I could do that but it seems like a little bit of an abuse of the import system since the API which includes CertificateError is really being provided by the ssl_match_hostname module, rather than the urllib3.connection module.  What do you think about adding the API to packages instead?  There's several ways I could do that but basically, urllib3.packages would contain the try: except block to do the detection.   Then when people import match_hostname and CertificateError from beneath packages, they get the stdlib version, backports module, or the vendored copy depending on what's available.