sslcontext 1.4.3__tar.gz → 2.1.0__tar.gz

sslcontext-2.1.0/.gitignore

@@ -0,0 +1,37 @@
+# Category rule: nothing dot-prefixed at the repo root gets tracked except the
+# git config files and the CI workflows re-included below.
+/.*
+!/.gitignore
+!/.gitattributes
+!/.github/
+
+# Private agent config. No trailing slash: .agents may be a symlink.
+# *.local.* is the unshared override and is never committed.
+.agents
+*.local.*
+CLAUDE*
+.claude
+
+# Build/dist output and generated docs site
+build/
+dist/
+site/
+
+# Python
+__pycache__/
+*.py[cod]
+.pytest_cache/
+.hypothesis/
+.mypy_cache/
+.ruff_cache/
+.coverage*
+htmlcov/
+*.egg-info/
+.pyvenv/
+.venv/
+
+# OS/editor
+.DS_Store
+Thumbs.db
+.idea/
+.vscode/

sslcontext-2.1.0/CHANGELOG.md

@@ -0,0 +1,97 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/).
+
+## [Unreleased]
+
+Nothing yet.
+
+## [2.1.0] - 2026-10-19
+
+### Added
+
+- A PKCS#12 bundle (`.p12`/`.pfx`) is accepted wherever a certificate is
+  (`certificate=`, `load_pem()`), decrypted with `password=`; encrypted DER
+  (PKCS#8) private keys are decrypted with `password=` as PEM ones are.
+- A password may be `bytes`, or a file holding it (a path object, or anything
+  with `open()` or `read()`; its first line), read only when needed.
+
+## [2.0.0] - 2026-10-19
+
+### Added
+
+- The `sslcontext` command (extra `cli`): `list` and `show` keystore
+  identities, `probe URL` to see a server's certificate request, the
+  candidates and the certificate sent.
+- `KeychainBackend` (`sslcontext.backends`, name `keychain`): identities in
+  the macOS Keychain and on smart cards, signed silently or, with
+  `KEYSTORE_PROMPT`, after macOS's own dialog. `system_sources()` uses it on
+  macOS.
+- On Python 3.9, where truststore is unavailable, `system_context()` on macOS
+  trusts the Keychain's anchors (system roots, and those an administrator or
+  the user trusted) in addition to OpenSSL's default store.
+- `create_context()` and `system_context()` take `ca=`, `certificate=`,
+  `key=`, `password=` and `identity=`. Every certificate, key, CA and
+  bundle argument (including `load_pem()` and `load_pkcs12()`) accepts PEM
+  text, PEM or DER bytes, a path, an object with `open()` or `read()`, a
+  `cryptography` certificate or private key, or a list of them.
+- Apple's `/usr/bin/python3` (LibreSSL 2.8) is supported: keystore
+  identities sign through it over TLS 1.2, and client certificates are
+  chosen when the server asks.
+- `system_context()`: a client context that behaves like the system's
+  browser: OS verification through truststore (a dependency on Python 3.10+) and
+  client certificates chosen when the server asks by a
+  `ClientCertificateSelector` over `system_sources()` (the Windows
+  Personal store, the default PKCS#11 module elsewhere), filtered as a
+  browser filters (validity, client-authentication usage, key type, the
+  CAs the server names) and picked by remembered choice, `AutoSelectRule`
+  rules, the Edge/Chrome/Chromium `AutoSelectCertificateForUrls` policy
+  (`browser_policies()`), a `choose` callback or the only candidate.
+- `create_context()` builds a verifying `ssl.SSLContext` from
+  `verify`/`cafile`/`capath`/`cadata`, TLS version bounds and ALPN.
+- `load_pem()` and `load_pkcs12()` load a certificate, chain and key from
+  memory, with no temporary files.
+- `Identity`, the `Signer` protocol and `load_identity()`: a certificate whose
+  private key is used only through a signer, for every handshake signature
+  (RSA PKCS#1 v1.5 and PSS, ECDSA; TLS 1.2 and 1.3). OpenSSL 1.1.1 and 3.x.
+- `sslcontext.testing.SoftwareSigner` and `software_identity()`.
+- `sslcontext.issuing`: `CertificateAuthority` (create, or load from PEM;
+  optional X.509 name constraints; encrypted key export) issuing server
+  certificates (`IssuedCertificate`) that pass strict verification, made with
+  the interpreter's own OpenSSL.
+- `Identity.info` (`CertificateInfo`: subject, issuer, serial, validity,
+  SHA-1/SHA-256 thumbprints, key type and size).
+- `sslcontext.backends`: the `Backend` contract with thumbprint, subject,
+  issuer, label and validity queries, a registry (`names()`, `get()`,
+  `register_backend()`, entry-point group `sslcontext.backends`), and
+  `CNGBackend` for Windows certificate stores: non-exportable, TPM and
+  smart-card keys through CNG, and legacy CryptoAPI CSP keys (PKCS#1 v1.5,
+  TLS 1.2).
+- PIN and password sources: `pin=` on every backend takes a PIN,
+  `KEYSTORE_PROMPT`, or a callback receiving a `PinRequest` (backend, token,
+  certificate, purpose); with no PIN, an operation needing one fails at once
+  instead of showing a dialog or waiting on a PIN pad. `load_pem()`,
+  `load_pkcs12()` and `SoftwareSigner` accept a password callable, called
+  only for an encrypted key.
+- `PKCS11Backend` for PKCS#11 tokens: smart cards (real and virtual, through
+  OpenSC), HSMs, TPMs and software tokens. RSA PKCS#1 v1.5 and PSS and
+  ECDSA, PINs from the PIN source (see below),
+  per-signature login for `CKA_ALWAYS_AUTHENTICATE` keys, and recovery after
+  the card is removed and reinserted. `SSLCONTEXT_PKCS11_MODULE` selects the
+  default module.
+
+### Changed
+
+- Rewritten from scratch. `sslcontext` now loads certificates and keystore-held
+  private keys into the standard library's `ssl.SSLContext`; nothing of the
+  1.x API (`SSLContext`/`SSLSocket` interfaces, `PyOpenSSLContext`,
+  `SSLContextProvider`) remains. The 1.x companions `sslcontext-factory`,
+  `openssl-engine` and `openssl-engine-capi` are superseded: OpenSSL 4 removed
+  the ENGINE API they were built on.
+
+[Unreleased]: https://github.com/jose-pr/sslcontext/compare/v2.1.0...HEAD
+[2.1.0]: https://github.com/jose-pr/sslcontext/compare/v2.0.0...v2.1.0
+[2.0.0]: https://github.com/jose-pr/sslcontext/releases/tag/v2.0.0

