[itamarst]

Fixes #1201

The cryptography half of this is in pyca/cryptography#8626

Potential user hazard: As currently implemented, users of pyOpenSSL who depend on this may be setting up their users for weird errors if they happen to install cryptography 40. So possibly this should also include either:

• Changing minimal required cryptography to 41, if/when Restore the x509 error verification codes cryptography#8626 is merged and v41 released.
• Or, don't change the minimal version, but do change cryptography dependency to forbid version 40, so you'd get versions before and after.
• Or, just assume this functionality is so obscure no one is likely to hit this in practice and do nothing.

[reaperhulk]

I think we're going to backport and release those bindings in 40.0.2. I think I'd prefer to avoid bumping up the minimum version as well, so we'll want to be more explicit (40.0.0 and 40.0.1) for the conditional branch. Please also add a comment that says when we bump to a 41+ minimum we can remove the branch 😄

[itamarst]

GitHub is being very laggy :( There's a fix for the flake issue that will show up in a minute or so.

[itamarst]

Anyway, how's this?

[reaperhulk]

Looks like this needs a rebase and addressing the outstanding comments. We're going to do a release in the next few days so this can land if it gets done!

[itamarst]

Ugh got distracted and didn't finish this. Will try to get to this tomorrow or next week.

[itamarst]

OK should be ready for review again, assuming CI passes.

[itamarst]

Can't tell if the docs issue is my fault or not.

[alex]

not related, I'll do a PR momentarily to fix it.

[alex]

One comment, besides that this LGTM.

[itamarst]

Addressed.