> +.. attribute:: SSLSocket.server_hostname
> +
> +   A ``bytes`` instance (...)
>
> Ah, this is a mistake. It's actually always a str instance (on SSLObject as well).

It is indeed, I stand corrected. I was confused by the decode -> encode roundtrip that happens in _ssl.

However I think that in theory SSLSocket.server_hostname could be a bytes, if a bytes was passed into the constructor. _ssl parses this argument with the "et" format which means it will let a correctly encoded byte string through. Not sure if anybody is using this though.