sslcontext-2.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Jose A.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

sslcontext-2.1.0/PKG-INFO

@@ -0,0 +1,168 @@
+Metadata-Version: 2.5
+Name: sslcontext
+Version: 2.1.0
+Summary: Client certificates from OS keystores (Windows CNG, macOS Keychain, PKCS#11 smart cards) in a standard ssl.SSLContext, chosen as the browser would
+Project-URL: Homepage, https://github.com/jose-pr/sslcontext/
+Project-URL: Documentation, https://jose-pr.github.io/sslcontext/
+Project-URL: Issues, https://github.com/jose-pr/sslcontext/issues
+Author: Jose A.
+License-Expression: MIT
+License-File: LICENSE
+Classifier: Development Status :: 3 - Alpha
+Classifier: Operating System :: MacOS
+Classifier: Operating System :: Microsoft :: Windows
+Classifier: Operating System :: POSIX :: Linux
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security :: Cryptography
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Requires-Dist: truststore<0.11,>=0.10; python_version >= '3.10'
+Provides-Extra: cli
+Requires-Dist: duho<0.8,>=0.7.4; extra == 'cli'
+Provides-Extra: dev
+Requires-Dist: black; extra == 'dev'
+Requires-Dist: build; extra == 'dev'
+Requires-Dist: duho<0.8,>=0.7.4; extra == 'dev'
+Requires-Dist: pytest; extra == 'dev'
+Provides-Extra: docs
+Requires-Dist: mkdocs; extra == 'docs'
+Requires-Dist: mkdocs-material; extra == 'docs'
+Requires-Dist: mkdocstrings[python]; extra == 'docs'
+Description-Content-Type: text/markdown
+
+# sslcontext
+
+[![Version](https://img.shields.io/pypi/v/sslcontext.svg)](https://pypi.org/project/sslcontext/)
+[![Python versions](https://img.shields.io/pypi/pyversions/sslcontext.svg)](https://pypi.org/project/sslcontext/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/jose-pr/sslcontext/blob/main/LICENSE)
+[![Docs](https://img.shields.io/badge/docs-latest-blue.svg)](https://jose-pr.github.io/sslcontext/)
+[![CI](https://img.shields.io/github/actions/workflow/status/jose-pr/sslcontext/test.yml)](https://github.com/jose-pr/sslcontext/actions/workflows/test.yml)
+
+**Client certificates whose private keys never leave the OS keystore, in a
+plain `ssl.SSLContext`.** `sslcontext` signs TLS handshakes through Windows
+CNG, the macOS Keychain or a PKCS#11 token (smart cards included), so every
+library that accepts an `ssl_context` gets mutual TLS with no patching, no
+temporary key files and no compiled extension; `system_context()` also picks the certificate as the
+browser would. Documentation: <https://jose-pr.github.io/sslcontext/>.
+
+## Features
+
+- **Keystore identities in stdlib `ssl`** — non-exportable and smart-card
+  keys work, because the key is used through the keystore, never copied.
+- **Pure Python** — ctypes over the OpenSSL that Python itself loaded: an
+  OpenSSL 3 provider on modern builds, an OpenSSL 1.1 engine on older ones.
+- **In-memory credentials** — load PEM or PKCS#12 bytes into a context
+  without writing a key to disk.
+- **Never blocks on a PIN** — PINs and passwords come from a value or a
+  callback you write; with none, operations fail at once. Keystore dialogs
+  and PIN pads are opt-in.
+- **The system's context** — `system_context()`: the OS verifies servers
+  (truststore) and, when a server asks, the client certificate is chosen
+  as the browser would: from the system's keystores, matching the CAs the
+  server names, following Edge's and Chrome's `AutoSelectCertificateForUrls`
+  policy, your rules or your callback, and never blocking.
