10 files changed, 22 insertions, 21 deletions
diff --git a/urllib3/_collections.py b/urllib3/_collections.py
index b68b9a5..af8074a 100644
--- a/urllib3/_collections.py
+++ b/urllib3/_collections.py
@@ -14,7 +14,7 @@ try:  # Python 2.7+
     from collections import OrderedDict
 except ImportError:
     from .packages.ordered_dict import OrderedDict
-from .packages.six import iterkeys, itervalues, PY3
+from six import iterkeys, itervalues, PY3
 
 
 __all__ = ['RecentlyUsedContainer', 'HTTPHeaderDict']
diff --git a/urllib3/connection.py b/urllib3/connection.py
index f64dd1a..a2b8fcb 100644
--- a/urllib3/connection.py
+++ b/urllib3/connection.py
@@ -3,7 +3,7 @@ import sys
 import socket
 from socket import timeout as SocketTimeout
 import warnings
-from .packages import six
+import six
 
 try:  # Python 3
     from http.client import HTTPConnection as _HTTPConnection, HTTPException
diff --git a/urllib3/connectionpool.py b/urllib3/connectionpool.py
index c958725..fe2f546 100644
--- a/urllib3/connectionpool.py
+++ b/urllib3/connectionpool.py
@@ -28,7 +28,7 @@ from .exceptions import (
     InsecureRequestWarning,
 )
 from .packages.ssl_match_hostname import CertificateError
-from .packages import six
+import six
 from .connection import (
     port_by_scheme,
     DummyConnection,
@@ -679,6 +679,8 @@ class HTTPSConnectionPool(HTTPConnectionPool):
     ``ssl_version`` are only used if :mod:`ssl` is available and are fed into
     :meth:`urllib3.util.ssl_wrap_socket` to upgrade the connection socket
     into an SSL socket.
+
+    On Debian, SSL certificate validation is required by default
     """
 
     scheme = 'https'
@@ -688,8 +690,8 @@ class HTTPSConnectionPool(HTTPConnectionPool):
                  strict=False, timeout=Timeout.DEFAULT_TIMEOUT, maxsize=1,
                  block=False, headers=None, retries=None,
                  _proxy=None, _proxy_headers=None,
-                 key_file=None, cert_file=None, cert_reqs=None,
-                 ca_certs=None, ssl_version=None,
+                 key_file=None, cert_file=None, cert_reqs='CERT_REQUIRED',
+                 ca_certs='/etc/ssl/certs/ca-certificates.crt', ssl_version=None,
                  assert_hostname=None, assert_fingerprint=None,
                  **conn_kw):
 
diff --git a/urllib3/fields.py b/urllib3/fields.py
index c853f8d..5fe3c24 100644
--- a/urllib3/fields.py
+++ b/urllib3/fields.py
@@ -1,7 +1,7 @@
 import email.utils
 import mimetypes
 
-from .packages import six
+import six
 
 
 def guess_content_type(filename, default='application/octet-stream'):
diff --git a/urllib3/filepost.py b/urllib3/filepost.py
index 0fbf488..97ab970 100644
--- a/urllib3/filepost.py
+++ b/urllib3/filepost.py
@@ -3,8 +3,8 @@ import codecs
 from uuid import uuid4
 from io import BytesIO
 
-from .packages import six
-from .packages.six import b
+import six
+from six import b
 from .fields import RequestField
 
 writer = codecs.lookup('utf-8')[3]
diff --git a/urllib3/packages/__init__.py b/urllib3/packages/__init__.py
index 37e8351..10a3aa8 100644
--- a/urllib3/packages/__init__.py
+++ b/urllib3/packages/__init__.py
@@ -1,4 +1,9 @@
 from __future__ import absolute_import
 
-from . import ssl_match_hostname
-
+try:
+    # cPython >= 2.7.9 has ssl features backported from Python3
+    from ssl import CertificateError
+    del CertificateError
+    import ssl as ssl_match_hostname
+except ImportError:
+    from . import ssl_match_hostname
diff --git a/urllib3/response.py b/urllib3/response.py
index 15d4aac..c41bd2c 100644
--- a/urllib3/response.py
+++ b/urllib3/response.py
@@ -1,7 +1,3 @@
-try:
-    import http.client as httplib
-except ImportError:
-    import httplib
 from contextlib import contextmanager
 import zlib
 import io
@@ -11,7 +7,8 @@ from ._collections import HTTPHeaderDict
 from .exceptions import (
     ProtocolError, DecodeError, ReadTimeoutError, ResponseNotChunked
 )
-from .packages.six import string_types as basestring, binary_type, PY3
+from six import string_types as basestring, binary_type, PY3
+from six.moves import http_client as httplib
 from .connection import HTTPException, BaseSSLError
 from .util.response import is_fp_closed, is_response_to_head
 
diff --git a/urllib3/util/request.py b/urllib3/util/request.py
index bc64f6b..5f4ccfd 100644
--- a/urllib3/util/request.py
+++ b/urllib3/util/request.py
@@ -1,6 +1,6 @@
 from base64 import b64encode
 
-from ..packages.six import b
+from six import b
 
 ACCEPT_ENCODING = 'gzip,deflate'
 
diff --git a/urllib3/util/response.py b/urllib3/util/response.py
index 767ee15..6695809 100644
--- a/urllib3/util/response.py
+++ b/urllib3/util/response.py
@@ -1,7 +1,4 @@
-try:
-    import http.client as httplib
-except ImportError:
-    import httplib
+from six.moves import http_client as httplib
 
 from ..exceptions import HeaderParsingError
 
diff --git a/urllib3/util/retry.py b/urllib3/util/retry.py
index 1fb1f23..178b374 100644
--- a/urllib3/util/retry.py
+++ b/urllib3/util/retry.py
@@ -8,7 +8,7 @@ from ..exceptions import (
     ReadTimeoutError,
     ResponseError,
 )
-from ..packages import six
+import six
 
 
 log = logging.getLogger(__name__)