The scenario is that I'm trying to access a server at e.g. https://[2001:db8::17]/ running with a certificate that contains both DNS:2001:db8::17 and IP:2001:db8::17 via urllib3, which in turn uses the cryptography module in order to parse the certificate.

With released version 2.0.3, there is an error already in cert.extensions.get_extension_for_class(x509.SubjectAlternativeName), if I install the current git master, the error moves to a later stage when ext.get_values_for_type(x509.DNSName) is called.

After asking in #cryptography-dev I used the workarounf of dropping the DNS:... part from the certificate, but in that case the certificate is no longer accepted by the standard httplib module, see https://bugs.python.org/issue23239, so we really need a fix to accept that part here.