+- **One context builder** — `create_context()` for the verify/cafile/capath
+  combinations every HTTP client reimplements.
+
+### Keystores
+
+| Backend | Platform | Keys | Extra |
+| --- | --- | --- | --- |
+| `cng` | Windows | certificate stores: software (incl. non-exportable), TPM, smart cards and virtual smart cards, legacy CryptoAPI CSPs | none |
+| `pkcs11` | any | PKCS#11 tokens: smart cards (real or virtual) via OpenSC, HSMs, TPMs, SoftHSM | none |
+
+## Installation
+
+```bash
+pip install sslcontext
+```
+
+## Quick start
+
+Behave like the system's browser: the OS verifies the server, and when a
+server asks for a client certificate the matching one is chosen from the
+system's keystores. Build it once and share it:
+
+```python
+import urllib.request
+import sslcontext
+
+ctx = sslcontext.system_context()
+urllib.request.urlopen("https://intranet.example.com/", context=ctx)
+```
+
+A client certificate and key, from files, PEM text, bytes, `pathlib`
+paths or `cryptography` objects alike:
+
+```python
+import sslcontext
+
+ctx = sslcontext.create_context(ca="ca.pem", certificate="client.pem", key=key_pem)
+```
+
+Use a certificate from the Windows store whose key cannot be exported:
+
+```python
+import urllib.request
+import sslcontext
+from sslcontext.backends import CNGBackend
+
+ctx = sslcontext.create_context()
+sslcontext.load_identity(ctx, CNGBackend().find_identity(subject="alice"))
+urllib.request.urlopen("https://mtls.example.com/", context=ctx)
+```
+
+Use a smart card through its PKCS#11 module. The PIN callback decides how
+the PIN is obtained; with no PIN, signing fails instead of waiting:
+
+```python
+from getpass import getpass
+from sslcontext.backends import PKCS11Backend
+
+def pin(request: sslcontext.PinRequest):
+    if request.purpose == "list":
+        return None  # list without logging in
+    return getpass(f"PIN for {request.token}: ")
+
+card = PKCS11Backend(pin=pin)
+sslcontext.load_identity(ctx, card.find_identity(subject="alice"))
+```
+
+## API overview
+
+| Module | Purpose |
+| --- | --- |
+| `sslcontext` | context builders (`system_context`, `create_context`), identity loading, client certificate selection, the `Signer` contract |
+| `sslcontext.backends` | keystore backends and their registry |
+| `sslcontext.issuing` | a local certificate authority issuing server certificates |
+| `sslcontext.testing` | `SoftwareSigner`, an in-memory signer for tests |
+| `sslcontext.exceptions` | the package's errors |
+
+## Command line
+
+`pip install "sslcontext[cli]"` adds `sslcontext`: `sslcontext list` shows the
+client certificates the system's keystores hold, and `sslcontext probe
+https://intranet.example/` shows what a server asks for and which
+certificate answers it.
+
+## Development
+
+```bash
+dotagents pyvenv && dotagents pyvenv 3.9
+.pyvenv/<tag>/Scripts/python -m pip install -e ".[dev]"
+.pyvenv/<tag>/Scripts/python -m pytest -q -rs
+```
+
+### Releasing
+
+This project follows [Semantic Versioning](https://semver.org/) and keeps a
+[`CHANGELOG.md`](https://github.com/jose-pr/sslcontext/blob/main/CHANGELOG.md).
+Pushing a tag matching `v*` triggers the release workflow: test gate → build
+(checking the tag names the version built) → a strict docs build as a gate →
+GitHub release → publish. The release workflow never deploys the docs site
+itself: for a final release its last job dispatches the docs workflow at the
+tag, which owns every Pages deploy.
+
+## License
+
+MIT — see [LICENSE](https://github.com/jose-pr/sslcontext/blob/main/LICENSE).

