Use the public cryptography API for this!
MODIFY
urllib3/contrib/pyopenssl.py
urllib3/contrib/pyopenssl.py
@@ -183,8 +183,11 @@ def get_subj_alt_name(peer_cert):
Given an PyOpenSSL certificate, provides all the subject alternative names.
"""
# Pass the cert to cryptography, which has much better APIs for this.
+ if hasattr(peer_cert, "to_cryptography"):
+ cert = peer_cert.to_cryptography()
+ else:
# This is technically using private APIs, but should work across all
- # relevant versions until PyOpenSSL gets something proper for this.
+ # relevant versions before PyOpenSSL got a proper API for this.
cert = _Certificate(openssl_backend, peer_cert._x509)
# We want to find the SAN extension. Ask Cryptography to locate it (it's

Use the public cryptography API for this!