Same issue as T212395: cergen CI fails to run on Debian Stretch because cryptography dependency cannot be built against newer openssl version.
When I switched striker's CI to run on Debian Stretch it started to fail building because of cryptography and the newer openssl version.
The full log is https://integration.wikimedia.org/ci/job/labs-striker-tox-docker/44/consoleFull
For now I've kept striker CI on Debian Jessie, but that isn't a long-term sustainable solution.