Most of the time, the connection between a circulation manager and a SIP2 server is not secured by TLS; rather, the connection happens on a private network.

However, some libraries do secure the connection to their SIP2 servers, and the circulation manager needs to be able to communicate with these servers.

I believe this means using Python's ssl.wrap_socket() to upgrade the socket connection where appropriate. We would either a) add a connection configuration controlling whether to try and upgrade the socket configuration or b) always try to upgrade the socket configuration and fall back if it's not possible.