Hi Andrew:

Can you use the patch from:

  https://github.com/roundup-
tracker/roundup/commit/2fb480eaed37b3247d61e183301b140be22423f1.patch

(corresponding to changeset:   7968:d7e79f8eb943).

I made a few changes to your patch in addition to making it conditional
on python version:

  initialize SSLContext with ssl.PROTOCOL_TLS_CLIENT
  if there is a cert file specified, enable sslctx.check_hostname
  if there is no cert file, call sslctx.load_default_certs()

Sadly there are no tests for this code in the test suite because of the need to
have an SSMTP server that we can configure as part of the tests. Issue2551351 has
been opened to record this deficiency.