`BuildSSLContextFromSSLCertTests` stubbed out `OpenerDirector.open`, so the urlopen handler chain never ran and `https_open()` was never reached. The tests then asserted against the SSL context the handler was constructed with, which is not necessarily the one the request uses. That hid a real bug. The legacy `ssl_cert` fallback context was being discarded in `https_open()`, and all three legacy tests passed anyway. These tests now stub `do_open()` on the handler instead. The chain runs as far as opening a connection, and the assertions look at the context handed to the connection, which is the one that would reach the server. Each call to `ssl.create_default_context()` gets its own `CaptureSSLContext` so that a rebuilt context doesn't accumulate state from the one it replaced. Testing Done: - Reverted the `https_open()` fix and confirmed `test_open_with_legacy_ssl_cert_hostname_mismatch` failed, where before it passed against the same bug. - Ran unit tests for `reviewboard.certs` and `reviewboard.hostingsvcs`.