PYTHON-2038 Remove pymongo.errors.CertificateError (#705)

doc/changelog.rst

@@ -93,6 +93,7 @@ Breaking Changes in 4.0
   :meth:`pymongo.message.query`, and :meth:`pymongo.message.update`.
 - Removed :exc:`pymongo.errors.NotMasterError`.
   Use :exc:`pymongo.errors.NotPrimaryError` instead.
+- Removed :exc:`pymongo.errors.CertificateError`.
 - Removed :attr:`pymongo.GEOHAYSTACK`.
 - Removed :class:`bson.binary.UUIDLegacy`.
 - The "tls" install extra is no longer necessary or supported and will be

doc/migrate-to-pymongo4.rst

@@ -582,6 +582,12 @@ NotMasterError is removed
 Removed :exc:`~pymongo.errors.NotMasterError`.
 Use :exc:`~pymongo.errors.NotPrimaryError` instead.
 
+CertificateError is removed
+---------------------------
+
+Removed :exc:`~pymongo.errors.CertificateError`. Since PyMongo 3.0 this error
+is handled internally and is never raised to the application.
+
 pymongo.GEOHAYSTACK is removed
 ------------------------------
 

pymongo/errors.py

@@ -18,14 +18,15 @@ from bson.errors import *
 
 try:
     # CPython 3.7+
-    from ssl import SSLCertVerificationError as CertificateError
+    from ssl import SSLCertVerificationError as _CertificateError
 except ImportError:
     try:
-        from ssl import CertificateError
+        from ssl import CertificateError as _CertificateError
     except ImportError:
-        class CertificateError(ValueError):
+        class _CertificateError(ValueError):
             pass
 
+
 class PyMongoError(Exception):
     """Base class for all PyMongo exceptions."""
     def __init__(self, message='', error_labels=None):

pymongo/pool.py

@@ -40,7 +40,7 @@ from pymongo.common import (MAX_BSON_SIZE,
                             ORDERED_TYPES,
                             WAIT_QUEUE_TIMEOUT)
 from pymongo.errors import (AutoReconnect,
-                            CertificateError,
+                            _CertificateError,
                             ConnectionFailure,
                             ConfigurationError,
                             InvalidOperation,
@@ -1013,7 +1013,7 @@ def _create_connection(address, options):
 def _configured_socket(address, options):
     """Given (host, port) and PoolOptions, return a configured socket.
 
-    Can raise socket.error, ConnectionFailure, or CertificateError.
+    Can raise socket.error, ConnectionFailure, or _CertificateError.
 
     Sets socket's SSL and timeout options.
     """
@@ -1034,9 +1034,9 @@ def _configured_socket(address, options):
                 sock = ssl_context.wrap_socket(sock, server_hostname=host)
             else:
                 sock = ssl_context.wrap_socket(sock)
-        except CertificateError:
+        except _CertificateError:
             sock.close()
-            # Raise CertificateError directly like we do after match_hostname
+            # Raise _CertificateError directly like we do after match_hostname
             # below.
             raise
         except (IOError, OSError, _SSLError) as exc:
@@ -1050,7 +1050,7 @@ def _configured_socket(address, options):
                 options.ssl_match_hostname):
             try:
                 ssl.match_hostname(sock.getpeercert(), hostname=host)
-            except CertificateError:
+            except _CertificateError:
                 sock.close()
                 raise
 
@@ -1310,7 +1310,7 @@ class Pool:
     def connect(self, all_credentials=None):
         """Connect to Mongo and return a new SocketInfo.
 
-        Can raise ConnectionFailure or CertificateError.
+        Can raise ConnectionFailure.
 
         Note that the pool does not keep a reference to the socket -- you
         must call return_socket() when you're done with it.

pymongo/pyopenssl_context.py

@@ -35,7 +35,7 @@ from service_identity import (
     VerificationError as _SIVerificationError)
 
 from pymongo.errors import (
-    CertificateError as _CertificateError,
+    _CertificateError,
     ConfigurationError as _ConfigurationError)
 from pymongo.ocsp_support import (
     _load_trusted_ca_certs,