diff --git a/ipapython/directivesetter.py b/ipapython/directivesetter.py
index 064766d8c..b03c580ee 100644
--- a/ipapython/directivesetter.py
+++ b/ipapython/directivesetter.py
@@ -2,8 +2,6 @@
 # Copyright (C) 2018 FreeIPA Contributors see COPYING for license
 #
 
-import six
-
 import io
 import os
 import re
@@ -47,7 +45,7 @@ class DirectiveSetter:
         fd, name = tempfile.mkstemp(prefix=prefix, dir=directory, text=True)
         with io.open(fd, mode='w', closefd=True) as f:
             for line in self.lines:
-                if not isinstance(line, six.text_type):
+                if not isinstance(line, str):
                     line = line.decode('utf-8')
                 f.write(line)
             self.lines = None
diff --git a/ipapython/dn.py b/ipapython/dn.py
index 1fca45232..6747a0ece 100644
--- a/ipapython/dn.py
+++ b/ipapython/dn.py
@@ -454,7 +454,7 @@ def _normalize_ava_input(val):
     if six.PY3 and isinstance(val, bytes):
         raise TypeError('expected str, got bytes: %r' % val)
     elif not isinstance(val, str):
-        val = val_encode(six.text_type(val))
+        val = val_encode(str(val))
     elif six.PY2 and isinstance(val, unicode):
         val = val.encode('utf-8')
     return val
@@ -882,7 +882,7 @@ class RDN:
         if len(self._avas) == 0:
             raise IndexError("No AVA's in this RDN")
 
-        self._avas[0][0] = val_encode(six.text_type(new_attr))
+        self._avas[0][0] = val_encode(str(new_attr))
 
     attr  = property(_get_attr)
 
@@ -894,7 +894,7 @@ class RDN:
     def _set_value(self, new_value):
         if len(self._avas) == 0:
             raise IndexError("No AVA's in this RDN")
-        self._avas[0][1] = val_encode(six.text_type(new_value))
+        self._avas[0][1] = val_encode(str(new_value))
 
     value = property(_get_value)
 
@@ -1114,7 +1114,7 @@ class DN:
     def _rdns_from_value(self, value):
         if isinstance(value, str):
             try:
-                if isinstance(value, six.text_type):
+                if isinstance(value, str):
                     value = val_encode(value)
                 rdns = str2dn(value)
             except DECODING_ERROR:
diff --git a/ipapython/ipaldap.py b/ipapython/ipaldap.py
index a35c94c27..45f78a108 100644
--- a/ipapython/ipaldap.py
+++ b/ipapython/ipaldap.py
@@ -910,7 +910,7 @@ class LDAPClient:
             else:
                 return b'FALSE'
         elif isinstance(val, (unicode, int, Decimal, DN, Principal)):
-            return six.text_type(val).encode('utf-8')
+            return str(val).encode('utf-8')
         elif isinstance(val, DNSName):
             return val.to_text().encode('ascii')
         elif isinstance(val, bytes):
@@ -1295,7 +1295,7 @@ class LDAPClient:
                 value = u'\\'.join(
                     value[i:i+2] for i in six.moves.range(-2, len(value), 2))
             else:
-                value = six.text_type(value)
+                value = str(value)
                 value = ldap.filter.escape_filter_chars(value)
 
             if not exact:
diff --git a/ipapython/ipautil.py b/ipapython/ipautil.py
index dd0da4196..2f4209cff 100644
--- a/ipapython/ipautil.py
+++ b/ipapython/ipautil.py
@@ -1441,12 +1441,12 @@ if six.PY2:
         """
         if isinstance(value, six.binary_type):
             return value.decode(sys.getfilesystemencoding())
-        elif isinstance(value, six.text_type):
+        elif isinstance(value, str):
             return value
         else:
             raise TypeError("expect {0} or {1}, not {2}".format(
                 six.binary_type.__name__,
-                six.text_type.__name__,
+                str.__name__,
                 type(value).__name__))
 else:
     fsdecode = os.fsdecode  #pylint: disable=no-member
@@ -1522,7 +1522,7 @@ def decode_json(data):
         # default
         return 'utf-8'
 
-    if isinstance(data, six.text_type):
+    if isinstance(data, str):
         return data
 
     return data.decode(detect_encoding(data), 'surrogatepass')
diff --git a/ipaserver/dcerpc_common.py b/ipaserver/dcerpc_common.py
index 526b025e3..f0f56d8c1 100644
--- a/ipaserver/dcerpc_common.py
+++ b/ipaserver/dcerpc_common.py
@@ -1,7 +1,7 @@
 import six
 from ipalib import _
 if six.PY3:
-    unicode = six.text_type
+    unicode = str
 
