diff --git a/.gitignore b/.gitignore
index 331960c..2129f2d 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1 +1 @@
-SOURCES/node-v12.16.1-stripped.tar.gz
+SOURCES/node-v12.18.2-stripped.tar.gz
diff --git a/.rh-nodejs12-nodejs.metadata b/.rh-nodejs12-nodejs.metadata
index f6a527f..d6445da 100644
--- a/.rh-nodejs12-nodejs.metadata
+++ b/.rh-nodejs12-nodejs.metadata
@@ -1 +1 @@
-696bdce06cf5dc6300d8ef6fc646d45cff401190 SOURCES/node-v12.16.1-stripped.tar.gz
+2b5af5fe544a0aa310e962bb70f5e225022589b7 SOURCES/node-v12.18.2-stripped.tar.gz
diff --git a/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch b/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch
index 1c093c9..b675a8d 100644
--- a/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch
+++ b/SOURCES/0001-Remove-or-backport-OpenSSL-features.patch
@@ -1,28 +1,31 @@
-From 7776e056175360b0eaf8e8cd9605671ece0cd66c Mon Sep 17 00:00:00 2001
+From 0bb0ed5712eaa274c0e025c74fe792c56c5c8c7f Mon Sep 17 00:00:00 2001
 From: Zuzana Svetlikova <zsvetlik@redhat.com>
 Date: Wed, 19 Feb 2020 09:33:47 +0000
-Subject: [PATCH 1/4] remove openssl features
+Subject: [PATCH] Remove or backport OpenSSL features
 
+Signed-off-by: rpm-build <rpm-build>
 ---
- doc/api/cli.md                |  26 ---
+ doc/api/cli.md                |  26 --
  lib/_tls_common.js            |   2 +-
  lib/internal/crypto/keygen.js |   8 +-
  lib/tls.js                    |   9 +-
  src/env.h                     |   1 -
  src/node_constants.cc         |  12 +-
- src/node_crypto.cc            | 500 +++++++++++++++++++++++++++++++++++++++---
- src/node_crypto.h             |  44 ++++
+ src/node_crypto.cc            | 461 +++++++++++++++++++++++++++++++---
+ src/node_crypto.h             |  77 ++++++
  src/node_crypto_bio.cc        |  29 ++-
+ src/node_crypto_common.cc     |  32 ++-
+ src/node_crypto_common.h      |   2 +
  src/node_errors.h             |   4 +-
  src/node_options.cc           |   4 +
  src/tls_wrap.cc               |   2 +
- 12 files changed, 568 insertions(+), 73 deletions(-)
+ 14 files changed, 592 insertions(+), 77 deletions(-)
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index 7703d0b..ecf7632 100644
+index 5dd5ae4..2ea0732 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -706,15 +706,6 @@ added: v4.0.0
+@@ -753,15 +753,6 @@ added: v4.0.0
  Specify an alternative default TLS cipher list. Requires Node.js to be built
  with crypto support (default).
  
@@ -38,7 +41,7 @@ index 7703d0b..ecf7632 100644
  ### `--tls-max-v1.2`
  <!-- YAML
  added: v12.0.0
-@@ -723,14 +714,6 @@ added: v12.0.0
+@@ -770,14 +761,6 @@ added: v12.0.0
  Set [`tls.DEFAULT_MAX_VERSION`][] to 'TLSv1.2'. Use to disable support for
  TLSv1.3.
  
@@ -53,7 +56,7 @@ index 7703d0b..ecf7632 100644
  ### `--tls-min-v1.0`
  <!-- YAML
  added: v12.0.0
-@@ -756,14 +739,6 @@ Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.2'. This is the default for
+@@ -803,14 +786,6 @@ Set default [`tls.DEFAULT_MIN_VERSION`][] to 'TLSv1.2'. This is the default for
  12.x and later, but the option is supported for compatibility with older Node.js
  versions.
  
@@ -68,7 +71,7 @@ index 7703d0b..ecf7632 100644
  ### `--trace-deprecation`
  <!-- YAML
  added: v0.8.0
-@@ -1118,7 +1093,6 @@ Node.js options that are allowed are:
+@@ -1190,7 +1165,6 @@ Node.js options that are allowed are:
  * `--throw-deprecation`
  * `--title`
  * `--tls-cipher-list`
@@ -90,29 +93,29 @@ index 9f7747c..32e4a77 100644
  }
  
 diff --git a/lib/internal/crypto/keygen.js b/lib/internal/crypto/keygen.js
-index 88d2822..61a41d0 100644
+index ced1a06..a8a6897 100644
 --- a/lib/internal/crypto/keygen.js
 +++ b/lib/internal/crypto/keygen.js
-@@ -11,10 +11,10 @@ const {
-   generateKeyPairDSA,
+@@ -12,10 +12,10 @@ const {
    generateKeyPairEC,
    generateKeyPairNid,
+   generateKeyPairDH,
 -  EVP_PKEY_ED25519,
 -  EVP_PKEY_ED448,
 -  EVP_PKEY_X25519,
 -  EVP_PKEY_X448,
-+  //EVP_PKEY_ED25519,
-+  //EVP_PKEY_ED448,
-+  //EVP_PKEY_X25519,
-+  //EVP_PKEY_X448,
++  // EVP_PKEY_ED25519,
++  // EVP_PKEY_ED448,
++  // EVP_PKEY_X25519,
++  // EVP_PKEY_X448,
    OPENSSL_EC_NAMED_CURVE,
    OPENSSL_EC_EXPLICIT_CURVE
  } = internalBinding('crypto');
 diff --git a/lib/tls.js b/lib/tls.js
-index 281de07..3b0cf09 100644
+index 2ccbe40..ea5f7c9 100644
 --- a/lib/tls.js
 +++ b/lib/tls.js
-@@ -67,17 +67,10 @@ else if (getOptionValue('--tls-min-v1.1'))
+@@ -66,17 +66,10 @@ else if (getOptionValue('--tls-min-v1.1'))
    exports.DEFAULT_MIN_VERSION = 'TLSv1.1';
  else if (getOptionValue('--tls-min-v1.2'))
    exports.DEFAULT_MIN_VERSION = 'TLSv1.2';
@@ -132,10 +135,10 @@ index 281de07..3b0cf09 100644
  
  exports.getCiphers = internalUtil.cachedResult(
 diff --git a/src/env.h b/src/env.h
-index 4e625f3..60b7c4b 100644
+index 6de5ba9..5731afe 100644
 --- a/src/env.h
 +++ b/src/env.h
-@@ -255,7 +255,6 @@ constexpr size_t kFsStatsBufferLength =
+@@ -261,7 +261,6 @@ constexpr size_t kFsStatsBufferLength =
    V(host_string, "host")                                                       \
    V(hostmaster_string, "hostmaster")                                           \
    V(http_1_1_string, "http/1.1")                                               \
@@ -144,7 +147,7 @@ index 4e625f3..60b7c4b 100644
    V(infoaccess_string, "infoAccess")                                           \
    V(inherit_string, "inherit")                                                 \
 diff --git a/src/node_constants.cc b/src/node_constants.cc
-index 68af221..0b8ee44 100644
+index 5d99fa1..eff87ee 100644
 --- a/src/node_constants.cc
 +++ b/src/node_constants.cc
 @@ -956,8 +956,12 @@ void DefineCryptoConstants(Local<Object> target) {
@@ -174,10 +177,10 @@ index 68af221..0b8ee44 100644
      NODE_DEFINE_CONSTANT(target, ENGINE_METHOD_PKEY_METHS);
  # endif
 diff --git a/src/node_crypto.cc b/src/node_crypto.cc
-index e0684d9..332b6f3 100644
+index f08d68d..34fb29d 100644
 --- a/src/node_crypto.cc
 +++ b/src/node_crypto.cc
-@@ -55,6 +55,7 @@
+@@ -56,6 +56,7 @@
  #include <cstring>
  
  #include <algorithm>
@@ -185,24 +188,11 @@ index e0684d9..332b6f3 100644
  #include <memory>
  #include <utility>
  #include <vector>
-@@ -128,6 +129,230 @@ struct OpenSSLBufferDeleter {
- };
- using OpenSSLBuffer = std::unique_ptr<char[], OpenSSLBufferDeleter>;
+@@ -105,6 +106,213 @@ using v8::Value;
+ # define IS_OCB_MODE(mode) ((mode) == EVP_CIPH_OCB_MODE)
+ #endif
  
