diff --git a/scrapy/core/downloader/tls.py b/scrapy/core/downloader/tls.py
index e1c4f4908..c97c6a9a9 100644
--- a/scrapy/core/downloader/tls.py
+++ b/scrapy/core/downloader/tls.py
@@ -40,7 +40,14 @@ if twisted_version >= (14, 0, 0):
     from twisted.internet._sslverify import (ClientTLSOptions,
                                              verifyHostname,
                                              VerificationError)
-    from service_identity.exceptions import CertificateError
+    try:
+        # XXX: this import would fail on Debian jessie with system installed
+        # service_identity library, due to lack of cryptography.x509 dependency
+        # See https://github.com/pyca/service_identity/issues/21
+        from service_identity.exceptions import CertificateError
+        verification_errors = (CertificateError, VerificationError)
+    except ImportError:
+        verification_errors = VerificationError
 
     if twisted_version < (17, 0, 0):
         from twisted.internet._sslverify import _maybeSetHostNameIndication
@@ -66,7 +73,7 @@ if twisted_version >= (14, 0, 0):
             elif where & SSL_CB_HANDSHAKE_DONE:
                 try:
                     verifyHostname(connection, self._hostnameASCII)
-                except (CertificateError, VerificationError) as e:
+                except verification_errors as e:
                     logger.warning(
                         'Remote certificate is not valid for hostname "{}"; {}'.format(
                             self._hostnameASCII, e))
diff --git a/tests/test_downloader_handlers.py b/tests/test_downloader_handlers.py
index ceb03f945..b34faa7e7 100644
--- a/tests/test_downloader_handlers.py
+++ b/tests/test_downloader_handlers.py
@@ -512,6 +512,10 @@ class Https11InvalidDNSPattern(Https11TestCase):
     certfile = 'keys/localhost.ip.crt'
 
     def setUp(self):
+        try:
+            from service_identity.exceptions import CertificateError
+        except ImportError:
+            raise unittest.SkipTest("cryptography lib is too old")
         super(Https11InvalidDNSPattern, self).setUp()