diff --git a/changelogs/fragments/ansible-test-cryptography-refactor.yml b/changelogs/fragments/ansible-test-cryptography-refactor.yml
new file mode 100644
index 00000000000..9372bfda20e
--- /dev/null
+++ b/changelogs/fragments/ansible-test-cryptography-refactor.yml
@@ -0,0 +1,2 @@
+minor_changes:
+  - ansible-test - Refactor code for installing ``cryptography`` to allow re-use in the future.
diff --git a/test/lib/ansible_test/_internal/executor.py b/test/lib/ansible_test/_internal/executor.py
index d127e9cda7a..9649a74bfce 100644
--- a/test/lib/ansible_test/_internal/executor.py
+++ b/test/lib/ansible_test/_internal/executor.py
@@ -233,7 +233,28 @@ def get_setuptools_version(args, python):  # type: (EnvironmentConfig, str) -> t
         raise
 
 
-def get_cryptography_requirement(args, python_version):  # type: (EnvironmentConfig, str) -> str
+def install_cryptography(args, python, python_version, pip):  # type: (EnvironmentConfig, str, str, t.List[str]) -> None
+    """
+    Install cryptography for the specified environment.
+    """
+    # make sure ansible-test's basic requirements are met before continuing
+    # this is primarily to ensure that pip is new enough to facilitate further requirements installation
+    install_ansible_test_requirements(args, pip)
+
+    # make sure setuptools is available before trying to install cryptography
+    # the installed version of setuptools affects the version of cryptography to install
+    run_command(args, generate_pip_install(pip, '', packages=['setuptools']))
+
+    # install the latest cryptography version that the current requirements can support
+    # use a custom constraints file to avoid the normal constraints file overriding the chosen version of cryptography
+    # if not installed here later install commands may try to install an unsupported version due to the presence of older setuptools
+    # this is done instead of upgrading setuptools to allow tests to function with older distribution provided versions of setuptools
+    run_command(args, generate_pip_install(pip, '',
+                                           packages=[get_cryptography_requirement(args, python, python_version)],
+                                           constraints=os.path.join(ANSIBLE_TEST_DATA_ROOT, 'cryptography-constraints.txt')))
+
+
+def get_cryptography_requirement(args, python, python_version):  # type: (EnvironmentConfig, str, str) -> str
     """
     Return the correct cryptography requirement for the given python version.
     The version of cryptography installed depends on the python version, setuptools version and openssl version.
@@ -295,7 +316,8 @@ def install_command_requirements(args, python_version=None, context=None, enable
     if not python_version:
         python_version = args.python_version
 
-    pip = generate_pip_command(find_python(python_version))
+    python = find_python(python_version)
+    pip = generate_pip_command(python)
 
     # skip packages which have aleady been installed for python_version
 
@@ -313,19 +335,7 @@ def install_command_requirements(args, python_version=None, context=None, enable
     installed_packages.update(packages)
 
     if args.command != 'sanity':
-        install_ansible_test_requirements(args, pip)
-
-        # make sure setuptools is available before trying to install cryptography
-        # the installed version of setuptools affects the version of cryptography to install
-        run_command(args, generate_pip_install(pip, '', packages=['setuptools']))
-
-        # install the latest cryptography version that the current requirements can support
-        # use a custom constraints file to avoid the normal constraints file overriding the chosen version of cryptography
-        # if not installed here later install commands may try to install an unsupported version due to the presence of older setuptools
-        # this is done instead of upgrading setuptools to allow tests to function with older distribution provided versions of setuptools
-        run_command(args, generate_pip_install(pip, '',
-                                               packages=[get_cryptography_requirement(args, python_version)],
-                                               constraints=os.path.join(ANSIBLE_TEST_DATA_ROOT, 'cryptography-constraints.txt')))
+        install_cryptography(args, python, python_version, pip)
 
     commands = [generate_pip_install(pip, args.command, packages=packages, context=context)]