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+static void RSA_get0_key(const RSA* r, const BIGNUM** n, const BIGNUM** e,
-+                         const BIGNUM** d) {
-+  if (n != nullptr) {
-+    *n = r->n;
-+  }
-+  if (e != nullptr) {
-+    *e = r->e;
-+  }
-+  if (d != nullptr) {
-+    *d = r->d;
-+  }
-+}
-+
 +static void DH_get0_pqg(const DH* dh, const BIGNUM** p, const BIGNUM** q,
 +                        const BIGNUM** g) {
 +  if (p != nullptr) {
@@ -261,22 +251,6 @@ index e0684d9..332b6f3 100644
 +  return 1;
 +}
 +
-+static int EC_GROUP_order_bits(const EC_GROUP *group) {
-+  int num_bits = 0;
-+  BIGNUM *order = BN_new();
-+  BN_CTX *ctx = BN_CTX_new();
-+  if (order == nullptr || ctx == nullptr) { goto end; }
-+
-+  if (EC_GROUP_get_order(group, order, ctx) != 1) { goto end; }
-+  num_bits = BN_num_bits(order);
-+
-+end:
-+  BN_CTX_free(ctx), ctx = nullptr;
-+  BN_free(order), order = nullptr;
-+
-+  return num_bits;
-+}
-+
 +static int EVP_PKEY_up_ref(EVP_PKEY *pkey) {
 +  int refcount = std::atomic_fetch_add_explicit(
 +    reinterpret_cast<std::atomic<int>*>(&pkey->references),
@@ -410,37 +384,42 @@ index e0684d9..332b6f3 100644
 +  }
 +}
 +
++stack_st_X509_OBJECT *X509_STORE_get0_objects(X509_STORE *store) {
++    return store->objs;
++}
++
++int X509_OBJECT_get_type(X509_OBJECT *object) {
++    return object->type;
++}
++
++X509 *X509_OBJECT_get0_X509(X509_OBJECT *object) {
++    return (object->type == X509_LU_X509) ? object->data.x509 : nullptr;
++}
++
 +#endif  // OPENSSL_VERSION_NUMBER < 0x10100000L
 +
 +
  static const char* const root_certs[] = {
  #include "node_root_certs.h"  // NOLINT(build/include_order)
  };
-@@ -144,11 +369,19 @@ template void SSLWrap<TLSWrap>::AddMethods(Environment* env,
- template void SSLWrap<TLSWrap>::ConfigureSecureContext(SecureContext* sc);
- template void SSLWrap<TLSWrap>::SetSNIContext(SecureContext* sc);
- template int SSLWrap<TLSWrap>::SetCACerts(SecureContext* sc);
+@@ -123,7 +331,11 @@ template int SSLWrap<TLSWrap>::SetCACerts(SecureContext* sc);
+ template void SSLWrap<TLSWrap>::MemoryInfo(MemoryTracker* tracker) const;
+ template SSL_SESSION* SSLWrap<TLSWrap>::GetSessionCallback(
+     SSL* s,
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+template SSL_SESSION* SSLWrap<TLSWrap>::GetSessionCallback(
-+    SSL* s,
 +    unsigned char* key,
-+    int len,
-+    int* copy);
 +#else
- template SSL_SESSION* SSLWrap<TLSWrap>::GetSessionCallback(
-     SSL* s,
      const unsigned char* key,
++#endif
      int len,
      int* copy);
-+#endif
  template int SSLWrap<TLSWrap>::NewSessionCallback(SSL* s,
-                                                   SSL_SESSION* sess);
- template void SSLWrap<TLSWrap>::KeylogCallback(const SSL* s,
-@@ -168,6 +401,35 @@ template int SSLWrap<TLSWrap>::SelectALPNCallback(
+@@ -145,6 +357,36 @@ template int SSLWrap<TLSWrap>::SelectALPNCallback(
      unsigned int inlen,
      void* arg);
  
 +
++// Provide locking mechanism for OpenSSL
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
 +static Mutex* mutexes;
 +
@@ -472,7 +451,7 @@ index e0684d9..332b6f3 100644
  static int PasswordCallback(char* buf, int size, int rwflag, void* u) {
    const char* passphrase = static_cast<char*>(u);
    if (passphrase != nullptr) {
-@@ -299,15 +561,10 @@ Maybe<bool> Decorate(Environment* env, Local<Object> obj,
+@@ -276,15 +518,10 @@ Maybe<bool> Decorate(Environment* env, Local<Object> obj,
      V(COMP)                                                                   \
      V(ECDSA)                                                                  \
      V(ECDH)                                                                   \
@@ -488,7 +467,7 @@ index e0684d9..332b6f3 100644
      V(USER)                                                                   \
  
  #define V(name) case ERR_LIB_##name: lib = #name "_"; break;
-@@ -537,9 +794,13 @@ void SecureContext::New(const FunctionCallbackInfo<Value>& args) {
+@@ -524,9 +761,13 @@ void SecureContext::New(const FunctionCallbackInfo<Value>& args) {
    new SecureContext(env, args.This());
  }
  
@@ -502,7 +481,7 @@ index e0684d9..332b6f3 100644
  
  void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
    SecureContext* sc;
-@@ -552,7 +813,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+@@ -539,7 +780,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
  
    int min_version = args[1].As<Int32>()->Value();
    int max_version = args[2].As<Int32>()->Value();
@@ -511,7 +490,7 @@ index e0684d9..332b6f3 100644
  
    if (max_version == 0)
      max_version = MAX_SUPPORTED_VERSION;
-@@ -586,54 +847,57 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+@@ -573,54 +814,57 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
        max_version = TLS1_2_VERSION;
      } else if (strcmp(*sslmethod, "SSLv23_server_method") == 0) {
        max_version = TLS1_2_VERSION;
@@ -579,7 +558,7 @@ index e0684d9..332b6f3 100644
      } else {
        const std::string msg("Unknown method: ");
        THROW_ERR_TLS_INVALID_PROTOCOL_METHOD(env, (msg + * sslmethod).c_str());
-@@ -663,9 +927,16 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+@@ -650,9 +894,16 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
                                   SSL_SESS_CACHE_NO_INTERNAL |
                                   SSL_SESS_CACHE_NO_AUTO_CLEAR);
  
@@ -597,7 +576,7 @@ index e0684d9..332b6f3 100644
    // OpenSSL 1.1.0 changed the ticket key size, but the OpenSSL 1.0.x size was
    // exposed in the public API. To retain compatibility, install a callback
    // which restores the old algorithm.
-@@ -675,6 +946,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
+@@ -662,6 +913,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
      return env->ThrowError("Error generating ticket keys");
    }
    SSL_CTX_set_tlsext_ticket_key_cb(sc->ctx_.get(), TicketCompatibilityCallback);
@@ -605,7 +584,7 @@ index e0684d9..332b6f3 100644
  }
  
  
-@@ -1202,6 +1474,7 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
+@@ -1151,6 +1403,7 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
    CHECK_EQ(args.Length(), 1);
    CHECK(args[0]->IsString());
  
@@ -613,7 +592,7 @@ index e0684d9..332b6f3 100644
    const node::Utf8Value ciphers(args.GetIsolate(), args[0]);
    if (!SSL_CTX_set_cipher_list(sc->ctx_.get(), *ciphers)) {
      unsigned long err = ERR_get_error();  // NOLINT(runtime/int)
-@@ -1217,6 +1490,32 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
+@@ -1162,6 +1415,32 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
        // that's actually an error.
        return;
      }
@@ -643,10 +622,10 @@ index e0684d9..332b6f3 100644
 +      return env->ThrowError("Failed to set ciphers");
 +    }
 +#endif
-     return ThrowCryptoError(env, err);
+     return ThrowCryptoError(env, err, "Failed to set ciphers");
    }
  }
-@@ -1234,6 +1533,11 @@ void SecureContext::SetECDHCurve(const FunctionCallbackInfo<Value>& args) {
+@@ -1179,6 +1458,11 @@ void SecureContext::SetECDHCurve(const FunctionCallbackInfo<Value>& args) {
  
    node::Utf8Value curve(env->isolate(), args[0]);
  
@@ -658,7 +637,7 @@ index e0684d9..332b6f3 100644
    if (strcmp(*curve, "auto") == 0)
      return;
  
-@@ -1536,9 +1840,17 @@ void SecureContext::GetTicketKeys(const FunctionCallbackInfo<Value>& args) {
+@@ -1481,9 +1765,17 @@ void SecureContext::GetTicketKeys(const FunctionCallbackInfo<Value>& args) {
    ASSIGN_OR_RETURN_UNWRAP(&wrap, args.Holder());
  
    Local<Object> buff = Buffer::New(wrap->env(), 48).ToLocalChecked();
@@ -676,7 +655,7 @@ index e0684d9..332b6f3 100644
  
    args.GetReturnValue().Set(buff);
  #endif  // !def(OPENSSL_NO_TLSEXT) && def(SSL_CTX_get_tlsext_ticket_keys)
-@@ -1574,6 +1886,14 @@ void SecureContext::SetTicketKeys(const FunctionCallbackInfo<Value>& args) {
+@@ -1519,6 +1811,14 @@ void SecureContext::SetTicketKeys(const FunctionCallbackInfo<Value>& args) {
  
  
  void SecureContext::SetFreeListLength(const FunctionCallbackInfo<Value>& args) {
@@ -691,7 +670,7 @@ index e0684d9..332b6f3 100644
  }
  
  
-@@ -1676,6 +1996,7 @@ int SecureContext::TicketKeyCallback(SSL* ssl,
+@@ -1621,6 +1921,7 @@ int SecureContext::TicketKeyCallback(SSL* ssl,
  }
  
  
@@ -699,7 +678,7 @@ index e0684d9..332b6f3 100644
  int SecureContext::TicketCompatibilityCallback(SSL* ssl,
                                                 unsigned char* name,
                                                 unsigned char* iv,
-@@ -1710,6 +2031,7 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
+@@ -1655,6 +1956,7 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
    }
    return 1;
  }
@@ -707,89 +686,19 @@ index e0684d9..332b6f3 100644
  
  
  void SecureContext::CtxGetter(const FunctionCallbackInfo<Value>& info) {
-@@ -1788,11 +2110,19 @@ void SSLWrap<Base>::ConfigureSecureContext(SecureContext* sc) {
- }
- 
+@@ -1737,7 +2039,11 @@ void SSLWrap<Base>::ConfigureSecureContext(SecureContext* sc) {
  
