code: def create_tls_context(self):
          
          # Create context manually, as we're going to set our own options.
          tls_context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
  
          # Load client/server certificate.
          if self.tls_certificate_file:
              tls_context.load_cert_chain(self.tls_certificate_file, self.tls_certificate_keyfile,
                                          password=self.tls_certificate_password)
  
          # Set some relevant options:
          # - No server should use SSLv2 or SSLv3 any more, they are outdated and full of security holes. (RFC6176, RFC7568)
          # - Disable compression in order to counter the CRIME attack. (https://en.wikipedia.org/wiki/CRIME_%28security_exploit%29)
          # - Disable session resumption to maintain perfect forward secrecy. (https://timtaubert.de/blog/2014/11/the-sad-state-of-server-side-tls-session-resumption-implementations/)
          for opt in ['NO_SSLv2', 'NO_SSLv3', 'NO_COMPRESSION', 'NO_TICKET']:
              if hasattr(ssl, 'OP_' + opt):
                  tls_context.options |= getattr(ssl, 'OP_' + opt)
  
          # Set TLS verification options.
          if self.tls_verify:
              # Set our custom verification callback, if the library supports it.
              tls_context.set_servername_callback(self.verify_tls)
  
              # Load certificate verification paths.
              tls_context.set_default_verify_paths()
              if sys.platform in DEFAULT_CA_PATHS and path.isdir(DEFAULT_CA_PATHS[sys.platform]):
                  tls_context.load_verify_locations(capath=DEFAULT_CA_PATHS[sys.platform])
  
              # If we want to verify the TLS connection, we first need a certicate.
              # Check this certificate and its entire chain, if possible, against revocation lists.
              tls_context.verify_mode = ssl.CERT_REQUIRED
              tls_context.verify_flags = ssl.VERIFY_CRL_CHECK_CHAIN
  
          return tls_context
docs: Transform our regular socket into a TLS socket.