sslcontext-2.1.0/README.md

@@ -0,0 +1,136 @@
+# sslcontext
+
+[![Version](https://img.shields.io/pypi/v/sslcontext.svg)](https://pypi.org/project/sslcontext/)
+[![Python versions](https://img.shields.io/pypi/pyversions/sslcontext.svg)](https://pypi.org/project/sslcontext/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](https://github.com/jose-pr/sslcontext/blob/main/LICENSE)
+[![Docs](https://img.shields.io/badge/docs-latest-blue.svg)](https://jose-pr.github.io/sslcontext/)
+[![CI](https://img.shields.io/github/actions/workflow/status/jose-pr/sslcontext/test.yml)](https://github.com/jose-pr/sslcontext/actions/workflows/test.yml)
+
+**Client certificates whose private keys never leave the OS keystore, in a
+plain `ssl.SSLContext`.** `sslcontext` signs TLS handshakes through Windows
+CNG, the macOS Keychain or a PKCS#11 token (smart cards included), so every
+library that accepts an `ssl_context` gets mutual TLS with no patching, no
+temporary key files and no compiled extension; `system_context()` also picks the certificate as the
+browser would. Documentation: <https://jose-pr.github.io/sslcontext/>.
+
+## Features
+
+- **Keystore identities in stdlib `ssl`** — non-exportable and smart-card
+  keys work, because the key is used through the keystore, never copied.
+- **Pure Python** — ctypes over the OpenSSL that Python itself loaded: an
+  OpenSSL 3 provider on modern builds, an OpenSSL 1.1 engine on older ones.
+- **In-memory credentials** — load PEM or PKCS#12 bytes into a context
+  without writing a key to disk.
+- **Never blocks on a PIN** — PINs and passwords come from a value or a
+  callback you write; with none, operations fail at once. Keystore dialogs
+  and PIN pads are opt-in.
+- **The system's context** — `system_context()`: the OS verifies servers
+  (truststore) and, when a server asks, the client certificate is chosen
+  as the browser would: from the system's keystores, matching the CAs the
+  server names, following Edge's and Chrome's `AutoSelectCertificateForUrls`
+  policy, your rules or your callback, and never blocking.
+- **One context builder** — `create_context()` for the verify/cafile/capath
+  combinations every HTTP client reimplements.
+
+### Keystores
+
+| Backend | Platform | Keys | Extra |
+| --- | --- | --- | --- |
+| `cng` | Windows | certificate stores: software (incl. non-exportable), TPM, smart cards and virtual smart cards, legacy CryptoAPI CSPs | none |
+| `pkcs11` | any | PKCS#11 tokens: smart cards (real or virtual) via OpenSC, HSMs, TPMs, SoftHSM | none |
+
+## Installation
+
+```bash
+pip install sslcontext
+```
+
+## Quick start
+
+Behave like the system's browser: the OS verifies the server, and when a
+server asks for a client certificate the matching one is chosen from the
+system's keystores. Build it once and share it:
+
+```python
+import urllib.request
+import sslcontext
+
+ctx = sslcontext.system_context()
+urllib.request.urlopen("https://intranet.example.com/", context=ctx)
+```
+
+A client certificate and key, from files, PEM text, bytes, `pathlib`
+paths or `cryptography` objects alike:
+
+```python
+import sslcontext
+
+ctx = sslcontext.create_context(ca="ca.pem", certificate="client.pem", key=key_pem)
+```
+
+Use a certificate from the Windows store whose key cannot be exported:
+
+```python