+ template <class Base>
+ SSL_SESSION* SSLWrap<Base>::GetSessionCallback(SSL* s,
 +#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+template <class Base>
-+SSL_SESSION* SSLWrap<Base>::GetSessionCallback(SSL* s,
 +                                               unsigned char* key,
-+                                               int len,
-+                                               int* copy) {
 +#else
- template <class Base>
- SSL_SESSION* SSLWrap<Base>::GetSessionCallback(SSL* s,
                                                 const unsigned char* key,
++#endif
                                                 int len,
                                                 int* copy) {
-+#endif
    Base* w = static_cast<Base*>(SSL_get_app_data(s));
- 
-   *copy = 0;
-@@ -2121,6 +2451,23 @@ static Local<Object> X509ToObject(Environment* env, X509* cert) {
-   rsa.reset();
-   ec.reset();
- 
-+#if OPENSSL_VERSION_NUMBER < 0x10100000L
-+  ASN1_TIME_print(bio.get(), X509_get_notBefore(cert));
-+  BIO_get_mem_ptr(bio.get(), &mem);
-+  info->Set(context, env->valid_from_string(),
-+            String::NewFromUtf8(env->isolate(), mem->data,
-+                                NewStringType::kNormal,
-+                                mem->length).ToLocalChecked()).Check();
-+  USE(BIO_reset(bio.get()));
-+
-+  ASN1_TIME_print(bio.get(), X509_get_notAfter(cert));
-+  BIO_get_mem_ptr(bio.get(), &mem);
-+  info->Set(context, env->valid_to_string(),
-+            String::NewFromUtf8(env->isolate(), mem->data,
-+                                NewStringType::kNormal,
-+                                mem->length).ToLocalChecked()).Check();
-+  bio.reset();
-+#else
-   ASN1_TIME_print(bio.get(), X509_get0_notBefore(cert));
-   BIO_get_mem_ptr(bio.get(), &mem);
-   info->Set(context, env->valid_from_string(),
-@@ -2136,6 +2483,7 @@ static Local<Object> X509ToObject(Environment* env, X509* cert) {
-                                 NewStringType::kNormal,
-                                 mem->length).ToLocalChecked()).Check();
-   bio.reset();
-+#endif
- 
-   unsigned char md[EVP_MAX_MD_SIZE];
-   unsigned int md_size;
-@@ -2560,6 +2908,7 @@ void SSLWrap<Base>::GetEphemeralKeyInfo(
-             .Check();
-         break;
-       case EVP_PKEY_EC:
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-       case EVP_PKEY_X25519:
-       case EVP_PKEY_X448:
-         {
-@@ -2582,6 +2931,21 @@ void SSLWrap<Base>::GetEphemeralKeyInfo(
-                                  EVP_PKEY_bits(key.get()))).Check();
-         }
-         break;
-+#else
-+        {
-+          EC_KEY* ec = EVP_PKEY_get1_EC_KEY(key.get());
-+          int nid = EC_GROUP_get_curve_name(EC_KEY_get0_group(ec));
-+          EC_KEY_free(ec);
-+          info->Set(context, env->type_string(),
-+                    FIXED_ONE_BYTE_STRING(env->isolate(), "ECDH")).Check();
-+          info->Set(context, env->name_string(),
-+                    OneByteString(args.GetIsolate(),
-+                                  OBJ_nid2sn(nid))).Check();
-+          info->Set(context, env->size_string(),
-+                    Integer::New(env->isolate(),
-+                                  EVP_PKEY_bits(key.get()))).Check();
-+         }
-+#endif
-       default:
-         break;
-     }
-@@ -3901,12 +4265,15 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
+@@ -3362,14 +3668,17 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
    switch (EVP_PKEY_id(this->asymmetric_key_.get())) {
    case EVP_PKEY_RSA:
      return env()->crypto_rsa_string();
@@ -799,13 +708,15 @@ index e0684d9..332b6f3 100644
 +#endif
    case EVP_PKEY_DSA:
      return env()->crypto_dsa_string();
+   case EVP_PKEY_DH:
+     return env()->crypto_dh_string();
    case EVP_PKEY_EC:
      return env()->crypto_ec_string();
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    case EVP_PKEY_ED25519:
      return env()->crypto_ed25519_string();
    case EVP_PKEY_ED448:
-@@ -3915,6 +4282,7 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
+@@ -3378,6 +3687,7 @@ Local<Value> KeyObject::GetAsymmetricKeyType() const {
      return env()->crypto_x25519_string();
    case EVP_PKEY_X448:
      return env()->crypto_x448_string();
@@ -813,7 +724,7 @@ index e0684d9..332b6f3 100644
    default:
      return Undefined(env()->isolate());
    }
-@@ -4210,10 +4578,10 @@ bool CipherBase::InitAuthenticated(const char* cipher_type, int iv_len,
+@@ -3685,10 +3995,10 @@ bool CipherBase::InitAuthenticated(const char* cipher_type, int iv_len,
    CHECK(IsAuthenticatedMode());
    MarkPopErrorOnReturn mark_pop_error_on_return;
  
@@ -828,7 +739,7 @@ index e0684d9..332b6f3 100644
      env()->ThrowError("Invalid IV length");
      return false;
    }
-@@ -4561,8 +4929,12 @@ bool CipherBase::Final(AllocatedBuffer* out) {
+@@ -4036,8 +4346,12 @@ bool CipherBase::Final(AllocatedBuffer* out) {
          CHECK(mode == EVP_CIPH_GCM_MODE);
          auth_tag_len_ = sizeof(auth_tag_);
        }
@@ -843,7 +754,7 @@ index e0684d9..332b6f3 100644
                        reinterpret_cast<unsigned char*>(auth_tag_)));
      }
    }
-@@ -4852,8 +5224,12 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
+@@ -4345,8 +4659,12 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
        ret = EVP_DigestFinal_ex(hash->mdctx_.get(), hash->md_value_,
                                 &hash->md_len_);
      } else {
@@ -856,7 +767,7 @@ index e0684d9..332b6f3 100644
      }
  
      if (ret != 1) {
-@@ -4883,12 +5259,14 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
+@@ -4376,12 +4694,14 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
  
  SignBase::Error SignBase::Init(const char* sign_type) {
    CHECK_NULL(mdctx_);
@@ -871,7 +782,7 @@ index e0684d9..332b6f3 100644
    const EVP_MD* md = EVP_get_digestbyname(sign_type);
    if (md == nullptr)
      return kSignUnknownDigest;
-@@ -4960,9 +5338,14 @@ static bool ApplyRSAOptions(const ManagedEVPPKey& pkey,
+@@ -4457,9 +4777,14 @@ static bool ApplyRSAOptions(const ManagedEVPPKey& pkey,
                              EVP_PKEY_CTX* pkctx,
                              int padding,
                              const Maybe<int>& salt_len) {
@@ -886,7 +797,7 @@ index e0684d9..332b6f3 100644
      if (EVP_PKEY_CTX_set_rsa_padding(pkctx, padding) <= 0)
        return false;
      if (padding == RSA_PKCS1_PSS_PADDING && salt_len.IsJust()) {
-@@ -5017,9 +5400,13 @@ void Sign::SignUpdate(const FunctionCallbackInfo<Value>& args) {
+@@ -4518,9 +4843,13 @@ void Sign::SignUpdate(const FunctionCallbackInfo<Value>& args) {
    sign->CheckThrow(err);
  }
  
@@ -901,7 +812,49 @@ index e0684d9..332b6f3 100644
  }
  
  static const unsigned int kNoDsaSignature = static_cast<unsigned int>(-1);
-@@ -6312,9 +6699,24 @@ struct PBKDF2Job : public CryptoJob {
+@@ -4910,6 +5239,9 @@ void Verify::VerifyFinal(const FunctionCallbackInfo<Value>& args) {
+     if (signature.get() == nullptr)
+       return verify->CheckThrow(Error::kSignMalformedSignature);
+   }
++#else // OPENSSL_VERSION_NUMBER >= 0x10100000L
++  ByteSource signature = ByteSource::Foreign(hbuf.data(), hbuf.length());
++#endif
+ 
+   bool verify_result;
+   Error err = verify->VerifyFinal(pkey, signature, padding,
+@@ -5165,11 +5497,15 @@ bool DiffieHellman::Init(int primeLength, int g) {
+ bool DiffieHellman::Init(const char* p, int p_len, int g) {
+   dh_.reset(DH_new());
+   if (p_len <= 0) {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+     BNerr(BN_F_BN_GENERATE_PRIME_EX, BN_R_BITS_TOO_SMALL);
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+     return false;
+   }
+   if (g <= 1) {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+     DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_BAD_GENERATOR);
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+     return false;
+   }
+   BIGNUM* bn_p =
+@@ -5188,11 +5524,15 @@ bool DiffieHellman::Init(const char* p, int p_len, int g) {
+ bool DiffieHellman::Init(const char* p, int p_len, const char* g, int g_len) {
+   dh_.reset(DH_new());
+   if (p_len <= 0) {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+     BNerr(BN_F_BN_GENERATE_PRIME_EX, BN_R_BITS_TOO_SMALL);
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+     return false;
+   }
+   if (g_len <= 0) {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+     DHerr(DH_F_DH_BUILTIN_GENPARAMS, DH_R_BAD_GENERATOR);
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+     return false;
+   }
+   BIGNUM* bn_g =
+@@ -5842,9 +6182,24 @@ struct PBKDF2Job : public CryptoJob {
    }
  
    inline void DoThreadPoolWork() override {
@@ -928,7 +881,7 @@ index e0684d9..332b6f3 100644
                            iteration_count, digest, keybuf_size, keybuf_data);
      success = Just(ok);
      Cleanse();
-@@ -6497,6 +6899,7 @@ class RSAKeyPairGenerationConfig : public KeyPairGenerationConfig {
+@@ -6027,6 +6382,7 @@ class RSAKeyPairGenerationConfig : public KeyPairGenerationConfig {
    const unsigned int exponent_;
  };
  
@@ -936,7 +889,7 @@ index e0684d9..332b6f3 100644
  class RSAPSSKeyPairGenerationConfig : public RSAKeyPairGenerationConfig {
   public:
    RSAPSSKeyPairGenerationConfig(unsigned int modulus_bits,
-@@ -6538,6 +6941,7 @@ class RSAPSSKeyPairGenerationConfig : public RSAKeyPairGenerationConfig {
+@@ -6068,6 +6424,7 @@ class RSAPSSKeyPairGenerationConfig : public RSAKeyPairGenerationConfig {
    const EVP_MD* mgf1_md_;
    const int saltlen_;
  };
@@ -944,7 +897,7 @@ index e0684d9..332b6f3 100644
  
  class DSAKeyPairGenerationConfig : public KeyPairGenerationConfig {
   public:
-@@ -6613,6 +7017,7 @@ class ECKeyPairGenerationConfig : public KeyPairGenerationConfig {
+@@ -6143,6 +6500,7 @@ class ECKeyPairGenerationConfig : public KeyPairGenerationConfig {
    const int param_encoding_;
  };
  
