Update SMTP Email Backend to use an SSLContext.

[Luis Saavedra]

Setting SSL cert and key in ​`SMTP.starttls()` is deprecated (since Python 3.6) in favour of passing an SSLContext. Update the SMTP backend to use the newer API.

​https://github.com/django/django/pull/13305

[Carlton Gibson]

Thanks for the report. Yes, an update here sounds good.

We'll need docs and tests for the changes. You've added new settings, those will need documenting too.
Then, do we need to deprecate the old settings, as no longer appropriate?

[Luis Saavedra]

The old settings are good because set the authenticity credentials of a client, this pull request add the CA parameters to check the authenticity of the server. A man in the midle attack can pass any certificate to the client and the client can't check the authenticity because dont have CA parameters.

[Carlton Gibson]

Updating flags to put back in the review queue

[Carlton Gibson]

PR looks good. Just needs to add deprecations for the old keyfile and certfile way of doing things.

[Carlton Gibson]

So ​conclusion on the PR is that we should add the option to accept the parameters for an SSLContext on EmailBackend but not add them as settings. (The default is to use the system CA certs which is what most people want/need.)

We will then recommend subclassing in the docs for more control.

At the same time we should deprecate EMAIL_SSL_CERTFILE and EMAIL_SSL_KEYFILE for the same reasons.

[Mariusz Felisiak]

EmailBackend uses SSLContext since 2848e5d0ce5cf3c31fe87525536093b21d570f69. Users can subclass EmailBackend and override the ssl_context property to use custom cart/key files. Maybe it's enough to consider this ticket as fixed 🤔

[Carlton Gibson]

...override the ssl_context property to use custom crt/key files.

The ssl_context still uses the settings, so not sure they need to subclass even.
(I still we expose too much of smtplib through the settings here, but progress there is likely Jacob's proposal from ​https://groups.google.com/g/django-developers/c/R8ebGynQjK0/m/kc-zggaxAgAJ)

I agree the narrow ticket here was resolved in 2848e5d0ce5cf3c31fe87525536093b21d570f69. 👍