diff --git a/tests/integration/targets/setup_openssl/tasks/main.yml b/tests/integration/targets/setup_openssl/tasks/main.yml
index 907f44b7..35df231e 100644
--- a/tests/integration/targets/setup_openssl/tasks/main.yml
+++ b/tests/integration/targets/setup_openssl/tasks/main.yml
@@ -89,7 +89,7 @@
   - name: Install cryptography (Darwin)
     become: true
     pip:
-      name: cryptography
+      name: cryptography>=3.3
       extra_args: "-c {{ remote_constraints }}"
     when: ansible_os_family == 'Darwin'
 
diff --git a/tests/utils/constraints.txt b/tests/utils/constraints.txt
index ae6000ae..7f21a5cf 100644
--- a/tests/utils/constraints.txt
+++ b/tests/utils/constraints.txt
@@ -1,6 +1,7 @@
 coverage >= 4.2, < 5.0.0, != 4.3.2 ; python_version <= '3.7' # features in 4.2+ required, avoid known bug in 4.3.2 on python 2.6, coverage 5.0+ incompatible
 coverage >= 4.5.4, < 5.0.0 ; python_version > '3.7' # coverage had a bug in < 4.5.4 that would cause unit tests to hang in Python 3.8, coverage 5.0+ incompatible
 cryptography < 2.2 ; python_version < '2.7' # cryptography 2.2 drops support for python 2.6
+cryptography >= 3.0, < 3.4 ; python_version < '3.6' # cryptography 3.4 drops support for python 2.7
 deepdiff < 4.0.0 ; python_version < '3' # deepdiff 4.0.0 and later require python 3
 jinja2 < 2.11 ; python_version < '2.7' # jinja2 2.11 and later require python 2.7 or later
 urllib3 < 1.24 ; python_version < '2.7' # urllib3 1.24 and later require python 2.7 or later