[Lukasa]

The python.org official installers are all linked against the system OpenSSL. You need to build from source to avoid that. I recommend getting Python from macports in this case, as they should allow you to link against their provided OpenSSL.

[pvg]

The 3.6 macOS installer is bundled with its own, recent version of OpenSSL and supports TLS 1.2.

[mauntz]

Thanks for your replies! It's as I feared then. The switch to macports luckily isn't all that painful.