tlslite-ng

What it is and what it does

tlslite-ng is a pure Python implementation of SSL and TLS protocols spanning SSLv3.0 through TLS 1.3. It handles the full TLS handshake, certificate validation, and encrypted record exchange without requiring compiled C extensions, though it can optionally use external crypto libraries (pycrypto, m2crypto, gmp) for faster cryptographic operations. The package supports a comprehensive set of modern cipher suites, elliptic-curve and post-quantum key exchange methods, and certificate types including RSA, DSA, and ECDSA.

It is intended as a drop-in replacement for the older tlslite library, offering more features and secure defaults. The single runtime dependency is ecdsa, and the package supports Python versions from 2.6 through 3.12. Because it is pure Python, it is portable and does not require system-level SSL libraries, making it useful for embedded systems, testing, and environments where the standard library ssl module is unavailable or insufficient.

Use it for:

• Testing TLS implementations and protocol compliance without relying on system OpenSSL.
• Building TLS clients or servers in pure Python for embedded or resource-constrained environments.
• Implementing custom TLS handshake logic or certificate pinning (TACK support).
• Protocol fuzzing and security research on TLS behavior.
• Environments where system SSL libraries are unavailable or where fine-grained control over TLS parameters is needed.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Pure Python implementation of SSL/TLS protocols (SSLv3.0, TLS 1.0–1.3) with support for modern ciphers, key exchange methods, and certificate types, optionally accelerated by external crypto libraries.

Yes, with conditions. Install if you need a pure-Python TLS implementation for testing, embedded use, or custom protocol control, and you accept the LGPLv2 copyleft constraint. The package is actively maintained, has no known vulnerabilities, and low install friction. Do not install as a drop-in replacement for the standard library ssl module in production unless you have specific requirements that justify the performance trade-off of pure Python over native code.

Install

tlslite-ng on PyPI

pip install tlslite-ng

uv add tlslite-ng

poetry add tlslite-ng

Installing tlslite-ng

Before you install

Low friction: pure Python wheel with a single runtime dependency (ecdsa). Actively maintained with recent commits and no known vulnerabilities. Supports a broad range of Python versions from 2.6 through 3.12.

License in practice

LGPLv2 copyleft license: derivative works and modifications must be released under the same license. Suitable for open-source projects; proprietary use requires careful review or relicensing negotiation.

Quickstart

pip install tlslite-ng

from tlslite.tlsconnection import TLSConnection
from socket import socket

sock = socket()
conn = TLSConnection(sock)
conn.handshakeClientCert()

Requires Python 2.6+ or 3.6+; optional acceleration libraries (pycrypto, m2crypto, gmp) are not required but improve performance.

Verify before relying

• Completeness of TLS 1.3 support (description notes RFC 8446 is 'not complete')—specific gaps or limitations unknown.
• Performance characteristics relative to standard library ssl module or other pure-Python TLS implementations.
• Whether optional acceleration libraries (pycrypto, m2crypto, gmp) are still maintained and compatible with current Python versions.

Package facts

Evidence: tlslite_ng-0.8.2-py3-none-any.whl

Keywords: ssl, tls, pure-python

Tags

More Python Modules packages