diff -r 07fa1ed0d551 Lib/ssl.py
--- a/Lib/ssl.py    Wed Nov 06 17:25:17 2013 +0100
+++ b/Lib/ssl.py    Thu Nov 07 22:23:23 2013 +0100
@@ -278,7 +278,7 @@
     """An SSLContext holds various SSL-related configuration options and
     data, such as certificates and possibly a private key."""

-    __slots__ = ('protocol', '__weakref__')
+    __slots__ = ('protocol', '_check_cert', '__weakref__')

     def __new__(cls, protocol, *args, **kwargs):
         self = _SSLContext.__new__(cls, protocol)
@@ -286,8 +286,9 @@
             self.set_ciphers(_DEFAULT_CIPHERS)
         return self

-    def __init__(self, protocol):
+    def __init__(self, protocol, *, check_cert=None):
         self.protocol = protocol
+        self._check_cert = check_cert

     def wrap_socket(self, sock, server_side=False,
                     do_handshake_on_connect=True,
@@ -310,6 +311,27 @@

         self._set_npn_protocols(protos)

+    def check_cert(self, sslsock, hostname=None, *, initiator=None, **kwargs):
+        check_cert = self._check_cert
+        if callable(check_cert):
+            return check_cert(sslsock=sslsock, hostname=hostname,
+                              initiator=initiator, **kwargs)
+        will_verify = self.verify_mode != CERT_NONE
+        if check_cert is None:
+            check_cert = will_verify
+        elif check_cert and not will_verify:
+            raise CertificateError("check_cert needs a SSL context with "
+                                   "either CERT_OPTIONAL or CERT_REQUIRED")
+        if not check_cert:
+            return False
+        if hostname is None:
+            hostname = sslsock.server_hostname
+            if hostname is None:
+                raise CertificateError("check_cert needs a hostname or a ssl "
+                                       "socket with server_hostname.")
+        match_hostname(sslsock.getpeercert(), hostname)
+        return True
+

 class SSLSocket(socket):
     """This class implements a subtype of socket.socket that wraps
@@ -685,6 +707,17 @@
             return None
         return self._sslobj.tls_unique_cb()

+    def check_cert(self, hostname=None, *, close_onerror=False,
+                   initiator=None, **kwargs):
+        try:
+            return self.context.check_cert(self, hostname=hostname,
+                                           initiator=initiator, **kwargs)
+        except Exception:
+            if close_onerror:
+                self.shutdown(socket.SHUT_RDWR)
+                self.close()
+            raise
+

 def wrap_socket(sock, keyfile=None, certfile=None,
                 server_side=False, cert_reqs=CERT_NONE,