@@ -952,15 +905,15 @@ index e0684d9..332b6f3 100644
  class NidKeyPairGenerationConfig : public KeyPairGenerationConfig {
   public:
    explicit NidKeyPairGenerationConfig(int id) : id_(id) {}
-@@ -6624,6 +7029,7 @@ class NidKeyPairGenerationConfig : public KeyPairGenerationConfig {
+@@ -6154,6 +6512,7 @@ class NidKeyPairGenerationConfig : public KeyPairGenerationConfig {
   private:
    const int id_;
  };
 +#endif
  
- class GenerateKeyPairJob : public CryptoJob {
-  public:
-@@ -6768,6 +7174,7 @@ void GenerateKeyPairRSA(const FunctionCallbackInfo<Value>& args) {
+ // TODO(tniessen): Use std::variant instead.
+ // Diffie-Hellman can either generate keys using a fixed prime, or by first
+@@ -6357,6 +6716,7 @@ void GenerateKeyPairRSA(const FunctionCallbackInfo<Value>& args) {
    GenerateKeyPair(args, 2, std::move(config));
  }
  
@@ -968,7 +921,7 @@ index e0684d9..332b6f3 100644
  void GenerateKeyPairRSAPSS(const FunctionCallbackInfo<Value>& args) {
    Environment* env = Environment::GetCurrent(args);
  
-@@ -6805,6 +7212,7 @@ void GenerateKeyPairRSAPSS(const FunctionCallbackInfo<Value>& args) {
+@@ -6394,6 +6754,7 @@ void GenerateKeyPairRSAPSS(const FunctionCallbackInfo<Value>& args) {
                                          md, mgf1_md, saltlen));
    GenerateKeyPair(args, 5, std::move(config));
  }
@@ -976,7 +929,7 @@ index e0684d9..332b6f3 100644
  
  void GenerateKeyPairDSA(const FunctionCallbackInfo<Value>& args) {
    CHECK(args[0]->IsUint32());
-@@ -6836,6 +7244,7 @@ void GenerateKeyPairEC(const FunctionCallbackInfo<Value>& args) {
+@@ -6425,6 +6786,7 @@ void GenerateKeyPairEC(const FunctionCallbackInfo<Value>& args) {
    GenerateKeyPair(args, 2, std::move(config));
  }
  
@@ -984,31 +937,50 @@ index e0684d9..332b6f3 100644
  void GenerateKeyPairNid(const FunctionCallbackInfo<Value>& args) {
    CHECK(args[0]->IsInt32());
    const int id = args[0].As<Int32>()->Value();
-@@ -6843,6 +7252,7 @@ void GenerateKeyPairNid(const FunctionCallbackInfo<Value>& args) {
+@@ -6432,6 +6794,7 @@ void GenerateKeyPairNid(const FunctionCallbackInfo<Value>& args) {
        new NidKeyPairGenerationConfig(id));
    GenerateKeyPair(args, 1, std::move(config));
  }
 +#endif
  
+ void GenerateKeyPairDH(const FunctionCallbackInfo<Value>& args) {
+   Environment* env = Environment::GetCurrent(args);
+@@ -6477,6 +6840,7 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
+   CHECK(ssl);
  
- void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
-@@ -6866,6 +7276,7 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
-                            SSL_CIPHER_get_name(cipher))).Check();
-   }
- 
+   STACK_OF(SSL_CIPHER)* ciphers = SSL_get_ciphers(ssl.get());
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    // TLSv1.3 ciphers aren't listed by EVP. There are only 5, we could just
    // document them, but since there are only 5, easier to just add them manually
    // and not have to explain their absence in the API docs. They are lower-cased
-@@ -6883,6 +7294,7 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
-     arr->Set(env->context(),
-              arr->Length(), OneByteString(args.GetIsolate(), name)).Check();
+@@ -6488,19 +6852,26 @@ void GetSSLCiphers(const FunctionCallbackInfo<Value>& args) {
+     "tls_aes_128_ccm_8_sha256",
+     "tls_aes_128_ccm_sha256"
+   };
++#endif
+ 
+   const int n = sk_SSL_CIPHER_num(ciphers);
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   std::vector<Local<Value>> arr(n + arraysize(TLS13_CIPHERS));
++#else
++  std::vector<Local<Value>> arr(n);
++#endif
+ 
+   for (int i = 0; i < n; ++i) {
+     const SSL_CIPHER* cipher = sk_SSL_CIPHER_value(ciphers, i);
+     arr[i] = OneByteString(env->isolate(), SSL_CIPHER_get_name(cipher));
+   }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   for (unsigned i = 0; i < arraysize(TLS13_CIPHERS); ++i) {
+     const char* name = TLS13_CIPHERS[i];
+     arr[n + i] = OneByteString(env->isolate(), name);
    }
 +#endif
  
-   args.GetReturnValue().Set(arr);
+   args.GetReturnValue().Set(Array::New(env->isolate(), arr.data(), arr.size()));
  }
-@@ -7111,7 +7523,7 @@ void TimingSafeEqual(const FunctionCallbackInfo<Value>& args) {
+@@ -6803,7 +7174,7 @@ void TimingSafeEqual(const FunctionCallbackInfo<Value>& args) {
  }
  
  void InitCryptoOnce() {
@@ -1017,7 +989,7 @@ index e0684d9..332b6f3 100644
    OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
  
    // --openssl-config=...
-@@ -7123,7 +7535,35 @@ void InitCryptoOnce() {
+@@ -6815,7 +7186,35 @@ void InitCryptoOnce() {
    OPENSSL_init_ssl(0, settings);
    OPENSSL_INIT_free(settings);
    settings = nullptr;
@@ -1054,7 +1026,7 @@ index e0684d9..332b6f3 100644
  
  #ifdef NODE_FIPS_MODE
    /* Override FIPS settings in cnf file, if needed. */
-@@ -7246,14 +7686,18 @@ void Initialize(Local<Object> target,
+@@ -6938,15 +7337,21 @@ void Initialize(Local<Object> target,
  
    env->SetMethod(target, "pbkdf2", PBKDF2);
    env->SetMethod(target, "generateKeyPairRSA", GenerateKeyPairRSA);
@@ -1065,6 +1037,9 @@ index e0684d9..332b6f3 100644
    env->SetMethod(target, "generateKeyPairEC", GenerateKeyPairEC);
 +#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    env->SetMethod(target, "generateKeyPairNid", GenerateKeyPairNid);
++#endif
+   env->SetMethod(target, "generateKeyPairDH", GenerateKeyPairDH);
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
    NODE_DEFINE_CONSTANT(target, EVP_PKEY_ED25519);
    NODE_DEFINE_CONSTANT(target, EVP_PKEY_ED448);
    NODE_DEFINE_CONSTANT(target, EVP_PKEY_X25519);
@@ -1074,10 +1049,10 @@ index e0684d9..332b6f3 100644
    NODE_DEFINE_CONSTANT(target, OPENSSL_EC_EXPLICIT_CURVE);
    NODE_DEFINE_CONSTANT(target, kKeyEncodingPKCS1);
 diff --git a/src/node_crypto.h b/src/node_crypto.h
-index 4862c16..580ca6a 100644
+index 772a34a..f61ad3d 100644
 --- a/src/node_crypto.h
 +++ b/src/node_crypto.h
-@@ -35,10 +35,47 @@
+@@ -35,10 +35,77 @@
  
  #include <openssl/err.h>
  #include <openssl/ssl.h>
@@ -1121,11 +1096,41 @@ index 4862c16..580ca6a 100644
 +    OPENSSL_cleanse(to, tolen);
 +    return BN_bn2bin(a, to);
 +}
++
++inline void RSA_get0_key(const RSA* r, const BIGNUM** n, const BIGNUM** e,
++                         const BIGNUM** d) {
++  if (n != nullptr) {
++    *n = r->n;
++  }
++  if (e != nullptr) {
++    *e = r->e;
++  }
++  if (d != nullptr) {
++    *d = r->d;
++  }
++}
++
++inline int EC_GROUP_order_bits(const EC_GROUP *group) {
++  int num_bits = 0;
++  BIGNUM *order = BN_new();
++  BN_CTX *ctx = BN_CTX_new();
++  if (order == nullptr || ctx == nullptr) { goto end; }
++
++  if (EC_GROUP_get_order(group, order, ctx) != 1) { goto end; }
++  num_bits = BN_num_bits(order);
++
++end:
++  BN_CTX_free(ctx), ctx = nullptr;
++  BN_free(order), order = nullptr;
++
++  return num_bits;
++}
++
 +#endif // OPENSSL_VERSION_NUMBER < 0x10100000L
  
  namespace node {
  namespace crypto {
-@@ -240,10 +277,17 @@ class SSLWrap {
+@@ -230,10 +297,17 @@ class SSLWrap {
    static void ConfigureSecureContext(SecureContext* sc);
    static void AddMethods(Environment* env, v8::Local<v8::FunctionTemplate> t);
  
@@ -1143,8 +1148,18 @@ index 4862c16..580ca6a 100644
    static int NewSessionCallback(SSL* s, SSL_SESSION* sess);
    static void KeylogCallback(const SSL* s, const char* line);
    static void OnClientHello(void* arg,
+@@ -353,6 +427,9 @@ class ByteSource {
+   size_t size_ = 0;
+ 
+   ByteSource(const char* data, char* allocated_data, size_t size);
++public:
++  static ByteSource Allocated(char* data, size_t size);
++  static ByteSource Foreign(const char* data, size_t size);
+ };
+ 
+ enum PKEncodingType {
 diff --git a/src/node_crypto_bio.cc b/src/node_crypto_bio.cc
-index fc14304..75b55eb 100644
+index 55f5e8a..72af159 100644
 --- a/src/node_crypto_bio.cc
 +++ b/src/node_crypto_bio.cc
 @@ -30,8 +30,18 @@
@@ -1198,11 +1213,145 @@ index fc14304..75b55eb 100644
  }
  
