code: def _get_ssl_options(self, scheme):
      if scheme == "https":
          if self.request.ssl_options is not None:
              return self.request.ssl_options
          # If we are using the defaults, don't construct a
          # new SSLContext.
          if (
              self.request.validate_cert
              and self.request.ca_certs is None
              and self.request.client_cert is None
              and self.request.client_key is None
          ):
              return _client_ssl_defaults
          ssl_options = {}
          if self.request.validate_cert:
              ssl_options["cert_reqs"] = ssl.CERT_REQUIRED
          if self.request.ca_certs is not None:
              ssl_options["ca_certs"] = self.request.ca_certs
          elif not hasattr(ssl, "create_default_context"):
              # When create_default_context is present,
              # we can omit the "ca_certs" parameter entirely,
              # which avoids the dependency on "certifi" for py34.
              ssl_options["ca_certs"] = _default_ca_certs()
          if self.request.client_key is not None:
              ssl_options["keyfile"] = self.request.client_key
          if self.request.client_cert is not None:
              ssl_options["certfile"] = self.request.client_cert
  
          # SSL interoperability is tricky.  We want to disable
          # SSLv2 for security reasons; it wasn't disabled by default
          # until openssl 1.0.  The best way to do this is to use
          # the SSL_OP_NO_SSLv2, but that wasn't exposed to python
          # until 3.2.  Python 2.7 adds the ciphers argument, which
          # can also be used to disable SSLv2.  As a last resort
          # on python 2.6, we set ssl_version to TLSv1.  This is
          # more narrow than we'd like since it also breaks
          # compatibility with servers configured for SSLv3 only,
          # but nearly all servers support both SSLv3 and TLSv1:
          # http://blog.ivanristic.com/2011/09/ssl-survey-protocol-support.html
          if sys.version_info >= (2, 7):
              # In addition to disabling SSLv2, we also exclude certain
              # classes of insecure ciphers.
              ssl_options["ciphers"] = "DEFAULT:!SSLv2:!EXPORT:!DES"
          else:
              # This is really only necessary for pre-1.0 versions
              # of openssl, but python 2.6 doesn't expose version
              # information.
              ssl_options["ssl_version"] = ssl.PROTOCOL_TLSv1
          return ssl_options
      return None
  
imports: from __future__ import absolute_import, division, print_function
  from tornado.escape import utf8, _unicode
  from tornado import gen
  from tornado.httpclient import HTTPResponse, HTTPError, AsyncHTTPClient, main, _RequestProxy
  from tornado import httputil
  from tornado.http1connection import HTTP1Connection, HTTP1ConnectionParameters
  from tornado.iostream import StreamClosedError
  from tornado.netutil import Resolver, OverrideResolver, _client_ssl_defaults
  from tornado.log import gen_log
  from tornado import stack_context
  from tornado.tcpclient import TCPClient
  from tornado.util import PY3
  import base64
  import collections
  import copy
  import functools
  import re
  import socket
  import sys
  from io import BytesIO
label_desc: Use image node_id 2 for calling the _HTTPConnection obj's underlying member method code with example usage: obj._get_ssl_options(scheme) and returns: None, ssl_options, self, _client_ssl_defaults