Remove requests[security] dependency (#8626)

Fixes https://github.com/certbot/certbot/issues/7901.

* stop using requests[security]

* add changelog entry

* remove unused import

acme/acme/client.py

@@ -6,7 +6,6 @@ from email.utils import parsedate_tz
 import heapq
 import logging
 import re
-import sys
 import time
 
 import josepy as jose
@@ -30,17 +29,6 @@ from acme.mixins import VersionedLEACMEMixin
 
 logger = logging.getLogger(__name__)
 
-# Prior to Python 2.7.9 the stdlib SSL module did not allow a user to configure
-# many important security related options. On these platforms we use PyOpenSSL
-# for SSL, which does allow these options to be configured.
-# https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning
-if sys.version_info < (2, 7, 9):  # pragma: no cover
-    try:
-        requests.packages.urllib3.contrib.pyopenssl.inject_into_urllib3()  # type: ignore
-    except AttributeError:
-        import urllib3.contrib.pyopenssl
-        urllib3.contrib.pyopenssl.inject_into_urllib3()
-
 DEFAULT_NETWORK_TIMEOUT = 45
 
 DER_CONTENT_TYPE = 'application/pkix-cert'

acme/setup.py

@@ -17,7 +17,7 @@ install_requires = [
     'PyOpenSSL>=17.3.0',
     'pyrfc3339',
     'pytz',
-    'requests[security]>=2.6.0',  # security extras added in 2.4.1
+    'requests>=2.6.0',
     'requests-toolbelt>=0.3.0',
     'setuptools>=39.0.1',
     'six>=1.11.0',

certbot/CHANGELOG.md

@@ -10,7 +10,9 @@ Certbot adheres to [Semantic Versioning](https://semver.org/).
 
 ### Changed
 
-*
+* The acme library no longer depends on the `security` extras from `requests`
+  which was needed to support SNI in TLS requests when using old versions of
+  Python 2.
 
 ### Fixed
 

tools/oldest_constraints.txt

@@ -47,7 +47,7 @@ pyparsing==2.2.0
 apacheconfig==0.3.2
 cloudflare==1.5.1
 python-digitalocean==1.11
-requests[security]==2.6.0
+requests==2.6.0
 
 # Ubuntu Xenial constraints
 # Ubuntu Xenial only has versions of Python which we do not support available