<p dir="auto">In  requests-2.18.1 and earlier:</p>
<p dir="auto"><code class="notranslate">requests.get('https://testssl-expire-r2i2.disig.sk/index.en.html')</code></p>
<p dir="auto">Used to raise <code class="notranslate">SSLError: ("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",)</code></p>
<p dir="auto">But as of requests-2.18.2 (the latest version), the same URL is returning <code class="notranslate">ConnectionError: HTTPSConnectionPool(host='testssl-expire-r2i2.disig.sk', port=443): Max retries exceeded with url: /index.en.html (Caused by SSLError(SSLError("bad handshake: Error([('SSL routines', 'tls_process_server_certificate', 'certificate verify failed')],)",),))</code></p>
<p dir="auto">I just need a confirmation that this change is intentional and if it is going to remain so (or not).</p>
<p dir="auto">Thanks.</p>
<p dir="auto">I'm floating this idea because currently our native <code class="notranslate">ssl</code> module support isn't being utilized by any requests users and I'm planning on making major improvements to SNI within native <code class="notranslate">ssl</code> support in urllib3 including leaning on the stdlib for hostname verification.  What are the thoughts on only using pyOpenSSL when <code class="notranslate">urllib3.util.HAS_SNI</code> is false?</p>