A true SSLContext object is not available warning in 2.6.0 for python < 2.7.9

Since upgrading to from requests 2.5.3 to 2.6.0 I now see 'A true SSLContext object is not available' warnings.
The test environment is Python 2.7.6 on Ubuntu 14.04.2 LTS

``` python
mkvirtualenv requests260 -i requests==2.6.0
....
(requests260)dave@xxps:~$ python
Python 2.7.6 (default, Mar 22 2014, 22:59:56) 
[GCC 4.8.2] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import requests
>>> resp = requests.get('https://github.com')
/home/dave/.virtualenvs/requests260/local/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:79: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
>>> quit()
```

The [urllib3](https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning)     documentation recommends the use of [PyOpenSSL](https://urllib3.readthedocs.org/en/latest/security.html#openssl-pyopenssl) for python versions earlier than 2.7.9.
The **pyopenssl.inject_into_urllib3()** call is being made in [requests/**init**.py](https://github.com/kennethreitz/requests/blob/fa338da717124188b21d48df55f2fa9aca459d12/requests/__init__.py#L54) 

Is the requests 2.6.0 SSLContext warning expected behaviour on python versions earlier than 2.7.9 considering that PyOpenSSL is being used ? 


That warning should not be raised unless we're not using pyOpenSSL. Can you confirm that `pip freeze` lists pyOpenSSL, ndg-httpsclient, and pyasn1?


Oooops! I had convinced myself that pyOpenSSL was installed, but it wasn't.
If I install **ndg-httpsclient** along with **requests** I no longer see the warnings.

``` python
mkvirtualenv requests260_ndghttpsclient -i requests==2.6.0 -i ndg-httpsclient
...
(requests260_ndghttpsclient)dave@xxps:~$ pip freeze
cffi==0.9.2
cryptography==0.8
enum34==1.0.4
ndg-httpsclient==0.3.3
pyasn1==0.1.7
pycparser==2.10
pyOpenSSL==0.14
requests==2.6.0
six==1.9.0
```

Doing a very crude timing test it appears that the addition of pyOpenSSL adds about half a second to the import process. Which pretty much lines up with this [ticket](https://github.com/pyca/pyopenssl/issues/137) for pyOpenSSL

The timing below is run on distinct virtualenvs with the following modules installed requests==2.5.3, requests==2.6.0, requests==2.6.0 + ndg-httpsclient==0.3.3.

``` python
dave@xxps:~$ time /home/dave/.virtualenvs/requests253/bin/python -c "import requests; resp = requests.get('https://github.com')"

real    0m0.516s
user    0m0.089s
sys  0m0.022s

dave@xxps:~$ time /home/dave/.virtualenvs/requests260/bin/python -c "import requests; requests.packages.urllib3.disable_warnings(); resp = requests.get('https://github.com')"

real    0m0.515s
user    0m0.106s
sys  0m0.023s

dave@xxps:~$ time /home/dave/.virtualenvs/requests260_ndghttpsclient/bin/python -c "import requests; resp = requests.get('https://github.com')"

real    0m1.134s
user    0m0.722s
sys  0m0.037s
```

From what I have read there aren't currently any plans to backport python 2.7.9 to the current Ubuntu Long Term Support version, Ubuntu 14.04.

I guess Ubuntu 14.04 users have the following choices,
- Install **ndg-httpsclient** and its dependencies along with **requests**, and take the import performance hit.
- Disable all urllib3 warnings with **requests.packages.urllib3.disable_warnings()**
- Stick with requests<=2.5.3

Would it be beneficial to state a recommendation to install ndg-httpsclient for python versions less than 2.7.9 in the [install](http://docs.python-requests.org/en/latest/user/install/#install) section of the documentation ? Or have the install process issue a warning that ndg-httpsclient should be installed when python < 2.7.9 is detected ?


I'm not sure. Our hope is that this warning is enough (and it did lead you down the right track!), but it's possible that we'll still find this to be a problem.

For the moment, I'm inclined to say that we're fine as we are, but that we should remain aware of the possibility that we need to be even more explicit.


Thanks for the clarifications on import performance.  Since this is a likely landing spot for people searching for terms like InsecurePlatformWarning requests, perhaps someone could link to or describe the security implications of ignoring the warnings by not using  PyOpenSSL,  ndg-httpsclient etc on pre-python 2.7.9 systems, so we have a better sense for how to evaluate the options.  Of course I know it varies by what people are using requests for, but even a worst-case scenario would be helpful.