Add ClientResponse.certificate and populate it, if appropriate

CHANGES/2816.feature

@@ -0,0 +1 @@
+Added ``ClientResponse.certificate``, which is populated, if appropriate, with the certificate of the server.

CONTRIBUTORS.txt

@@ -261,6 +261,7 @@ Pavol Vargovčík
 Pawel Kowalski
 Pawel Miech
 Pepe Osca
+Petros Blanis
 Philipp A.
 Pieter van Beek
 Qiao Han

aiohttp/client_reqrep.py

@@ -699,6 +699,7 @@ def __init__(
 
         self.method = method
         self.cookies: SimpleCookie[str] = SimpleCookie()
+        self.certificate: Optional[Dict[str, Union[Tuple[Any, ...], int, str]]] = None
 
         self._real_url = url
         self._url = url.with_fragment(None)
@@ -860,6 +861,9 @@ async def start(self, connection: "Connection") -> "ClientResponse":
                     set_result(self._continue, True)
                     self._continue = None
 
+        if self._connection is not None and self._connection.transport is not None:
+            self.certificate = self._connection.transport.get_extra_info("peercert")
+
         # payload eof handler
         payload.on_eof(self._response_eof)
 

docs/client_reference.rst

@@ -1360,6 +1360,12 @@ Response object
       objects of preceding requests (earliest request first) if there were
       redirects, an empty sequence otherwise.
 
+   .. attribute:: certificate
+
+      The server certificate. This is available with TLS connections,
+      if the certificate is retrieved before the connection or the TLS session is
+      closed, otherwise it is ``None``.
+
    .. method:: close()
 
       Close response and underlying connection.

tests/test_client_request.py

@@ -13,7 +13,7 @@
 from yarl import URL
 
 import aiohttp
-from aiohttp import BaseConnector, hdrs, payload
+from aiohttp import BaseConnector, hdrs, payload, web
 from aiohttp.client_reqrep import (
     ClientRequest,
     ClientResponse,
@@ -1230,3 +1230,28 @@ def test_loose_cookies_types(loop: Any) -> None:
 def test_gen_default_accept_encoding(has_brotli: Any, expected: Any) -> None:
     with mock.patch("aiohttp.client_reqrep.HAS_BROTLI", has_brotli):
         assert _gen_default_accept_encoding() == expected
+
+
+async def test_certificate_exists(
+    ssl_ctx: Any, client_ssl_ctx: Any, aiohttp_client: Any, aiohttp_raw_server: Any
+) -> None:
+    async def handler(request):
+        return web.Response(text="ok")
+
+    server = await aiohttp_raw_server(handler, ssl=ssl_ctx)
+
+    async with await aiohttp_client(
+        server, connector=aiohttp.TCPConnector(ssl=client_ssl_ctx)
+    ) as client:
+        async with await client.get("/") as resp:
+            assert frozenset(resp.certificate) >= frozenset(
+                (
+                    "subject",
+                    "issuer",
+                    "version",
+                    "serialNumber",
+                    "notBefore",
+                    "notAfter",
+                    "subjectAltName",
+                )
+            )