check_hostname defaults to true when true is invalid #160605

Bug report

#156793 introduces a regression where if you had code like this

asyncio.open_connection(host, port, ssl=ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT), server_hostname="")

you start getting ValueError: check_hostname requires server_hostname starting in 3.14.8 when the same code worked in 3.14.7.

I understand there was a change made for security reasons. If somebody has enabled check_hostname they expect hostname validation. However, this code does not enable check_hostname. It's being defaulted somewhere. The previous code was intentionally not checking the hostname.

I don't know how common this is. In my case, server_hostname is set to empty because the target service behaves incorrectly if it receives SNI, and hostname validation is not desired because the presented certificate is valid for no names. It's a server certificate, but it uses the client certificate validation pattern where the certificate must be signed by the expected CA.

CPython versions tested on:

3.14

Operating systems tested on:

Linux