def _startTLS(self, caps, contextFactory, tls):
        """
        Continue the process of switching to encrypted communication.

        This callback function runs after the server capabilities are received.

        The next step is sending the server an STLS command to request a
        switch to encrypted communication.  When an OK response is received,
        the L{_startedTLS} callback function completes the switch to encrypted
        communication. Then, the new server capabilities are requested.

        @type caps: L{dict} mapping L{bytes} to L{list} of L{bytes} and/or
            L{bytes} to L{None}
        @param caps: The server capabilities.

        @type contextFactory: L{ClientContextFactory
            <twisted.internet.ssl.ClientContextFactory>}
        @param contextFactory: A context factory with which to negotiate TLS.

        @type tls: L{ITLSTransport <interfaces.ITLSTransport>}
        @param tls: A TCP transport that supports switching to TLS midstream.

        @rtype: L{Deferred <defer.Deferred>} which successfully triggers with
            L{dict} mapping L{bytes} to L{list} of L{bytes} and/or L{bytes} to
            L{None} or fails with L{TLSNotSupportedError}
        @return: A deferred which successfully fires when the response from
            the server to the request to start TLS has been received and the
            new server capabilities have been received or fails when the server
            does not support TLS.
        """
        assert not self.startedTLS, "Client and Server are currently communicating via TLS"

        if b'STLS' not in caps:
            return defer.fail(TLSNotSupportedError(
                "Server does not support secure communication "
                "via TLS / SSL"))

        d = self.sendShort(b'STLS', None)
        d.addCallback(self._startedTLS, contextFactory, tls)
        d.addCallback(lambda _: self.capabilities())
        return d

        Continue the process of switching to encrypted communication.

        This callback function runs after the server capabilities are received.

        The next step is sending the server an STLS command to request a
        switch to encrypted communication.  When an OK response is received,
        the L{_startedTLS} callback function completes the switch to encrypted
        communication. Then, the new server capabilities are requested.

        @type caps: L{dict} mapping L{bytes} to L{list} of L{bytes} and/or
            L{bytes} to L{None}
        @param caps: The server capabilities.

        @type contextFactory: L{ClientContextFactory
            <twisted.internet.ssl.ClientContextFactory>}
        @param contextFactory: A context factory with which to negotiate TLS.

        @type tls: L{ITLSTransport <interfaces.ITLSTransport>}
        @param tls: A TCP transport that supports switching to TLS midstream.

        @rtype: L{Deferred <defer.Deferred>} which successfully triggers with
            L{dict} mapping L{bytes} to L{list} of L{bytes} and/or L{bytes} to
            L{None} or fails with L{TLSNotSupportedError}
        @return: A deferred which successfully fires when the response from
            the server to the request to start TLS has been received and the
            new server capabilities have been received or fails when the server
            does not support TLS.
        
stackoverflow/venv/lib/python3.6/site-packages/twisted/mail/pop3client.py