--- pyproject.toml.orig	2025-10-11 16:50:06.000000000 +0800
+++ pyproject.toml	2025-10-22 15:54:44.000000000 +0800
@@ -27,9 +27,9 @@
 ]
 dependencies = [
     "certifi",
-    "cryptography>=42.0.0",
+    "cryptography",
     "pylsqpack>=0.3.3,<0.4.0",
-    "pyopenssl>=24",
+    "pyopenssl>=22",
     "service-identity>=24.1.0",
 ]
 dynamic = ["version"]


--- src/aioquic/tls.py.orig	2025-10-11 16:50:06.000000000 +0800
+++ src/aioquic/tls.py	2025-10-22 15:53:52.000000000 +0800
@@ -16,7 +16,6 @@
     Sequence,
     TypeVar,
     Union,
-    cast,
 )
 
 import certifi
@@ -35,10 +34,6 @@
     x448,
     x25519,
 )
-from cryptography.hazmat.primitives.asymmetric.types import (
-    CertificateIssuerPublicKeyTypes,
-    PrivateKeyTypes,
-)
 from cryptography.hazmat.primitives.kdf.hkdf import HKDFExpand
 from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
 from OpenSSL import crypto
@@ -58,8 +53,7 @@
 
 
 # facilitate mocking for the test suite
-def utcnow() -> datetime.datetime:
-    return datetime.datetime.now(datetime.timezone.utc)
+utcnow = datetime.datetime.utcnow
 
 
 class AlertDescription(IntEnum):
@@ -195,7 +189,7 @@
 
 def load_pem_private_key(
     data: bytes, password: Optional[bytes] = None
-) -> PrivateKeyTypes:
+) -> Union[dsa.DSAPrivateKey, ec.EllipticCurvePrivateKey, rsa.RSAPrivateKey]:
     """
     Load a PEM-encoded private key.
     """
@@ -224,9 +218,9 @@
 ) -> None:
     # verify dates
     now = utcnow()
-    if now < certificate.not_valid_before_utc:
+    if now < certificate.not_valid_before:
         raise AlertCertificateExpired("Certificate is not valid yet")
-    if now > certificate.not_valid_after_utc:
+    if now > certificate.not_valid_after:
         raise AlertCertificateExpired("Certificate is no longer valid")
 
     # verify subject
@@ -1105,7 +1099,7 @@
             k.update_hash(data)
 
 
-CIPHER_SUITES: dict = {
+CIPHER_SUITES = {
     CipherSuite.AES_128_GCM_SHA256: hashes.SHA256,
     CipherSuite.AES_256_GCM_SHA384: hashes.SHA384,
     CipherSuite.CHACHA20_POLY1305_SHA256: hashes.SHA256,
@@ -1497,16 +1491,7 @@
             )
 
         try:
-            # The type of public_key() is CertificatePublicKeyTypes, but along with
-            # ed25519 and ed448, which are fine, this type includes
-            # x25519 and x448 which can be public keys but can't sign.  We know
-            # we won't get x25519 and x448 as they are not on our list of
-            # signature algorithms, so we can cast public key to
-            # CertificateIssuerPublicKeyTypes safely and make mypy happy.
-            public_key = cast(
-                CertificateIssuerPublicKeyTypes, self._peer_certificate.public_key()
-            )
-            public_key.verify(
+            self._peer_certificate.public_key().verify(
                 verify.signature,
                 self.key_schedule.certificate_verify_data(
                     SERVER_CONTEXT_STRING if self._is_client else CLIENT_CONTEXT_STRING


--- tests/utils.py.orig	2025-10-11 16:50:06.000000000 +0800
+++ tests/utils.py	2025-10-22 15:57:36.000000000 +0800
@@ -56,10 +56,8 @@
         .issuer_name(issuer)
         .public_key(key.public_key())
         .serial_number(x509.random_serial_number())
-        .not_valid_before(datetime.datetime.now(datetime.timezone.utc))
-        .not_valid_after(
-            datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=10)
-        )
+        .not_valid_before(datetime.datetime.utcnow())
+        .not_valid_after(datetime.datetime.utcnow() + datetime.timedelta(days=10))
     )
     if alternative_names:
         builder = builder.add_extension(


--- tests/test_tls.py.orig	2025-10-11 16:50:06.000000000 +0800
+++ tests/test_tls.py	2025-10-22 15:56:30.000000000 +0800
@@ -1620,7 +1620,7 @@
             certificate = load_pem_x509_certificates(fp.read())[0]
 
         with patch("aioquic.tls.utcnow") as mock_utcnow:
-            mock_utcnow.return_value = certificate.not_valid_before_utc
+            mock_utcnow.return_value = certificate.not_valid_before
 
             # fail
             with self.assertRaises(tls.AlertBadCertificate) as cm:
@@ -1642,7 +1642,7 @@
         )
 
         with patch("aioquic.tls.utcnow") as mock_utcnow:
-            mock_utcnow.return_value = certificate.not_valid_before_utc
+            mock_utcnow.return_value = certificate.not_valid_before
 
             # fail
             with self.assertRaises(tls.AlertBadCertificate) as cm:
@@ -1671,7 +1671,7 @@
         #  too early
         with patch("aioquic.tls.utcnow") as mock_utcnow:
             mock_utcnow.return_value = (
-                certificate.not_valid_before_utc - datetime.timedelta(seconds=1)
+                certificate.not_valid_before - datetime.timedelta(seconds=1)
             )
             with self.assertRaises(tls.AlertCertificateExpired) as cm:
                 verify_certificate(
@@ -1681,7 +1681,7 @@
 
         # valid
         with patch("aioquic.tls.utcnow") as mock_utcnow:
-            mock_utcnow.return_value = certificate.not_valid_before_utc
+            mock_utcnow.return_value = certificate.not_valid_before
             verify_certificate(
                 cadata=cadata, certificate=certificate, server_name="example.com"
             )
@@ -1695,7 +1695,7 @@
         # too late
         with patch("aioquic.tls.utcnow") as mock_utcnow:
             mock_utcnow.return_value = (
-                certificate.not_valid_after_utc + datetime.timedelta(seconds=1)
+                certificate.not_valid_after + datetime.timedelta(seconds=1)
             )
             with self.assertRaises(tls.AlertCertificateExpired) as cm:
                 verify_certificate(
@@ -1708,7 +1708,7 @@
         cadata = certificate.public_bytes(serialization.Encoding.PEM)
 
         with patch("aioquic.tls.utcnow") as mock_utcnow:
-            mock_utcnow.return_value = certificate.not_valid_before_utc
+            mock_utcnow.return_value = certificate.not_valid_before
 
             # certificates with no SubjectAltName are rejected
             with self.assertRaises(tls.AlertBadCertificate) as cm:
@@ -1727,7 +1727,7 @@
         cadata = certificate.public_bytes(serialization.Encoding.PEM)
 
         with patch("aioquic.tls.utcnow") as mock_utcnow:
-            mock_utcnow.return_value = certificate.not_valid_before_utc
+            mock_utcnow.return_value = certificate.not_valid_before
 
             # valid
             verify_certificate(
@@ -1757,7 +1757,7 @@
         cadata = certificate.public_bytes(serialization.Encoding.PEM)
 
         with patch("aioquic.tls.utcnow") as mock_utcnow:
-            mock_utcnow.return_value = certificate.not_valid_before_utc
+            mock_utcnow.return_value = certificate.not_valid_before
 
             # valid
             verify_certificate(


