SNOW-4065060: urllib3 plans to deprecate and remove pyOpenSSL support

urllib3 is planning to deprecate urllib3.contrib.pyopenssl again and remove pyOpenSSL support in urllib3 v3.0: https://github.com/urllib3/urllib3/issues/5208.

As far as we know, Snowflake Connector is currently the only remaining large user of urllib3's pyOpenSSL integration. We understand that Snowflake vendors urllib3 today, including the pyOpenSSL integration, so the removal in upstream urllib3 would not immediately break existing releases. Snowflake's recent releases continue to update that vendored urllib3 copy.

We'd like to understand your plans before moving forward with the removal. If Snowflake still needs pyOpenSSL-specific behavior, would it be viable to move the pyOpenSSL wrapping/integration into Snowflake Connector itself rather than relying on urllib3.contrib.pyopenssl?

The goal on the urllib3 side is to avoid maintaining a second TLS backend indefinitely, while still making sure downstream projects have a reasonable migration path.

We'd especially appreciate feedback on any functionality provided by urllib3.contrib.pyopenssl that Snowflake still depends on and that would be difficult to reproduce within the connector.

Please also leave any feedback or concerns on the upstream tracking issue so we can take them into account before urllib3 v3.0 https://github.com/urllib3/urllib3/issues/5208.

Start by reviewing the connector's use of urllib3.contrib.pyopenssl and the upstream tracking issue linked in the report. Identify any pyOpenSSL-specific functionality Snowflake still depends on, then document the migration plan and provide feedback on the upstream issue; done means the dependency and path forward are agreed.