diff --git a/openssl-3.2.patch b/openssl-3.2.patch
new file mode 100644
index 0000000..689c04b
--- /dev/null
+++ b/openssl-3.2.patch
@@ -0,0 +1,32 @@
+Index: urllib3-2.1.0/changelog/3268.bugfix.rst
+===================================================================
+--- /dev/null
++++ urllib3-2.1.0/changelog/3268.bugfix.rst
+@@ -0,0 +1 @@
++Fixed handling of OpenSSL 3.2.0 new error message for misconfiguring an HTTP proxy as HTTPS.
+Index: urllib3-2.1.0/src/urllib3/connection.py
+===================================================================
+--- urllib3-2.1.0.orig/src/urllib3/connection.py
++++ urllib3-2.1.0/src/urllib3/connection.py
+@@ -864,6 +864,7 @@ def _wrap_proxy_error(err: Exception, pr
+     is_likely_http_proxy = (
+         "wrong version number" in error_normalized
+         or "unknown protocol" in error_normalized
++        or "record layer failure" in error_normalized
+     )
+     http_proxy_warning = (
+         ". Your proxy appears to only use HTTP and not HTTPS, "
+Index: urllib3-2.1.0/test/with_dummyserver/test_socketlevel.py
+===================================================================
+--- urllib3-2.1.0.orig/test/with_dummyserver/test_socketlevel.py
++++ urllib3-2.1.0/test/with_dummyserver/test_socketlevel.py
+@@ -1297,7 +1297,8 @@ class TestSSL(SocketDummyServerTestCase)
+         self._start_server(socket_handler)
+         with HTTPSConnectionPool(self.host, self.port, ca_certs=DEFAULT_CA) as pool:
+             with pytest.raises(
+-                SSLError, match=r"(wrong version number|record overflow)"
++                SSLError,
++                match=r"(wrong version number|record overflow|record layer failure)",
+             ):
+                 pool.request("GET", "/", retries=False)
+ 
diff --git a/python-urllib3.changes b/python-urllib3.changes
index 99c8e34..dccff5a 100644
--- a/python-urllib3.changes
+++ b/python-urllib3.changes
@@ -1,3 +1,9 @@
+-------------------------------------------------------------------
+Thu Jan 11 11:46:04 UTC 2024 - Daniel Garcia <daniel.garcia@suse.com>
+
+- Add upstream patch openssl-3.2.patch, to fix tests with opennssl
+  3.2.0, gh#urllib3/urllib3#3271
+
 -------------------------------------------------------------------
 Mon Nov 27 20:29:27 UTC 2023 - Dirk Müller <dmueller@suse.com>
 
diff --git a/python-urllib3.spec b/python-urllib3.spec
index 95ce09f..5261cd3 100644
--- a/python-urllib3.spec
+++ b/python-urllib3.spec
@@ -1,7 +1,7 @@
 #
 # spec file
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -32,6 +32,8 @@ Summary:        HTTP library with thread-safe connection pooling, file post, and
 License:        MIT
 URL:            https://urllib3.readthedocs.org/
 Source:         https://files.pythonhosted.org/packages/source/u/urllib3/urllib3-%{version}.tar.gz
+# PATCH-FIX-OPENSUSE openssl-3.2.patch gh#urllib3/urllib3#3271
+Patch1:         openssl-3.2.patch
 BuildRequires:  %{python_module base >= 3.7}
 BuildRequires:  %{python_module hatchling}
 BuildRequires:  %{python_module pip}