Merge pull request #2690 from kleptog/bug2689

SSLIOStream: Handle CertificateErrors like other errors

Author: bdarnell

tornado/iostream.py

@@ -1413,6 +1413,10 @@ def _do_ssl_handshake(self) -> None:
                 )
                 return self.close(exc_info=err)
             raise
+        except ssl.CertificateError as err:
+            # CertificateError can happen during handshake (hostname
+            # verification) and should be passed to user
+            return self.close(exc_info=err)
         except socket.error as err:
             # Some port scans (e.g. nmap in -sT mode) have been known
             # to cause do_handshake to raise EBADF and ENOTCONN, so make