'Returns True if peercert is valid according to the configured
validation mode and hostname.
The ssl handshake already tested the certificate for a valid
CA signature; the only thing that remains is to check
the hostname.'

def _verify_cert(self, peercert):

    if isinstance(self._ssl_options, dict):
        verify_mode = self._ssl_options.get('cert_reqs', ssl.CERT_NONE)
    elif isinstance(self._ssl_options, ssl.SSLContext):
        verify_mode = self._ssl_options.verify_mode
    assert (verify_mode in (ssl.CERT_NONE, ssl.CERT_REQUIRED, ssl.CERT_OPTIONAL))
    if ((verify_mode == ssl.CERT_NONE) or (self._server_hostname is None)):
        return True
    cert = self.socket.getpeercert()
    if ((cert is None) and (verify_mode == ssl.CERT_REQUIRED)):
        gen_log.warning('No    SSL    certificate    given')
        return False
    try:
        ssl_match_hostname(peercert, self._server_hostname)
    except SSLCertificateError:
        gen_log.warning('Invalid    SSL    certificate', exc_info=True)
        return False
    else:
        return True
