Provide an explicit and configurable way to enable/disable certificate checking

[juanvalino]

We need some way to enable/disable certificate checking. Currently the library uses the top-level wrap_socket function, which got removed in Python 3.12; that one never did certificate validation. However, using default context's wrap_socket always did certificate validation (since Python 2.7.x for some x < 20 IIRC).

[gdt]

Agreed, and I think it should default to enabled.

[amotl]

Hi. xmpppy 0.7.2 has been released, including your improvement 48c14cc in this regard. Thank you very much.

[gdt]

Is there no way to set it to enabled/disabled programmatically?
My view is that in 2025, not doing pkix validation by default is a bug, and we should just fix the bug, and then as a lower priority option add a --no-check-certificates similar to wget.

[gdt]

I commented out the two "don't do pkix validation" lines, and it turns out each provokes an error. The first exposes the problem that the TLS code hasn't been given the server hostname. The second exposes something that seems like "configure system trust anchors" hasn't happened.