 # Both constants can be used as masks against trust direction
 # because bi-directional has two lower bits set.
diff --git a/ipaserver/install/ca.py b/ipaserver/install/ca.py
index bc9be1aeb..b30fbed65 100644
--- a/ipaserver/install/ca.py
+++ b/ipaserver/install/ca.py
@@ -84,7 +84,7 @@ def lookup_ca_subject(api, subject_base):
         # installutils.default_ca_subject_dn is NOT used here in
         # case the default changes in the future.
         ca_subject = DN(('CN', 'Certificate Authority'), subject_base)
-    return six.text_type(ca_subject)
+    return str(ca_subject)
 
 
 def set_subject_base_in_config(subject_base):
@@ -130,7 +130,7 @@ def install_check(standalone, replica_config, options):
         _api = api if standalone else options._remote_api
 
         # for replica-install the knobs cannot be written, hence leading '_'
-        options._subject_base = six.text_type(replica_config.subject_base)
+        options._subject_base = str(replica_config.subject_base)
         options._ca_subject = lookup_ca_subject(_api, options._subject_base)
 
     if replica_config is not None and not replica_config.setup_ca:
diff --git a/ipaserver/install/cainstance.py b/ipaserver/install/cainstance.py
index 154468a3d..e205e8ff7 100644
--- a/ipaserver/install/cainstance.py
+++ b/ipaserver/install/cainstance.py
@@ -38,7 +38,6 @@ import syslog
 import time
 import tempfile
 
-import six
 # pylint: disable=import-error
 from six.moves.configparser import RawConfigParser
 # pylint: enable=import-error
@@ -548,7 +547,7 @@ class CAInstance(DogtagInstance):
         # Directory server
         config.set("CA", "pki_ds_ldap_port", "389")
         config.set("CA", "pki_ds_password", self.dm_password)
-        config.set("CA", "pki_ds_base_dn", six.text_type(self.basedn))
+        config.set("CA", "pki_ds_base_dn", str(self.basedn))
         config.set("CA", "pki_ds_database", "ipaca")
 
         if self.use_ldaps:
@@ -2038,7 +2037,7 @@ class MSCSTemplateV1(MSCSTemplate):
         if len(parts) > 1:
             raise ValueError(
                 "Cannot specify certificate template version when using name.")
-        self.asn1obj = char.BMPString(six.text_type(parts[0]))
+        self.asn1obj = char.BMPString(str(parts[0]))
 
 
 class MSCSTemplateV2(MSCSTemplate):
diff --git a/ipaserver/install/dns.py b/ipaserver/install/dns.py
index 9c28d1b06..db8f34f86 100644
--- a/ipaserver/install/dns.py
+++ b/ipaserver/install/dns.py
@@ -143,7 +143,7 @@ def install_check(standalone, api, replica, options, hostname):
             dnsutil.check_zone_overlap(reverse_zone)
         except ValueError as e:
             if options.force or options.allow_zone_overlap:
-                logger.warning('%s', six.text_type(e))
+                logger.warning('%s', str(e))
             else:
                 raise e
 
diff --git a/ipaserver/install/krainstance.py b/ipaserver/install/krainstance.py
index 56135dd4a..69b6d09c5 100644
--- a/ipaserver/install/krainstance.py
+++ b/ipaserver/install/krainstance.py
@@ -26,7 +26,6 @@ import shutil
 import tempfile
 import base64
 
-import six
 # pylint: disable=import-error
 from six.moves.configparser import RawConfigParser
 # pylint: enable=import-error
@@ -203,7 +202,7 @@ class KRAInstance(DogtagInstance):
         # Directory server
         config.set("KRA", "pki_ds_ldap_port", "389")
         config.set("KRA", "pki_ds_password", self.dm_password)
-        config.set("KRA", "pki_ds_base_dn", six.text_type(self.basedn))
+        config.set("KRA", "pki_ds_base_dn", str(self.basedn))
         config.set("KRA", "pki_ds_database", "ipaca")
         config.set("KRA", "pki_ds_create_new_db", "False")
 
