The code in Synapse uses a subclass of ssl.ContextFactory with some manual OpenSSL setup.

Twisted will do quite a lot of this for you (more every day!) and can handle several things that it looks like Synapse isn't doing right now, like service identity validation and sending server name indication.

The relevant APIs are:

• Implement twisted.internet.interfaces.IOpenSSLClientConnectionCreator or twisted.internet.interfaces.IOpenSSLServerConnectionCreator rather than subclassing ContextFactory if you need to do your own thing.
• Consider using optionsForClientTLS for clients, or CertificateOptions (sorry - horrible class name there, I know) for servers, if the default behavior is good enough.