nofollow noreferrer">documentation</a> directs me to use the <code>--verify-mode</code> parameter and states simply:</p>
  
  <blockquote>
    <p>SSL verify mode for peer’s certificate, see ssl.VerifyMode enum for possible values.</p>
  </blockquote>
  
  <p>I tried a few guesses but get a fatal error: "hypercorn: error: argument --verify-mode: Not a valid verify mode"</p>
  
  <p>I poked around a bit and found this code in the <a href="https://gitlab.com/pgjones/hypercorn/-/commit/11a44aceaf6011d912da121496a8924ccb31dffd" rel="nofollow noreferrer">project history</a>:</p>
  
  <pre><code>if self.verify_mode is not None:
      context.verify_mode = self.verify_mode
  </code></pre>
  
  <p>So I did this to verify the valid values (Python 3.8):</p>
  
  <pre><code>&gt;&gt;&gt; import ssl
  &gt;&gt;&gt; context = ssl.SSLContext(ssl.PROTOCOL_TLSv1_2)
  &gt;&gt;&gt; context.verify_mode
  &lt;VerifyMode.CERT_NONE: 0&gt;
  &gt;&gt;&gt; context.verify_mode = 1
  &gt;&gt;&gt; context.verify_mode
  &lt;VerifyMode.CERT_OPTIONAL: 1&gt;
  &gt;&gt;&gt; context.verify_mode = 2
  &gt;&gt;&gt; context.verify_mode
  &lt;VerifyMode.CERT_REQUIRED: 2&gt;
  &gt;&gt;&gt; context.verify_mode = 4
  Traceback (most recent call last):
    File "&lt;stdin&gt;", line 1, in &lt;module&gt;
    File "...ssl.py", line 720, in verify_mode
      super(SSLContext, SSLContext).verify_mode.__set__(self, value)
  ValueError: invalid value for verify_mode
  </code></pre>
  
  <p>However trying to pass <code>0</code>, <code>1</code>, or <code>2</code> to <code>--verify-mode</code> all give the "Not a valid verify mode" error.  I am able to pass these values using <code>--cert-reqs</code> with the warning "Warning: Please use verify_mode instead" but it starts and based on the code I see in <a href="https://gitlab.com/pgjones/hypercorn/-/blob/master/src/hypercorn/config.py" rel="nofollow noreferrer">config.py</a>, it seems like this does the  right thing and sets the <code>SSLContext</code> <code>verify_mode</code> value.</p>
  
  <p>Unfortunately, this doesn't seem to do anything.  I would expect to be prompted for a client certificate when I do a <code>GET</code> in the browser or at least an error since it is set to 'required'.  But instead, I get a good 200 error code response.</p>
  
  <p>I can't find any good examples, tutorials, or documentation about doing this with hypercorn.  Is there something else here that I need to do such as setting some other properties?  Any guidance is appreciated.</p>