Right, fun story here. Before, `BaseSSLError` was just `ssl.SSLError`, which we imported at the top of the file. However, the SSL implementation (here, `self.ssl`) needs to be able to provide its own `SSLError` class, but crucially, there will be no `self.ssl` attribute if this is an `HTTPConnectionPool`, rather than an `HTTPSConnectionPool`. When I wrote this (I have since rethought it, with the help of your comments), I also took into account the possibility that the SSL implementation would lack a `CertificateError` class (if it also lacks `match_hostname()`). Therefore, I decided to populate an `ssl_errors` list (see right before the `try` block) with these classes if they exist, and `None` otherwise, then filter out the `None`s. So, on Py2.7 with the standard `ssl` impl, this would end up being `(SSLError,)`; on a Py2.7 compiled without SSL support, it would be `()`; and on Py2.7 with `backports.ssl`, it would be `(SSLError, CertificateError)`.

I realize this is not only confusing, but suboptimal, so I think I'll move as much logic as I can into the `HTTPSConnectionPool` subclass, and ensure that `CertificateError`/`match_hostname()` are always available no matter what SSL implementation is specified.