OpenSSL can support a cipher but be missing various modes, so we do need to check the combination. We could require that you pass a Cipher and Mode object, but for testing certain behaviors (supports AES 256-bit CBC) we'd need to set a random key of the proper length on the cipher object to be able to generate the right ciphername string.