+import urllib.request
+import sslcontext
+from sslcontext.backends import CNGBackend
+
+ctx = sslcontext.create_context()
+sslcontext.load_identity(ctx, CNGBackend().find_identity(subject="alice"))
+urllib.request.urlopen("https://mtls.example.com/", context=ctx)
+```
+
+Use a smart card through its PKCS#11 module. The PIN callback decides how
+the PIN is obtained; with no PIN, signing fails instead of waiting:
+
+```python
+from getpass import getpass
+from sslcontext.backends import PKCS11Backend
+
+def pin(request: sslcontext.PinRequest):
+    if request.purpose == "list":
+        return None  # list without logging in
+    return getpass(f"PIN for {request.token}: ")
+
+card = PKCS11Backend(pin=pin)
+sslcontext.load_identity(ctx, card.find_identity(subject="alice"))
+```
+
+## API overview
+
+| Module | Purpose |
+| --- | --- |
+| `sslcontext` | context builders (`system_context`, `create_context`), identity loading, client certificate selection, the `Signer` contract |
+| `sslcontext.backends` | keystore backends and their registry |
+| `sslcontext.issuing` | a local certificate authority issuing server certificates |
+| `sslcontext.testing` | `SoftwareSigner`, an in-memory signer for tests |
+| `sslcontext.exceptions` | the package's errors |
+
+## Command line
+
+`pip install "sslcontext[cli]"` adds `sslcontext`: `sslcontext list` shows the
+client certificates the system's keystores hold, and `sslcontext probe
+https://intranet.example/` shows what a server asks for and which
+certificate answers it.
+
+## Development
+
+```bash
+dotagents pyvenv && dotagents pyvenv 3.9
+.pyvenv/<tag>/Scripts/python -m pip install -e ".[dev]"
+.pyvenv/<tag>/Scripts/python -m pytest -q -rs
+```
+
+### Releasing
+
+This project follows [Semantic Versioning](https://semver.org/) and keeps a
+[`CHANGELOG.md`](https://github.com/jose-pr/sslcontext/blob/main/CHANGELOG.md).
+Pushing a tag matching `v*` triggers the release workflow: test gate → build
+(checking the tag names the version built) → a strict docs build as a gate →
+GitHub release → publish. The release workflow never deploys the docs site
+itself: for a final release its last job dispatches the docs workflow at the
+tag, which owns every Pages deploy.
+
+## License
+
+MIT — see [LICENSE](https://github.com/jose-pr/sslcontext/blob/main/LICENSE).

sslcontext-2.1.0/docs/api/reference.md

@@ -0,0 +1,41 @@
+# API Reference
+
+Every public name, generated from the package's own docstrings.
+
+The same surface in prose, with the bounds and the gotchas, is the API header
+that ships inside the installed package, `sslcontext/AGENTS.md`, readable with
+`importlib.resources.files("sslcontext")` and printed in the Guide of this site.
+
+::: sslcontext
+    options:
+      show_root_heading: false
+      members_order: source
+      filters:
+        - "!^_"
+
+## Keystore backends
+
+::: sslcontext.backends
+    options:
+      show_root_heading: false
+      members_order: source
+      filters:
+        - "!^_"
+
+## Issuing certificates
+
+::: sslcontext.issuing
+    options:
+      show_root_heading: false
+      members_order: source
+      filters:
+        - "!^_"
+
+## Test helpers
+
+::: sslcontext.testing
+    options:
+      show_root_heading: false
+      members_order: source
+      filters:
+        - "!^_"

