code: def _verify_cert(self, sock: ssl.SSLSocket):
          '''Check if certificate matches hostname.'''
          # Based on tornado.iostream.SSLIOStream
          # Needed for older OpenSSL (<0.9.8f) versions
          verify_mode = self._ssl_context.verify_mode
  
          assert verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED,
                                 ssl.CERT_OPTIONAL), \
              'Unknown verify mode {}'.format(verify_mode)
  
          if verify_mode == ssl.CERT_NONE:
              return
  
          cert = sock.getpeercert()
  
          if not cert and verify_mode == ssl.CERT_OPTIONAL:
              return
  
          if not cert:
              raise SSLVerificationError('No SSL certificate given')
  
          try:
              ssl.match_hostname(cert, self._hostname)
          except ssl.CertificateError as error:
              raise SSLVerificationError('Invalid SSL certificate') from errof _verify_cert(self, sock: ssl.SSLSocket):
          '''Check if certificate matches hostname.'''
          # Based on tornado.iostream.SSLIOStream
          # Needed for older OpenSSL (<0.9.8f) versions
          verify_mode = self._ssl_context.verify_mode
  
          assert verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED,
                                 ssl.CERT_OPTIONAL), \
              'Unknown verify mode {}'.format(verify_mode)
  
          if verify_mode == ssl.CERT_NONE:
              return
  
          cert = sock.getpeercert()
  
          if not cert and verify_mode == ssl.CERT_OPTIONAL:
              return
  
          if not cert:
              raise SSLVerificationError('No SSL certificate given')
  
          try:
              ssl.match_hostname(cert, self._hostname)
          except ssl.CertificateError as error:
              raise SSLVerificationError('Invalid SSL certificate') from error
docs: Check if certificate matches hostname.