gh-91826: Document that smtplib/poplib/ftplib TLS defaults do not verify certs

[Vamsi-klu]

Summary

Documentation-only follow-up to the long-standing issue that the stdlib mail/FTP TLS clients encrypt by default without verifying the peer certificate or hostname. This does not flip any runtime defaults (that remains PEP-gated on gh-91826). It closes the "users had no idea" half of the problem the same way gh-72507 / PR #152778 already did for imaplib.

Fixes part of gh-91826 (docs slice only).

---

What the issue is

smtplib, poplib, ftplib (and historically imaplib) obtain their default SSLContext from ssl._create_stdlib_context, which is an alias of ssl._create_unverified_context (cert_reqs=CERT_NONE, check_hostname=False). The connection is encrypted, but:

• a MITM can present any certificate,
• hostname mismatches are ignored,
• and nothing in the module docs said so for SMTP/POP/FTP.

imaplib already documents this (merged PR #152778). Users who only read smtplib / poplib / ftplib still had no in-tree warning, and Doc/library/security_warnings.rst did not list these modules either. That is a documentation gap on a security-sensitive default, independent of whether/when the default is flipped.

---

Why I solved it that way

1. Docs-only, no behavior change. Flipping verification on by default is blocked on a PEP / core-dev sponsor (two PEP attempts already died). Shipping docs does not require that process and is immediately backportable.
2. Copy the already-accepted wording. PR gh-72507: Document that imaplib does not verify TLS certificates by default #152778 established the note text and placement for IMAP4_SSL / IMAP4.starttls. Reusing it avoids inventing a second house style and makes the four modules consistent.
3. Parameter name adapted per API. imaplib uses *ssl_context*; the others use *context*. The note text uses the local parameter name so it matches the signature the reader is looking at.
4. security_warnings.rst bullets. That page is the stdlib index of "look here before you ship." Listing all four modules (including imaplib for completeness) matches how ssl / http.server / etc. are already called out.

I deliberately did not:

• change ssl._create_stdlib_context,
• add DeprecationWarnings,
• touch logging.handlers.SMTPHandler,
• or reopen the PEP track in this PR.

Those belong in separate workstreams so this PR stays reviewable in minutes.

---

How I did it

File	Change
Doc/library/smtplib.rst	Note on SMTP_SSL and SMTP.starttls
Doc/library/poplib.rst	Note on POP3_SSL and POP3.stls
Doc/library/ftplib.rst	Note on FTP_TLS (near context)
Doc/library/security_warnings.rst	Bullets for ftplib, imaplib, poplib, smtplib

Each note is:

.. note::

   With the default *context*, the connection is encrypted but the
   server certificate and hostname are not verified.
   To verify them, pass a context created by
   :func:`ssl.create_default_context`.

---

Impact

• Users: discover the insecure default in the first place they look (class/method docs and the security-warnings index).
• Runtime: zero. No bytecode, no ABI, no test expectation changes.
• Backports: safe for 3.15 / 3.14 / 3.13 (docs-only). Not needed on security-only branches unless an RM wants it.
• Does not close Enable TLS certificate validation by default for SMTP/IMAP/FTP/POP/NNTP protocols #91826 fully — only the documentation half. The default-flip remains open.

---

Testing plan

• Sphinx-lint / pre-commit on the touched .rst files (passed locally via pre-commit hook).
• Docs build (make -C Doc html or CI docs job) to confirm no broken refs to ssl.create_default_context.
• Visual check that notes render under the correct signatures on the HTML docs.

No unit tests: pure documentation.

---

Everything else

• Precedent: Hostname validation is False by default in imaplib #72507 / gh-72507: Document that imaplib does not verify TLS certificates by default #152778 (imaplib).
• Related but out of scope: Change default security of ftplib.FTP_TLS #143497 (FTP_TLS PROT P default), stale PR gh-91826: Enable cert and hostname verification for stdlib #91875 (full flip), draft PEP 738.
• Suggested reviewers: docs + ssl/stdlib TLS SMEs (see review request).
• Backport labels: please add needs backport to 3.15, 3.14, 3.13 if desired after merge.

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[read-the-docs-community]

Documentation build overview

📚 cpython-previews | 🛠️ Build #33762060 | 📁 Comparing abb5816 against main (f5f5059)

  🔍 Preview build  

4 files changed

± library/ftplib.html
± library/poplib.html
± library/security_warnings.html
± library/smtplib.html

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Keep them coming!

Reviewed commit: abb581689a

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Vamsi-klu]

Closing this PR. Thank you for the review attention.