diff --git a/ipaserver/plugins/cert.py b/ipaserver/plugins/cert.py
index 9e3d228f8..4e263f7f6 100644
--- a/ipaserver/plugins/cert.py
+++ b/ipaserver/plugins/cert.py
@@ -173,12 +173,12 @@ def _acl_make_request(principal_type, principal, ca_id, profile_id):
     groups = []
     if principal_type == 'user':
         user_obj = api.Command.user_show(
-            six.text_type(principal.username))['result']
+            str(principal.username))['result']
         groups = user_obj.get('memberof_group', [])
         groups += user_obj.get('memberofindirect_group', [])
     elif principal_type == 'host':
         host_obj = api.Command.host_show(
-            six.text_type(principal.hostname))['result']
+            str(principal.hostname))['result']
         groups = host_obj.get('memberof_hostgroup', [])
         groups += host_obj.get('memberofindirect_hostgroup', [])
     req.user.groups = sorted(set(groups))
@@ -957,7 +957,7 @@ class cert_request(Create, BaseCertMethod, VirtualCommand):
             if add:
                 if principal.is_service and not principal.is_host:
                     self.api.Command.service_add(
-                        six.text_type(principal), all=True, force=True)
+                        str(principal), all=True, force=True)
                     return self.lookup_principal(principal)  # we want an LDAPEntry
                 else:
                     if principal.is_user:
diff --git a/ipaserver/plugins/dns.py b/ipaserver/plugins/dns.py
index 9671a2358..7a8520768 100644
--- a/ipaserver/plugins/dns.py
+++ b/ipaserver/plugins/dns.py
@@ -2165,7 +2165,7 @@ class DNSZoneBase_add(LDAPCreate):
             try:
                 check_zone_overlap(keys[-1], raise_on_error=False)
             except ValueError as e:
-                raise errors.InvocationError(six.text_type(e))
+                raise errors.InvocationError(str(e))
 
         return dn
 
diff --git a/ipaserver/plugins/service.py b/ipaserver/plugins/service.py
index c1892467e..00d199047 100644
--- a/ipaserver/plugins/service.py
+++ b/ipaserver/plugins/service.py
@@ -546,7 +546,7 @@ class service(LDAPObject):
 
     def get_dn(self, *keys, **kwargs):
         key = keys[0]
-        if isinstance(key, six.text_type):
+        if isinstance(key, str):
             key = kerberos.Principal(key)
 
         key = unicode(normalize_principal(key))
diff --git a/ipatests/create_external_ca.py b/ipatests/create_external_ca.py
index 1af16f336..ed2464638 100644
--- a/ipatests/create_external_ca.py
+++ b/ipatests/create_external_ca.py
@@ -26,7 +26,6 @@ from cryptography.hazmat.backends import default_backend
 from cryptography.hazmat.primitives import serialization
 
 import datetime
-import six
 
 ISSUER_CN = 'example.test'
 
@@ -53,7 +52,7 @@ class ExternalCA:
         self.ca_public_key = self.ca_key.public_key()
 
         subject = self.issuer = x509.Name([
-            x509.NameAttribute(NameOID.COMMON_NAME, six.text_type(cn)),
+            x509.NameAttribute(NameOID.COMMON_NAME, str(cn)),
         ])
 
         builder = x509.CertificateBuilder()
diff --git a/ipatests/test_integration/test_dns_locations.py b/ipatests/test_integration/test_dns_locations.py
index db88fc4dd..f8d456dbe 100644
--- a/ipatests/test_integration/test_dns_locations.py
+++ b/ipatests/test_integration/test_dns_locations.py
@@ -4,7 +4,6 @@
 import logging
 import time
 import pytest
-import six
 import dns.resolver
 import dns.rrset
 import dns.rdatatype
@@ -39,7 +38,7 @@ IPA_DEFAULT_ADTRUST_SRV_REC = (
 )
 
 IPA_CA_A_REC = (
-    (DNSName(six.text_type(IPA_CA_RECORD))),
+    (DNSName(str(IPA_CA_RECORD))),
 )
 
 
diff --git a/ipatests/util.py b/ipatests/util.py
index 31807e552..21dd7d346 100644
--- a/ipatests/util.py
+++ b/ipatests/util.py
@@ -210,7 +210,7 @@ class Fuzzy:
     Use of a regular expression by default implies the ``unicode`` type, so
     comparing with an ``str`` instance will evaluate to ``False``:
 
-    >>> phone.type is six.text_type
+    >>> phone.type is str
     True
     >>> b'123-456-7890' == phone
     False