  
+diff --git a/src/node_crypto_common.cc b/src/node_crypto_common.cc
+index 3b35ee1..e33e52e 100644
+--- a/src/node_crypto_common.cc
++++ b/src/node_crypto_common.cc
+@@ -55,10 +55,11 @@ int SSL_CTX_get_issuer(SSL_CTX* ctx, X509* cert, X509** issuer) {
+ }
+ 
+ void LogSecret(
+-    const SSLPointer& ssl,
+-    const char* name,
+-    const unsigned char* secret,
+-    size_t secretlen) {
++    [[maybe_unused]] const SSLPointer& ssl,
++    [[maybe_unused]] const char* name,
++    [[maybe_unused]] const unsigned char* secret,
++    [[maybe_unused]] size_t secretlen) {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   auto keylog_cb = SSL_CTX_get_keylog_callback(SSL_get_SSL_CTX(ssl.get()));
+   unsigned char crandom[32];
+ 
+@@ -73,6 +74,7 @@ void LogSecret(
+   line += " " + StringBytes::hex_encode(
+       reinterpret_cast<const char*>(secret), secretlen);
+   keylog_cb(ssl.get(), line.c_str());
++#endif
+ }
+ 
+ bool SetALPN(const SSLPointer& ssl, const std::string& alpn) {
+@@ -195,7 +197,11 @@ std::string GetCertificateCN(X509* cert) {
+         ASN1_STRING* cn_str = X509_NAME_ENTRY_get_data(cn);
+         if (cn_str != nullptr) {
+           return std::string(reinterpret_cast<const char*>(
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+               ASN1_STRING_get0_data(cn_str)));
++#else // OPENSSL_VERSION_NUMBER >= 0x10100000L
++              ASN1_STRING_data(cn_str)));
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+         }
+       }
+     }
+@@ -238,6 +244,7 @@ int UseSNIContext(const SSLPointer& ssl, BaseObjectPtr<SecureContext> context) {
+   return err;
+ }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ const char* GetClientHelloALPN(const SSLPointer& ssl) {
+   const unsigned char* buf;
+   size_t len;
+@@ -284,13 +291,18 @@ const char* GetClientHelloServerName(const SSLPointer& ssl) {
+     return nullptr;
+   return reinterpret_cast<const char*>(buf + 5);
+ }
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+ 
+ const char* GetServerName(SSL* ssl) {
+   return SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
+ }
+ 
+ bool SetGroups(SecureContext* sc, const char* groups) {
++#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+   return SSL_CTX_set1_groups_list(**sc, groups) == 1;
++#else // OPENSSL_VERSION_NUMBER >= 0x10101000L
++  return SSL_CTX_set1_curves_list(**sc, groups) == 1;
++#endif // OPENSSL_VERSION_NUMBER >= 0x10101000L
+ }
+ 
+ const char* X509ErrorCode(long err) {  // NOLINT(runtime/int)
+@@ -609,7 +621,11 @@ MaybeLocal<Value> GetValidTo(
+     Environment* env,
+     X509* cert,
+     const BIOPointer& bio) {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++  ASN1_TIME_print(bio.get(), X509_get_notAfter(cert));
++#else
+   ASN1_TIME_print(bio.get(), X509_get0_notAfter(cert));
++#endif
+   return ToV8Value(env, bio);
+ }
+ 
+@@ -617,7 +633,11 @@ MaybeLocal<Value> GetValidFrom(
+     Environment* env,
+     X509* cert,
+     const BIOPointer& bio) {
++#if OPENSSL_VERSION_NUMBER < 0x10100000L
++  ASN1_TIME_print(bio.get(), X509_get_notBefore(cert));
++#else
+   ASN1_TIME_print(bio.get(), X509_get0_notBefore(cert));
++#endif
+   return ToV8Value(env, bio);
+ }
+ 
+@@ -768,6 +788,7 @@ MaybeLocal<Value> GetCipherVersion(Environment* env, const SSLPointer& ssl) {
+   return GetCipherVersion(env, SSL_get_current_cipher(ssl.get()));
+ }
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ MaybeLocal<Array> GetClientHelloCiphers(
+     Environment* env,
+     const SSLPointer& ssl) {
+@@ -800,6 +821,7 @@ MaybeLocal<Array> GetClientHelloCiphers(
+   Local<Array> ret = Array::New(env->isolate(), ciphers.out(), count);
+   return scope.Escape(ret);
+ }
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+ 
+ 
+ MaybeLocal<Object> GetCipherInfo(Environment* env, const SSLPointer& ssl) {
+@@ -849,8 +871,10 @@ MaybeLocal<Object> GetEphemeralKey(Environment* env, const SSLPointer& ssl) {
+       }
+       break;
+     case EVP_PKEY_EC:
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+     case EVP_PKEY_X25519:
+     case EVP_PKEY_X448:
++#endif
+       {
+         const char* curve_name;
+         if (kid == EVP_PKEY_EC) {
+diff --git a/src/node_crypto_common.h b/src/node_crypto_common.h
+index c373a97..bdf25e7 100644
+--- a/src/node_crypto_common.h
++++ b/src/node_crypto_common.h
+@@ -73,9 +73,11 @@ long VerifyPeerCertificate(  // NOLINT(runtime/int)
+ 
+ int UseSNIContext(const SSLPointer& ssl, BaseObjectPtr<SecureContext> context);
+ 
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+ const char* GetClientHelloALPN(const SSLPointer& ssl);
+ 
+ const char* GetClientHelloServerName(const SSLPointer& ssl);
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+ 
+ const char* GetServerName(SSL* ssl);
+ 
 diff --git a/src/node_errors.h b/src/node_errors.h
-index 74413e7..426b059 100644
+index f79b87a..ad8c272 100644
 --- a/src/node_errors.h
 +++ b/src/node_errors.h
-@@ -151,8 +151,8 @@ inline v8::Local<v8::Value> ERR_STRING_TOO_LONG(v8::Isolate* isolate) {
+@@ -158,8 +158,8 @@ inline v8::Local<v8::Value> ERR_STRING_TOO_LONG(v8::Isolate* isolate) {
  
  #define THROW_AND_RETURN_IF_NOT_STRING(env, val, prefix)                     \
    do {                                                                       \
@@ -1214,10 +1363,10 @@ index 74413e7..426b059 100644
    } while (0)
  
 diff --git a/src/node_options.cc b/src/node_options.cc
-index ed46978..4e473ca 100644
+index 8b3a161..17a7e34 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -588,10 +588,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
+@@ -524,10 +524,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
              "set default TLS minimum to TLSv1.2 (default: TLSv1.2)",
              &EnvironmentOptions::tls_min_v1_2,
              kAllowedInEnvironment);
@@ -1230,7 +1379,7 @@ index ed46978..4e473ca 100644
    AddOption("--tls-max-v1.2",
              "set default TLS maximum to TLSv1.2 (default: TLSv1.3)",
              &EnvironmentOptions::tls_max_v1_2,
-@@ -600,10 +602,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
+@@ -536,10 +538,12 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
    // - 11.x and below: TLS1.3 is opt-in with --tls-max-v1.3
    // - 12.x: TLS1.3 is opt-out with --tls-max-v1.2
    // In either case, support both options they are uniformly available.
@@ -1244,10 +1393,10 @@ index ed46978..4e473ca 100644
  
  PerIsolateOptionsParser::PerIsolateOptionsParser(
 diff --git a/src/tls_wrap.cc b/src/tls_wrap.cc
-index 263505c..75cfddd 100644
+index 39dcf53..8fda8b9 100644
 --- a/src/tls_wrap.cc
 +++ b/src/tls_wrap.cc
-@@ -914,11 +914,13 @@ void TLSWrap::EnableSessionCallbacks(
+@@ -939,11 +939,13 @@ void TLSWrap::EnableSessionCallbacks(
  
  void TLSWrap::EnableKeylogCallback(
      const FunctionCallbackInfo<Value>& args) {
@@ -1262,5 +1411,5 @@ index 263505c..75cfddd 100644
  
  // Check required capabilities were not excluded from the OpenSSL build:
 -- 
-1.8.3.1
+2.26.2
 
diff --git a/SOURCES/0002-Revert-new-options-using-unsupported-OpenSSL-feature.patch b/SOURCES/0002-Revert-new-options-using-unsupported-OpenSSL-feature.patch
index c11c6b3..0ffdb77 100644
--- a/SOURCES/0002-Revert-new-options-using-unsupported-OpenSSL-feature.patch
+++ b/SOURCES/0002-Revert-new-options-using-unsupported-OpenSSL-feature.patch
@@ -1,56 +1,54 @@
-From 0c7e5df7fecc76f64b45c3267c851eff2ac8c496 Mon Sep 17 00:00:00 2001
+From 787303a9ec7fafc5f4a6867a7691bf461c5e44f7 Mon Sep 17 00:00:00 2001
 From: Zuzana Svetlikova <zsvetlik@redhat.com>
 Date: Wed, 19 Feb 2020 09:45:19 +0000
-Subject: [PATCH 2/4] revert new features
+Subject: [PATCH] Revert new options using unsupported OpenSSL features
 
