Require pyOpenSSL 17.1.0+ to support cryptography 39+
ADD
changelog/2829.feature.rst
+Support cryptography>=39 by requiring OpenSSL>=17.1.0 and cryptography>=1.9.

MODIFY
pyproject.toml
pyproject.toml
@@ -46,8 +46,8 @@ zstd = [
"zstandard>=0.18.0",
]
secure = [
- "pyOpenSSL>=0.14",
- "cryptography>=1.3.4",
+ "pyOpenSSL>=17.1.0",
+ "cryptography>=1.9",
"idna>=2.0.0",
"certifi",
"urllib3-secure-extra",

MODIFY
src/urllib3/contrib/pyopenssl.py
src/urllib3/contrib/pyopenssl.py
@@ -42,8 +42,6 @@ from __future__ import annotations
import OpenSSL.SSL # type: ignore[import]
from cryptography import x509
-from cryptography.hazmat.backends.openssl import backend as openssl_backend
-from cryptography.hazmat.backends.openssl.x509 import _Certificate
try:
from cryptography.x509 import UnsupportedExtension # type: ignore[attr-defined]
@@ -238,13 +236,7 @@ def get_subj_alt_name(peer_cert: X509) -> list[tuple[str, str]]:
"""
Given an PyOpenSSL certificate, provides all the subject alternative names.
"""
- # Pass the cert to cryptography, which has much better APIs for this.
- if hasattr(peer_cert, "to_cryptography"):
cert = peer_cert.to_cryptography()
- else:
- # This is technically using private APIs, but should work across all
- # relevant versions before PyOpenSSL got a proper API for this.
- cert = _Certificate(openssl_backend, peer_cert._x509)
# We want to find the SAN extension. Ask Cryptography to locate it (it's
# faster than looping in Python)

Require pyOpenSSL 17.1.0+ to support cryptography 39+

Co-authored-by: Illia Volochii <illia.volochii@gmail.com>