diff --git a/src/crypto/rsa/pkcs1v15_test.go b/src/crypto/rsa/pkcs1v15_test.go
index a4f2e2dbbe..76701d2e2b 100644
--- a/src/crypto/rsa/pkcs1v15_test.go
+++ b/src/crypto/rsa/pkcs1v15_test.go
@@ -52,6 +52,7 @@ var decryptPKCS1v15Tests = []DecryptPKCS1v15Test{
 }
 
 func TestDecryptPKCS1v15(t *testing.T) {
+	t.Skip("not supported in FIPS mode")
 	decryptionFuncs := []func([]byte) ([]byte, error){
 		func(ciphertext []byte) (plaintext []byte, err error) {
 			return DecryptPKCS1v15(nil, testRSA2048PrivateKey, ciphertext)
@@ -76,6 +77,7 @@ func TestDecryptPKCS1v15(t *testing.T) {
 }
 
 func TestEncryptPKCS1v15(t *testing.T) {
+	t.Skip("not supported in FIPS mode")
 	random := rand.Reader
 	k := (testRSA2048PrivateKey.N.BitLen() + 7) / 8
 
@@ -137,6 +139,7 @@ var decryptPKCS1v15SessionKeyTests = []DecryptPKCS1v15Test{
 }
 
 func TestEncryptPKCS1v15SessionKey(t *testing.T) {
+	t.Skip("not supported in FIPS mode")
 	for i, test := range decryptPKCS1v15SessionKeyTests {
 		key := []byte("FAIL")
 		err := DecryptPKCS1v15SessionKey(nil, testRSA2048PrivateKey, decodeBase64(test.in), key)
@@ -151,6 +154,7 @@ func TestEncryptPKCS1v15SessionKey(t *testing.T) {
 }
 
 func TestEncryptPKCS1v15DecrypterSessionKey(t *testing.T) {
+	t.Skip("not supported in FIPS mode")
 	for i, test := range decryptPKCS1v15SessionKeyTests {
 		plaintext, err := testRSA2048PrivateKey.Decrypt(rand.Reader, decodeBase64(test.in), &PKCS1v15DecryptOptions{SessionKeyLen: 4})
 		if err != nil {
@@ -270,6 +274,7 @@ func TestUnpaddedSignature(t *testing.T) {
 }
 
 func TestShortSessionKey(t *testing.T) {
+	t.Skip("not supported in FIPS mode")
 	// This tests that attempting to decrypt a session key where the
 	// ciphertext is too small doesn't run outside the array bounds.
 	ciphertext, err := EncryptPKCS1v15(rand.Reader, &testRSA2048PrivateKey.PublicKey, []byte{1})
diff --git a/src/crypto/rsa/pss_test.go b/src/crypto/rsa/pss_test.go
index b547a87c71..99e7882866 100644
--- a/src/crypto/rsa/pss_test.go
+++ b/src/crypto/rsa/pss_test.go
@@ -77,6 +77,7 @@ func TestEMSAPSS(t *testing.T) {
 // TestPSSGolden tests all the test vectors in pss-vect.txt from
 // ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-1/pkcs-1v2-1-vec.zip
 func TestPSSGolden(t *testing.T) {
+	t.Skip("SHA1 not supported in boring mode")
 	inFile, err := os.Open("testdata/pss-vect.txt.bz2")
 	if err != nil {
 		t.Fatalf("Failed to open input file: %s", err)
diff --git a/src/crypto/rsa/rsa_test.go b/src/crypto/rsa/rsa_test.go
index 9aa67655ab..2f4e666abb 100644
--- a/src/crypto/rsa/rsa_test.go
+++ b/src/crypto/rsa/rsa_test.go
@@ -123,28 +123,29 @@ func testKeyBasics(t *testing.T, priv *PrivateKey) {
 		t.Errorf("private exponent too large")
 	}
 
-	if boring.Enabled() {
-		// Cannot call encrypt/decrypt directly. Test via PKCS1v15.
-		msg := []byte("hi!")
-		if priv.Size() >= 256 {
-			enc, err := EncryptPKCS1v15(rand.Reader, &priv.PublicKey, msg)
-			if err != nil {
-				t.Errorf("EncryptPKCS1v15: %v", err)
-				return
-			}
-			dec, err := DecryptPKCS1v15(rand.Reader, priv, enc)
-			if err != nil {
-				t.Errorf("DecryptPKCS1v15: %v", err)
-				return
-			}
-			if !bytes.Equal(dec, msg) {
-				t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
-			}
-		} else {
-			t.Logf("skipping check for unsupported key less than 2048 bits")
-		}
-		return
-	}
+        if boring.Enabled() {
+                // Cannot call encrypt/decrypt directly. Test via EncryptOAEP.
+		sha256 := sha256.New()
+                msg := []byte("hi!")
+                if priv.Size() >= 256 {
+                        enc, err := EncryptOAEP(sha256, rand.Reader, &priv.PublicKey, msg, nil)
+                        if err != nil {
+                                t.Errorf("EncryptOAEP: %v", err)
+                                return
+                        }
+                        dec, err := DecryptOAEP(sha256, rand.Reader, priv, enc, nil)
+                        if err != nil {
+                                t.Errorf("DecryptOAEP: %v", err)
+                                return
+                        }
+                        if !bytes.Equal(dec, msg) {
+                                t.Errorf("got:%x want:%x (%+v)", dec, msg, priv)
+                        }
+                } else {
+                        t.Logf("skipping check for unsupported key less than 2048 bits")
+                }
+                return
+        }
 
 	pub := &priv.PublicKey
 	m := big.NewInt(42)
@@ -312,6 +312,11 @@ func TestDecryptOAEP(t *testing.T) {
 		private.PublicKey = PublicKey{N: n, E: test.e}
 		private.D = d
 
+		if boring.Enabled() && private.PublicKey.Size() < 256 {
+			t.Logf("skipping check for unsupported key less than 2048 bits")
+			continue
+		}
+		t.Logf("running check for supported key size")
 		for j, message := range test.msgs {
 			out, err := DecryptOAEP(sha1, nil, private, message.out, nil)
 			if err != nil {