+Signed-off-by: rpm-build <rpm-build>
 ---
- doc/api/crypto.md                           |  24 ---
- doc/api/errors.md                           |   5 -
- doc/api/https.md                            |  25 ---
- doc/api/tls.md                              | 117 +-----------
- doc/node.1                                  |   5 -
- lib/_http_agent.js                          |  24 +--
- lib/_tls_common.js                          |  13 --
- lib/_tls_wrap.js                            | 143 +--------------
- lib/internal/crypto/cipher.js               |  10 +-
- lib/internal/crypto/sig.js                  |  37 +---
- src/env.h                                   |  13 +-
- src/node_crypto.cc                          | 266 +---------------------------
- src/node_crypto.h                           |  24 +--
- src/node_errors.h                           |   2 -
- src/node_options.cc                         |   4 -
- src/node_options.h                          |   1 -
- src/tls_wrap.cc                             | 134 --------------
- src/tls_wrap.h                              |  17 --
- test/fixtures/rsa-oaep-test-vectors.js      |  30 ----
- test/parallel/test-crypto-rsa-dsa.js        |  65 +++++--
- test/parallel/test-crypto-sign-verify.js    |  90 ++--------
- test/parallel/test-https-agent-keylog.js    |  44 -----
- test/parallel/test-tls-enable-keylog-cli.js |  57 ------
- test/parallel/test-tls-getcipher.js         |   4 -
- test/parallel/test-tls-keylog-tlsv13.js     |  10 +-
- test/parallel/test-tls-multi-key.js         |   2 -
- test/parallel/test-tls-multi-pfx.js         |   2 -
- test/parallel/test-tls-psk-circuit.js       |  72 --------
- test/parallel/test-tls-psk-errors.js        |  32 ----
- test/parallel/test-tls-psk-server.js        |  77 --------
- test/parallel/test-tls-set-sigalgs.js       |  74 --------
- test/sequential/test-tls-psk-client.js      |  96 ----------
- 32 files changed, 87 insertions(+), 1432 deletions(-)
+ doc/api/crypto.md                             |  24 ---
+ doc/api/errors.md                             |   5 -
+ doc/api/https.md                              |  25 ---
+ doc/api/tls.md                                | 117 +------------
+ doc/node.1                                    |   5 -
+ lib/_http_agent.js                            |  24 +--
+ lib/_tls_common.js                            |  13 --
+ lib/_tls_wrap.js                              | 141 +--------------
+ lib/internal/crypto/cipher.js                 |  10 +-
+ lib/internal/crypto/sig.js                    |  37 +---
+ src/env.h                                     |   3 -
+ src/node_crypto.cc                            | 161 ++----------------
+ src/node_crypto.h                             |  26 +--
+ src/node_crypto_common.cc                     |  12 +-
+ src/node_errors.h                             |   2 -
+ src/node_options.cc                           |   4 -
+ src/node_options.h                            |   1 -
+ src/tls_wrap.cc                               | 134 ---------------
+ src/tls_wrap.h                                |  17 --
+ test/fixtures/rsa-oaep-test-vectors.js        |  30 ----
+ .../test-tls-enable-keylog-cli.js             |   0
+ test/parallel/test-crypto-rsa-dsa.js          |  65 ++++---
+ test/parallel/test-crypto-sign-verify.js      |  67 ++++----
+ test/parallel/test-https-agent-keylog.js      |  44 -----
+ test/parallel/test-tls-getcipher.js           |   4 -
+ test/parallel/test-tls-keylog-tlsv13.js       |  10 +-
+ test/parallel/test-tls-multi-key.js           |   2 -
+ test/parallel/test-tls-multi-pfx.js           |   2 -
+ test/parallel/test-tls-psk-circuit.js         |  72 --------
+ test/parallel/test-tls-psk-errors.js          |  32 ----
+ test/parallel/test-tls-set-sigalgs.js         |  74 --------
+ 31 files changed, 126 insertions(+), 1037 deletions(-)
  delete mode 100644 test/fixtures/rsa-oaep-test-vectors.js
+ rename test/{parallel => known_issues}/test-tls-enable-keylog-cli.js (100%)
  delete mode 100644 test/parallel/test-https-agent-keylog.js
- delete mode 100644 test/parallel/test-tls-enable-keylog-cli.js
  delete mode 100644 test/parallel/test-tls-psk-circuit.js
  delete mode 100644 test/parallel/test-tls-psk-errors.js
- delete mode 100644 test/parallel/test-tls-psk-server.js
  delete mode 100644 test/parallel/test-tls-set-sigalgs.js
- delete mode 100644 test/sequential/test-tls-psk-client.js
 
 diff --git a/doc/api/crypto.md b/doc/api/crypto.md
-index f727d6f..7e74977 100644
+index 6d6d75e..2dd32d1 100644
 --- a/doc/api/crypto.md
 +++ b/doc/api/crypto.md
-@@ -1405,7 +1405,6 @@ changes:
+@@ -1410,7 +1410,6 @@ changes:
  -->
  
  * `privateKey` {Object | string | Buffer | KeyObject}
@@ -58,7 +56,7 @@ index f727d6f..7e74977 100644
    * `padding` {integer}
    * `saltLength` {integer}
  * `outputEncoding` {string} The [encoding][] of the return value.
-@@ -1418,10 +1417,6 @@ If `privateKey` is not a [`KeyObject`][], this function behaves as if
+@@ -1423,10 +1422,6 @@ If `privateKey` is not a [`KeyObject`][], this function behaves as if
  `privateKey` had been passed to [`crypto.createPrivateKey()`][]. If it is an
  object, the following additional properties can be passed:
  
@@ -69,7 +67,7 @@ index f727d6f..7e74977 100644
  * `padding` {integer} Optional padding value for RSA, one of the following:
    * `crypto.constants.RSA_PKCS1_PADDING` (default)
    * `crypto.constants.RSA_PKCS1_PSS_PADDING`
-@@ -1518,7 +1513,6 @@ changes:
+@@ -1523,7 +1518,6 @@ changes:
  -->
  
  * `object` {Object | string | Buffer | KeyObject}
@@ -77,7 +75,7 @@ index f727d6f..7e74977 100644
    * `padding` {integer}
    * `saltLength` {integer}
  * `signature` {string | Buffer | TypedArray | DataView}
-@@ -1532,10 +1526,6 @@ If `object` is not a [`KeyObject`][], this function behaves as if
+@@ -1537,10 +1531,6 @@ If `object` is not a [`KeyObject`][], this function behaves as if
  `object` had been passed to [`crypto.createPublicKey()`][]. If it is an
  object, the following additional properties can be passed:
  
@@ -88,7 +86,7 @@ index f727d6f..7e74977 100644
  * `padding` {integer} Optional padding value for RSA, one of the following:
    * `crypto.constants.RSA_PKCS1_PADDING` (default)
    * `crypto.constants.RSA_PKCS1_PSS_PADDING`
-@@ -2427,9 +2417,6 @@ An array of supported digest functions can be retrieved using
+@@ -2464,9 +2454,6 @@ An array of supported digest functions can be retrieved using
  <!-- YAML
  added: v0.11.14
  changes:
@@ -98,7 +96,7 @@ index f727d6f..7e74977 100644
    - version: v12.9.0
      pr-url: https://github.com/nodejs/node/pull/28335
      description: The `oaepHash` option was added.
-@@ -2514,9 +2501,6 @@ be passed instead of a public key.
+@@ -2553,9 +2540,6 @@ be passed instead of a public key.
  <!-- YAML
  added: v0.11.14
  changes:
@@ -108,7 +106,7 @@ index f727d6f..7e74977 100644
    - version: v12.9.0
      pr-url: https://github.com/nodejs/node/pull/28335
      description: The `oaepHash` option was added.
-@@ -2900,10 +2884,6 @@ If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
+@@ -2941,10 +2925,6 @@ If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
  passed to [`crypto.createPrivateKey()`][]. If it is an object, the following
  additional properties can be passed:
  
@@ -119,7 +117,7 @@ index f727d6f..7e74977 100644
  * `padding` {integer} Optional padding value for RSA, one of the following:
    * `crypto.constants.RSA_PKCS1_PADDING` (default)
    * `crypto.constants.RSA_PKCS1_PSS_PADDING`
-@@ -2957,10 +2937,6 @@ If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
+@@ -2998,10 +2978,6 @@ If `key` is not a [`KeyObject`][], this function behaves as if `key` had been
  passed to [`crypto.createPublicKey()`][]. If it is an object, the following
  additional properties can be passed:
  
@@ -131,10 +129,10 @@ index f727d6f..7e74977 100644
    * `crypto.constants.RSA_PKCS1_PADDING` (default)
    * `crypto.constants.RSA_PKCS1_PSS_PADDING`
 diff --git a/doc/api/errors.md b/doc/api/errors.md
-index 7cf3496..32ba4ec 100644
+index 51239ab..26e076d 100644
 --- a/doc/api/errors.md
 +++ b/doc/api/errors.md
-@@ -1849,11 +1849,6 @@ vector for denial-of-service attacks.
+@@ -1923,11 +1923,6 @@ vector for denial-of-service attacks.
  An attempt was made to issue Server Name Indication from a TLS server-side
  socket, which is only valid from a client.
  
