Oddly, I expected to run into this with my code using SSLObject in trio [1], but if I connect to python.org:443 and then 'await trio_ssl_stream.do_handshake(); trio_ssl_stream.getpeercert()' it works just fine ... even though when I run the sslbugs.py script I get the same weird results Greg reports. As far as I can tell the logic is identical. So I guess this might potentially be useful to narrow this down :-).

Test code that works:

@trio.run
async def main():
    import trio
    sock = trio.socket.socket()
    addr = await sock.resolve_remote_address(("python.org", 443))
    await sock.connect(addr)
    s = trio.SocketStream(sock)
    client = trio.ssl.SSLStream(
        s, trio.ssl.create_default_context(), server_hostname="python.org")
    await client.do_handshake()
    print(client.getpeercert())

[1] Currently in https://github.com/python-trio/trio/pull/107, eventually will be at https://github.com/python-trio/trio/blob/master/trio/ssl.py