diff --git a/Empty-security-extras.patch b/Empty-security-extras.patch
new file mode 100644
index 0000000..1f1e658
--- /dev/null
+++ b/Empty-security-extras.patch
@@ -0,0 +1,13 @@
+diff --git a/setup.py b/setup.py
+index 065eb22..043ae42 100755
+--- a/setup.py
++++ b/setup.py
+@@ -100,7 +100,7 @@ setup(
+     cmdclass={'test': PyTest},
+     tests_require=test_requirements,
+     extras_require={
+-        'security': ['pyOpenSSL >= 0.14', 'cryptography>=1.3.4'],
++        'security': [],
+         'socks': ['PySocks>=1.5.6, !=1.5.7'],
+         'socks:sys_platform == "win32" and python_version == "2.7"': ['win_inet_pton'],
+     },
diff --git a/python-requests.spec b/python-requests.spec
index f74b1ca..4be638a 100644
--- a/python-requests.spec
+++ b/python-requests.spec
@@ -5,7 +5,7 @@
 
 Name:           python-requests
 Version:        2.25.1
-Release:        3%{?dist}
+Release:        4%{?dist}
 Summary:        HTTP library, written in Python, for human beings
 
 License:        ASL 2.0
@@ -25,6 +25,20 @@ Patch2:         Remove-tests-that-use-the-tarpit.patch
 # a pretty odd one so this is a niche requirement.
 Patch3:         requests-2.12.4-tests_nonet.patch
 
+# The [security] extra as present in upstream 2.25.1 is not possible,
+# because the PyOpenSSL package is not part of RHEL 9.
+# We backport a pre-2.26.0 commit that makes request[security] a no-op:
+#   https://github.com/psf/requests/pull/5867
+# """
+# We initially removed default support for PyOpenSSL in Requests 2.24.0
+# as it is now considered less secure. Deprecation of the extras_require was
+# announced in Requests 2.25.0 and we're officially removing the extras_require
+# functionality in Requests 2.26.0.
+# Projects currently using requests[security] after this change will continue
+# to operate as if performing a standard requests installation (secure by default).
+# """
+Patch4:         Empty-security-extras.patch
+
 BuildArch:      noarch
 
 %description
@@ -100,6 +114,9 @@ sed -i 's/ --doctest-modules//' pytest.ini
 
 
 %changelog
+* Thu Jul 15 2021 Miro Hrončok <mhroncok@redhat.com> - 2.25.1-4
+- Make requests[security] extras a no-op (backported from future 2.26.0)
+
 * Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 2.25.1-3
 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937