@@ -147,7 +145,7 @@ index 7cf3496..32ba4ec 100644
  ### `ERR_TRACE_EVENTS_CATEGORY_REQUIRED`
  
 diff --git a/doc/api/https.md b/doc/api/https.md
-index bb0322d..e82ffa2 100644
+index c685b3f..3cb142d 100644
 --- a/doc/api/https.md
 +++ b/doc/api/https.md
 @@ -45,31 +45,6 @@ changes:
@@ -183,7 +181,7 @@ index bb0322d..e82ffa2 100644
  <!-- YAML
  added: v0.3.4
 diff --git a/doc/api/tls.md b/doc/api/tls.md
-index 2eaaab5..61dc459 100644
+index 04f5e23..34d6851 100644
 --- a/doc/api/tls.md
 +++ b/doc/api/tls.md
 @@ -118,40 +118,6 @@ SNI (Server Name Indication) are TLS handshake extensions:
@@ -273,10 +271,10 @@ index 2eaaab5..61dc459 100644
 -[SSL_get_shared_sigalgs](https://www.openssl.org/docs/man1.1.1/man3/SSL_get_shared_sigalgs.html)
 -for more information.
 -
- ### `tlsSocket.getTLSTicket()`
+ ### `tlsSocket.exportKeyingMaterial(length, label[, context])`
  <!-- YAML
- added: v0.11.4
-@@ -1241,9 +1184,6 @@ being issued by trusted CA (`options.ca`).
+ added: v12.17.0
+@@ -1274,9 +1217,6 @@ being issued by trusted CA (`options.ca`).
  <!-- YAML
  added: v0.11.3
  changes:
@@ -286,7 +284,7 @@ index 2eaaab5..61dc459 100644
    - version: v12.9.0
      pr-url: https://github.com/nodejs/node/pull/27836
      description: Support the `allowHalfOpen` option.
-@@ -1295,23 +1235,6 @@ changes:
+@@ -1328,23 +1268,6 @@ changes:
      verified against the list of supplied CAs. An `'error'` event is emitted if
      verification fails; `err.code` contains the OpenSSL error code. **Default:**
      `true`.
@@ -303,14 +301,14 @@ index 2eaaab5..61dc459 100644
 -    with optional identity `hint` provided by the server or `null`
 -    in case of TLS 1.3 where `hint` was removed.
 -    It will be necessary to provide a custom `tls.checkServerIdentity()`
--    for the connection as the default one will try to check hostname/IP
+-    for the connection as the default one will try to check host name/IP
 -    of the server against the certificate but that's not applicable for PSK
 -    because there won't be a certificate present.
 -    More information can be found in the [RFC 4279][].
    * `ALPNProtocols`: {string[]|Buffer[]|TypedArray[]|DataView[]|Buffer|
      TypedArray|DataView}
      An array of strings, `Buffer`s or `TypedArray`s or `DataView`s, or a
-@@ -1427,10 +1350,6 @@ changes:
+@@ -1460,10 +1383,6 @@ changes:
      pr-url: https://github.com/nodejs/node/pull/28973
      description: Added `privateKeyIdentifier` and `privateKeyEngine` options
                   to get private key from an OpenSSL engine.
@@ -321,7 +319,7 @@ index 2eaaab5..61dc459 100644
    - version: v12.0.0
      pr-url: https://github.com/nodejs/node/pull/26209
      description: TLSv1.3 support added.
-@@ -1491,12 +1410,6 @@ changes:
+@@ -1524,12 +1443,6 @@ changes:
      order as their private keys in `key`. If the intermediate certificates are
      not provided, the peer will not be able to validate the certificate, and the
      handshake will fail.
@@ -334,7 +332,7 @@ index 2eaaab5..61dc459 100644
    * `ciphers` {string} Cipher suite specification, replacing the default. For
      more information, see [modifying the default cipher suite][]. Permitted
      ciphers can be obtained via [`tls.getCiphers()`][]. Cipher names must be
-@@ -1647,30 +1560,8 @@ changes:
+@@ -1680,30 +1593,8 @@ changes:
      provided the default callback with high-level API will be used (see below).
    * `ticketKeys`: {Buffer} 48-bytes of cryptographically strong pseudo-random
      data. See [Session Resumption][] for more information.
@@ -366,17 +364,17 @@ index 2eaaab5..61dc459 100644
    * ...: Any [`net.createServer()`][] option can be provided.
  * `secureConnectionListener` {Function}
  * Returns: {tls.Server}
-@@ -1946,5 +1837,3 @@ where `secureSocket` has the same API as `pair.cleartext`.
+@@ -1980,5 +1871,3 @@ where `secureSocket` has the same API as `pair.cleartext`.
  [cipher list format]: https://www.openssl.org/docs/man1.1.1/man1/ciphers.html#CIPHER-LIST-FORMAT
  [modifying the default cipher suite]: #tls_modifying_the_default_tls_cipher_suite
  [specific attacks affecting larger AES key sizes]: https://www.schneier.com/blog/archives/2009/07/another_new_aes.html
 -[RFC 4279]: https://tools.ietf.org/html/rfc4279
 -[RFC 4086]: https://tools.ietf.org/html/rfc4086
 diff --git a/doc/node.1 b/doc/node.1
-index 675bfc9..ff31555 100644
+index be92e73..cfaa4d4 100644
 --- a/doc/node.1
 +++ b/doc/node.1
-@@ -330,11 +330,6 @@ Specify process.title on startup.
+@@ -345,11 +345,6 @@ Specify process.title on startup.
  Specify an alternative default TLS cipher list.
  Requires Node.js to be built with crypto support. (Default)
  .
@@ -389,7 +387,7 @@ index 675bfc9..ff31555 100644
  Set default  maxVersion to 'TLSv1.2'. Use to disable support for TLSv1.3.
  .
 diff --git a/lib/_http_agent.js b/lib/_http_agent.js
-index b3cd60b..d607a97 100644
+index 7fb4a49..084d6b1 100644
 --- a/lib/_http_agent.js
 +++ b/lib/_http_agent.js
 @@ -32,7 +32,7 @@ const net = require('net');
@@ -401,7 +399,7 @@ index b3cd60b..d607a97 100644
  // New Agent code.
  
  // The largest departure from the previous implementation is that
-@@ -125,28 +125,10 @@ function Agent(options) {
+@@ -136,28 +136,10 @@ function Agent(options) {
        }
      }
    });
@@ -430,7 +428,7 @@ index b3cd60b..d607a97 100644
  Agent.defaultMaxSockets = Infinity;
  
  Agent.prototype.createConnection = net.createConnection;
-@@ -320,10 +302,6 @@ function installListeners(agent, s, options) {
+@@ -351,10 +333,6 @@ function installListeners(agent, s, options) {
      s.removeListener('agentRemove', onRemove);
    }
    s.on('agentRemove', onRemove);
@@ -466,10 +464,10 @@ index 32e4a77..1e36b54 100644
    if (privateKeyIdentifier !== undefined) {
      if (privateKeyEngine === undefined) {
 diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
-index 0207d9b..0284fb4 100644
+index ff3deac..2ca8e6e 100644
 --- a/lib/_tls_wrap.js
 +++ b/lib/_tls_wrap.js
-@@ -49,12 +49,10 @@ const { TCP, constants: TCPConstants } = internalBinding('tcp_wrap');
+@@ -50,12 +50,10 @@ const { TCP, constants: TCPConstants } = internalBinding('tcp_wrap');
  const tls_wrap = internalBinding('tls_wrap');
  const { Pipe, constants: PipeConstants } = internalBinding('pipe_wrap');
  const { owner_symbol } = require('internal/async_hooks').symbols;
@@ -482,30 +480,36 @@ index 0207d9b..0284fb4 100644
    ERR_INVALID_CALLBACK,
    ERR_MULTIPLE_CALLBACK,
    ERR_SOCKET_CLOSED,
-@@ -66,12 +64,9 @@ const {
-   ERR_TLS_SESSION_ATTACK,
-   ERR_TLS_SNI_FROM_SERVER
+@@ -68,19 +66,15 @@ const {
+   ERR_TLS_SNI_FROM_SERVER,
+   ERR_TLS_INVALID_STATE
  } = codes;
 -const { onpskexchange: kOnPskExchange } = internalBinding('symbols');
- const { getOptionValue } = require('internal/options');
--const { validateString, validateBuffer } = require('internal/validators');
-+const { validateString } = require('internal/validators');
+ const {
+   getOptionValue,
+   getAllowUnauthorized,
+ } = require('internal/options');
+ const {
+   validateString,
+-  validateBuffer,
+   validateUint32
+ } = require('internal/validators');
  const traceTls = getOptionValue('--trace-tls');
 -const tlsKeylog = getOptionValue('--tls-keylog');
 -const { appendFile } = require('fs');
  const kConnectOptions = Symbol('connect-options');
  const kDisableRenegotiation = Symbol('disable-renegotiation');
  const kErrorEmitted = Symbol('error-emitted');
-@@ -79,8 +74,6 @@ const kHandshakeTimeout = Symbol('handshake-timeout');
+@@ -88,8 +82,6 @@ const kHandshakeTimeout = Symbol('handshake-timeout');
  const kRes = Symbol('res');
  const kSNICallback = Symbol('snicallback');
  const kEnableTrace = Symbol('enableTrace');
 -const kPskCallback = Symbol('pskcallback');
 -const kPskIdentityHint = Symbol('pskidentityhint');
+ const kPendingSession = Symbol('pendingSession');
+ const kIsVerified = Symbol('verified');
  
- const noop = () => {};
- 
-@@ -300,67 +293,6 @@ function onnewsession(sessionId, session) {
+@@ -315,67 +307,6 @@ function onnewsession(sessionId, session) {
      done();
  }
  
@@ -571,9 +575,9 @@ index 0207d9b..0284fb4 100644
 -  return { psk: ret.psk, identity: ret.identity };
 -}
  
- function onkeylogclient(line) {
-   debug('client onkeylog');
-@@ -636,8 +568,6 @@ TLSSocket.prototype._destroySSL = function _destroySSL() {
+ function onkeylog(line) {
+   debug('onkeylog');
+@@ -649,8 +580,6 @@ TLSSocket.prototype._destroySSL = function _destroySSL() {
  };
  
  // Constructor guts, arbitrarily factored out.
@@ -582,7 +586,7 @@ index 0207d9b..0284fb4 100644
  TLSSocket.prototype._init = function(socket, wrap) {
    const options = this._tlsOptions;
    const ssl = this._handle;
-@@ -721,24 +651,6 @@ TLSSocket.prototype._init = function(socket, wrap) {
+@@ -730,23 +659,6 @@ TLSSocket.prototype._init = function(socket, wrap) {
      }
    }
  
