# Pre-PEP discussion: revival of PEP 543 - A Unified TLS API for Python

**URL:** <https://discuss.python.org/t/pre-pep-discussion-revival-of-pep-543-a-unified-tls-api-for-python/51263>\
**Category:** Core Development\
**Tags:** pep\
**Created:** [April 17, 2024, 8:44pm UTC](https://discuss.python.org/t/pre-pep-discussion-revival-of-pep-543-a-unified-tls-api-for-python/51263 "2024-04-17T20:44:38Z")\
**Posts on this page:** 1\
**Showing post:** 78

<div class="post-metadata">

**Author:** ![Julien00859](https://sea2.discourse-cdn.com/flex002/user_avatar/discuss.python.org/julien00859/32/1300_2.png) [@Julien00859](https://discuss.python.org/u/Julien00859)\
**Post date:** [January 28, 2026, 11:11pm UTC](https://discuss.python.org/t/pre-pep-discussion-revival-of-pep-543-a-unified-tls-api-for-python/51263/78 "2026-01-28T23:11:24Z")

</div>

> [@jvdprng](#):
>
> > [@Julien00859](#):
> >
> > The same goes for `ClientCertificate.truststore`, it is set `None` by default at the moment, making the connection insecure by default. It should be a mandatory parameter client-side. Users who wish for an insecure connection are free to explicitly set the param `None`.
> 
> The backends are supposed to interpret a `None` trust store as the default (system) trust store. I am not sure if it would really make the connection insecure by default, as a missing trust store means all servers should be rejected. In order to skip the server certificate check, the user has to use the `insecure` module.

It is a nasty surprise that `truststore=None` means “use the system trust store” client-side and “disable client authentication” server-side, nothing is written in that regard in the PEP, only in the docstrings of tlslib. It means that client-side setting `truststore=None` and `truststore=TrustStore.system()` are two ways to achieve the same thing. IMO the default value should be the latter, and `None` not supported.

I assumed `truststore=None` to mean “disable server authentication”. I am now reading about the _insecure_ section, I understand the will to make it extra difficult to instantiate an insecure configuration by accident.

---

_[View the full topic](https://discuss.python.org/t/pre-pep-discussion-revival-of-pep-543-a-unified-tls-api-for-python/51263)._