Add ClientResponse.certificate and populate it, if appropriate

CHANGES/2816.feature

@@ -0,0 +1 @@
+Added ``ClientResponse.certificate``, which is populated, if appropriate, with the certificate of the server.

CONTRIBUTORS.txt

@@ -261,6 +261,7 @@ Pavol Vargovčík
 Pawel Kowalski
 Pawel Miech
 Pepe Osca
+Petros Blanis
 Philipp A.
 Pieter van Beek
 Qiao Han

aiohttp/client_reqrep.py

@@ -699,6 +699,7 @@ def __init__(
 
         self.method = method
         self.cookies: SimpleCookie[str] = SimpleCookie()
+        self.certificate: Optional[Dict[str, Union[Tuple[Any, ...], int, str]]] = None
 
         self._real_url = url
         self._url = url.with_fragment(None)
@@ -860,6 +861,13 @@ async def start(self, connection: "Connection") -> "ClientResponse":
                     set_result(self._continue, True)
                     self._continue = None
 
+        # certificate
+        is_tls_transport = (
+            self._connection is not None and self._connection.transport is not None
+        )
+        if is_tls_transport:
+            self.certificate = self._connection.transport.get_extra_info("peercert")
+
         # payload eof handler
         payload.on_eof(self._response_eof)
 

docs/client_reference.rst

@@ -1360,6 +1360,12 @@ Response object
       objects of preceding requests (earliest request first) if there were
       redirects, an empty sequence otherwise.
 
+   .. attribute:: certificate
+
+      The server certificate. This is available with TLS connections,
+      if the certificate is retrieved before the connection or the TLS session are
+      closed, otherwise it is ``None``.
+
    .. method:: close()
 
       Close response and underlying connection.

tests/test_client_request.py

@@ -13,7 +13,7 @@
 from yarl import URL
 
 import aiohttp
-from aiohttp import BaseConnector, hdrs, payload
+from aiohttp import BaseConnector, hdrs, payload, web
 from aiohttp.client_reqrep import (
     ClientRequest,
     ClientResponse,
@@ -1230,3 +1230,31 @@ def test_loose_cookies_types(loop: Any) -> None:
 def test_gen_default_accept_encoding(has_brotli: Any, expected: Any) -> None:
     with mock.patch("aiohttp.client_reqrep.HAS_BROTLI", has_brotli):
         assert _gen_default_accept_encoding() == expected
+
+
+async def test_certificate_exists(ssl_ctx, client_ssl_ctx) -> None:
+    async def handler(request):
+        return web.Response(text="ok")
+
+    server = web.Server(handler)
+    runner = web.ServerRunner(server)
+    await runner.setup()
+    site = web.TCPSite(runner, ssl_context=ssl_ctx)
+    await site.start()
+
+    async with aiohttp.ClientSession() as session:
+        resp = await session.get("https://127.0.0.1:8443", ssl=client_ssl_ctx)
+    assert frozenset(resp.certificate) >= frozenset(
+        (
+            "subject",
+            "issuer",
+            "version",
+            "serialNumber",
+            "notBefore",
+            "notAfter",
+            "subjectAltName",
+        )
+    )
+    resp.close()
+    await site.stop()
+    await server.shutdown()