From c2ee0d29382d9613cc3a8d4cee6cb4aa3ce239c4 Mon Sep 17 00:00:00 2001
From: Brad Warren <bmw@users.noreply.github.com>
Date: Fri, 5 Feb 2021 15:33:45 -0800
Subject: [PATCH] Remove requests[security] dependency (#8626)

Fixes https://github.com/certbot/certbot/issues/7901.

* stop using requests[security]

* add changelog entry

* remove unused import
---
 acme/acme/client.py          | 12 ------------
 acme/setup.py                |  2 +-
 certbot/CHANGELOG.md         |  4 +++-
 tools/oldest_constraints.txt |  2 +-
 4 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/acme/acme/client.py b/acme/acme/client.py
index d413ce13d..6adfe4b78 100644
--- a/acme/acme/client.py
+++ b/acme/acme/client.py
@@ -6,7 +6,6 @@ from email.utils import parsedate_tz
 import heapq
 import logging
 import re
-import sys
 import time
 
 import josepy as jose
@@ -30,17 +29,6 @@ from acme.mixins import VersionedLEACMEMixin
 
 logger = logging.getLogger(__name__)
 
-# Prior to Python 2.7.9 the stdlib SSL module did not allow a user to configure
-# many important security related options. On these platforms we use PyOpenSSL
-# for SSL, which does allow these options to be configured.
-# https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning
-if sys.version_info < (2, 7, 9):  # pragma: no cover
-    try:
-        requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3()  # type: ignore
-    except AttributeError:
-        import urllib3.contrib.pyopenssl
-        urllib3.contrib.pyopenssl.inject_into_urllib3()
-
 DEFAULT_NETWORK_TIMEOUT = 45
 
 DER_CONTENT_TYPE = 'application/pkix-cert'
diff --git a/acme/setup.py b/acme/setup.py
index 2fafe845c..c62562ff3 100644
--- a/acme/setup.py
+++ b/acme/setup.py
@@ -17,7 +17,7 @@ install_requires = [
     'PyOpenSSL>=17.3.0',
     'pyrfc3339',
     'pytz',
-    'requests[security]>=2.6.0',  # security extras added in 2.4.1
+    'requests>=2.6.0',
     'requests-toolbelt>=0.3.0',
     'setuptools>=39.0.1',
     'six>=1.11.0',
diff --git a/certbot/CHANGELOG.md b/certbot/CHANGELOG.md
index d83a258e2..a4a53c88e 100644
--- a/certbot/CHANGELOG.md
+++ b/certbot/CHANGELOG.md
@@ -10,7 +10,9 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
-*
+* The acme library no longer depends on the `security` extras from `requests`
+  which was needed to support SNI in TLS requests when using old versions of
+  Python 2.
 
 ### Fixed
 
diff --git a/tools/oldest_constraints.txt b/tools/oldest_constraints.txt
index 1aabf6eeb..f6528f396 100644
--- a/tools/oldest_constraints.txt
+++ b/tools/oldest_constraints.txt
@@ -47,7 +47,7 @@ pyparsing==2.2.0
 apacheconfig==0.3.2
 cloudflare==1.5.1
 python-digitalocean==1.11
-requests[security]==2.6.0
+requests==2.6.0
 
 # Ubuntu Xenial constraints
 # Ubuntu Xenial only has versions of Python which we do not support available