sslcontext-2.1.0/docs/changelog.md

@@ -0,0 +1,3 @@
+# Changelog
+
+--8<-- "CHANGELOG.md"

sslcontext-2.1.0/docs/header.md

@@ -0,0 +1,7 @@
+# The API header
+
+The reference that ships inside the installed package as
+`sslcontext/AGENTS.md`: every public name with its signature, contract and
+gotchas.
+
+--8<-- "src/sslcontext/AGENTS.md"

sslcontext-2.1.0/docs/index.md

@@ -0,0 +1,59 @@
+# sslcontext
+
+**Client certificates whose private keys never leave the OS keystore, in a
+plain `ssl.SSLContext`.** `sslcontext` signs TLS handshakes through Windows
+CNG, the macOS Keychain or a PKCS#11 token (smart cards included), so every
+library that takes an `ssl_context` gets mutual TLS with no patching, no
+temporary key files and no compiled extension. It drives the TLS library your
+Python already loaded, through ctypes: OpenSSL 1.1.1 and 3.x, and the
+LibreSSL of Apple's bundled Python. Nothing ever waits for a PIN unless you
+say how one is given.
+
+## Installation
+
+```bash
+pip install sslcontext
+```
+
+Requires Python 3.9 or newer.
+
+| Extra | Adds | Needed for |
+| --- | --- | --- |
+| `cli` | `duho` | the `sslcontext` command |
+
+## 30-second tour
+
+Behave like the system's browser: the OS verifies the server and, when a
+server asks for a client certificate, the matching one is chosen from the
+system's keystores. Build it once and share it:
+
+```python
+import urllib.request
+import sslcontext
+
+ctx = sslcontext.system_context()
+urllib.request.urlopen("https://intranet.example.com/", context=ctx)
+```
+
+Or name the certificate yourself:
+
+```python
+from sslcontext.backends import CNGBackend, PKCS11Backend
+
+ctx = sslcontext.create_context()
+sslcontext.load_identity(ctx, CNGBackend().find_identity(subject="alice"))
+# or a smart card: PKCS11Backend(pin=...).find_identity(label="...")
+```
+
+See which certificate a server would get:
+
+```bash
+sslcontext list
+sslcontext probe https://intranet.example.com/
+```
+
+## Learn more
+
+- [The API header](header.md): every public name, its contract and gotchas.
+- [API reference](api/reference.md), generated from the docstrings.
+- [Changelog](changelog.md)

sslcontext-2.1.0/mkdocs.yml

@@ -0,0 +1,52 @@
+site_name: sslcontext
+site_description: "Client certificates from OS keystores (Windows CNG, PKCS#11 smart cards) in a standard ssl.SSLContext, chosen as the browser would"
+site_url: https://jose-pr.github.io/sslcontext/
+repo_url: https://github.com/jose-pr/sslcontext
+repo_name: jose-pr/sslcontext
+edit_uri: edit/main/docs/
+
+# Constrain the scan to docs/ so pymdownx.snippets and strict nav do not trip
+# on repo-level markdown.
+docs_dir: docs
+
+theme:
+  name: material
+  palette:
+    - media: "(prefers-color-scheme: light)"
+      scheme: default
+      toggle:
+        icon: material/brightness-7
+        name: Switch to dark mode
+    - media: "(prefers-color-scheme: dark)"
+      scheme: slate
+      toggle:
+        icon: material/brightness-4
+        name: Switch to light mode
+  features:
+    - navigation.sections
+    - content.code.copy
+
+nav:
+  - Home: index.md
+  - Guide:
+      - The API header: header.md
+  - API Reference:
+      - Overview: api/reference.md
+  - Changelog: changelog.md
+
+plugins:
+  - search
+  - mkdocstrings:
+      handlers:
+        python:
+          options:
+            show_source: true
+            show_root_heading: true
+            merge_init_into_class: true
+
+markdown_extensions:
+  - admonition
+  - tables
+  - pymdownx.snippets:
+      base_path: ["."]
+  - pymdownx.superfences