> Right, socket._socketobject mearly nulls out the reference to _socket.socket, and lets reference counting take care of the rest.

Ugh this is bad... I thought close() was exactly there when you don't want to depend on refcounting for cleanup.

> * When do_handshake() raises an exception (say, a CertificateError), then a reference to a traceback is stored for sys.exc_info()
> * This traceback holds a reference to a frame where ssl.SSLObject is self
> * ssl.SSLObject holds a reference to _ssl._SSLSocket
> * Which holds a reference to _socket.socket

On Python 3.x the last one above is a weakref. 

> It seems like ``ssl.SSLSocket.close()`` should probably explicitly close the ``SSLObject`` somehow? I think this problem would appear on Python3 if you caught the exception manually and kept a reference to it?

On Python 3.x socket.close() does a real close() on the socket, it seems. (thought it appears to have an app-level refcount for makefile()). I agree this is the best way but it seems very scary to make that change for 2.7.

I think that closing the socket in SSLSocket.close(), as you suggest, would work (using socket._sock.close()), or or maybe you can make the "Socket" member in _SSLSocket a weakref?