@@ -591,23 +595,22 @@ index 0207d9b..0284fb4 100644
 -      warnOnTlsKeylog = false;
 -      process.emitWarning('Using --tls-keylog makes TLS connections insecure ' +
 -        'by writing secret key material to file ' + tlsKeylog);
--      ssl.enableKeylogCallback();
--      this.on('keylog', (line) => {
--        appendFile(tlsKeylog, line, { mode: 0o600 }, (err) => {
--          if (err && warnOnTlsKeylogError) {
--            warnOnTlsKeylogError = false;
--            process.emitWarning('Failed to write TLS keylog (this warning ' +
--              'will not be repeated): ' + err);
--          }
--        });
--      });
 -    }
+-    this.on('keylog', (line) => {
+-      appendFile(tlsKeylog, line, { mode: 0o600 }, (err) => {
+-        if (err && warnOnTlsKeylogError) {
+-          warnOnTlsKeylogError = false;
+-          process.emitWarning('Failed to write TLS keylog (this warning ' +
+-            'will not be repeated): ' + err);
+-        }
+-      });
+-    });
 -  }
 -
    ssl.onerror = onerror;
  
    // If custom SNICallback was given, or if
-@@ -759,32 +671,6 @@ TLSSocket.prototype._init = function(socket, wrap) {
+@@ -767,32 +679,6 @@ TLSSocket.prototype._init = function(socket, wrap) {
      ssl.setALPNProtocols(ssl._secureContext.alpnBuffer);
    }
  
@@ -640,7 +643,7 @@ index 0207d9b..0284fb4 100644
    if (options.handshakeTimeout > 0)
      this.setTimeout(options.handshakeTimeout, this._handleTimeout);
  
-@@ -983,7 +869,6 @@ function makeSocketMethodProxy(name) {
+@@ -1003,7 +889,6 @@ function makeSocketMethodProxy(name) {
  
  [
    'getCipher',
@@ -648,7 +651,7 @@ index 0207d9b..0284fb4 100644
    'getEphemeralKeyInfo',
    'getFinished',
    'getPeerFinished',
-@@ -996,7 +881,7 @@ function makeSocketMethodProxy(name) {
+@@ -1016,7 +901,7 @@ function makeSocketMethodProxy(name) {
    TLSSocket.prototype[method] = makeSocketMethodProxy(method);
  });
  
@@ -657,7 +660,7 @@ index 0207d9b..0284fb4 100644
  
  
  function onServerSocketSecure() {
-@@ -1052,8 +937,6 @@ function tlsConnectionListener(rawSocket) {
+@@ -1077,8 +962,6 @@ function tlsConnectionListener(rawSocket) {
      SNICallback: this[kSNICallback] || SNICallback,
      enableTrace: this[kEnableTrace],
      pauseOnConnect: this.pauseOnConnect,
@@ -666,7 +669,7 @@ index 0207d9b..0284fb4 100644
    });
  
    socket.on('secure', onServerSocketSecure);
-@@ -1158,8 +1041,6 @@ function Server(options, listener) {
+@@ -1186,8 +1069,6 @@ function Server(options, listener) {
  
    this[kHandshakeTimeout] = options.handshakeTimeout || (120 * 1000);
    this[kSNICallback] = options.SNICallback;
@@ -675,7 +678,7 @@ index 0207d9b..0284fb4 100644
  
    if (typeof this[kHandshakeTimeout] !== 'number') {
      throw new ERR_INVALID_ARG_TYPE(
-@@ -1171,18 +1052,6 @@ function Server(options, listener) {
+@@ -1199,18 +1080,6 @@ function Server(options, listener) {
        'options.SNICallback', 'function', options.SNICallback);
    }
  
@@ -694,7 +697,7 @@ index 0207d9b..0284fb4 100644
    // constructor call
    net.Server.call(this, options, tlsConnectionListener);
  
-@@ -1255,8 +1124,6 @@ Server.prototype.setSecureContext = function(options) {
+@@ -1283,8 +1152,6 @@ Server.prototype.setSecureContext = function(options) {
    else
      this.crl = undefined;
  
@@ -703,7 +706,7 @@ index 0207d9b..0284fb4 100644
    if (options.ciphers)
      this.ciphers = options.ciphers;
    else
-@@ -1298,7 +1165,6 @@ Server.prototype.setSecureContext = function(options) {
+@@ -1326,7 +1193,6 @@ Server.prototype.setSecureContext = function(options) {
      clientCertEngine: this.clientCertEngine,
      ca: this.ca,
      ciphers: this.ciphers,
@@ -711,7 +714,7 @@ index 0207d9b..0284fb4 100644
      ecdhCurve: this.ecdhCurve,
      dhparam: this.dhparam,
      minVersion: this.minVersion,
-@@ -1379,8 +1245,6 @@ Server.prototype.setOptions = deprecate(function(options) {
+@@ -1407,8 +1273,6 @@ Server.prototype.setOptions = deprecate(function(options) {
                                    .digest('hex')
                                    .slice(0, 32);
    }
@@ -720,7 +723,7 @@ index 0207d9b..0284fb4 100644
  }, 'Server.prototype.setOptions() is deprecated', 'DEP0122');
  
  // SNI Contexts High-Level API
-@@ -1568,8 +1432,7 @@ exports.connect = function connect(...args) {
+@@ -1592,8 +1456,7 @@ exports.connect = function connect(...args) {
      session: options.session,
      ALPNProtocols: options.ALPNProtocols,
      requestOCSP: options.requestOCSP,
@@ -851,28 +854,18 @@ index 27930ce..1fd99f9 100644
  
  module.exports = {
 diff --git a/src/env.h b/src/env.h
-index 60b7c4b..5b1884b 100644
+index 5731afe..e28292d 100644
 --- a/src/env.h
 +++ b/src/env.h
-@@ -161,12 +161,11 @@ constexpr size_t kFsStatsBufferLength =
- 
- // Symbols are per-isolate primitives but Environment proxies them
- // for the sake of convenience.
--#define PER_ISOLATE_SYMBOL_PROPERTIES(V)                                       \
--  V(handle_onclose_symbol, "handle_onclose")                                   \
--  V(no_message_symbol, "no_message_symbol")                                    \
--  V(oninit_symbol, "oninit")                                                   \
--  V(owner_symbol, "owner")                                                     \
+@@ -168,7 +168,6 @@ constexpr size_t kFsStatsBufferLength =
+   V(no_message_symbol, "no_message_symbol")                                    \
+   V(oninit_symbol, "oninit")                                                   \
+   V(owner_symbol, "owner_symbol")                                              \
 -  V(onpskexchange_symbol, "onpskexchange")                                     \
-+#define PER_ISOLATE_SYMBOL_PROPERTIES(V)                                      \
-+  V(handle_onclose_symbol, "handle_onclose")                                  \
-+  V(no_message_symbol, "no_message_symbol")                                   \
-+  V(oninit_symbol, "oninit")                                                  \
-+  V(owner_symbol, "owner")                                                    \
- 
- // Strings are per-isolate primitives but Environment proxies them
- // for the sake of convenience.  Strings should be ASCII-only.
-@@ -325,7 +324,6 @@ constexpr size_t kFsStatsBufferLength =
+   V(resource_symbol, "resource_symbol")                                        \
+   V(trigger_async_id_symbol, "trigger_async_id_symbol")                        \
+ 
+@@ -330,7 +329,6 @@ constexpr size_t kFsStatsBufferLength =
    V(priority_string, "priority")                                               \
    V(process_string, "process")                                                 \
    V(promise_string, "promise")                                                 \
@@ -880,7 +873,7 @@ index 60b7c4b..5b1884b 100644
    V(pubkey_string, "pubkey")                                                   \
    V(query_string, "query")                                                     \
    V(raw_string, "raw")                                                         \
-@@ -353,7 +351,6 @@ constexpr size_t kFsStatsBufferLength =
+@@ -358,7 +356,6 @@ constexpr size_t kFsStatsBufferLength =
    V(sni_context_string, "sni_context")                                         \
    V(source_string, "source")                                                   \
    V(stack_string, "stack")                                                     \
@@ -889,10 +882,10 @@ index 60b7c4b..5b1884b 100644
    V(status_string, "status")                                                   \
    V(stdio_string, "stdio")                                                     \
 diff --git a/src/node_crypto.cc b/src/node_crypto.cc
-index 332b6f3..934c17c 100644
+index 34fb29d..8d09305 100644
 --- a/src/node_crypto.cc
 +++ b/src/node_crypto.cc
-@@ -737,7 +737,6 @@ void SecureContext::Initialize(Environment* env, Local<Object> target) {
+@@ -686,7 +686,6 @@ void SecureContext::Initialize(Environment* env, Local<Object> target) {
    env->SetProtoMethod(t, "addRootCerts", AddRootCerts);
    env->SetProtoMethod(t, "setCipherSuites", SetCipherSuites);
    env->SetProtoMethod(t, "setCiphers", SetCiphers);
@@ -900,7 +893,7 @@ index 332b6f3..934c17c 100644
    env->SetProtoMethod(t, "setECDHCurve", SetECDHCurve);
    env->SetProtoMethod(t, "setDHParam", SetDHParam);
    env->SetProtoMethod(t, "setMaxProto", SetMaxProto);
-@@ -1021,23 +1020,6 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
+@@ -983,23 +982,6 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
    }
  }
  
@@ -924,130 +917,33 @@ index 332b6f3..934c17c 100644
  
  #ifndef OPENSSL_NO_ENGINE
  // Helpers for the smart pointer.
-@@ -2080,7 +2062,6 @@ void SSLWrap<Base>::AddMethods(Environment* env, Local<FunctionTemplate> t) {
+@@ -2005,7 +1987,9 @@ void SSLWrap<Base>::AddMethods(Environment* env, Local<FunctionTemplate> t) {
    env->SetProtoMethodNoSideEffect(t, "isSessionReused", IsSessionReused);
    env->SetProtoMethodNoSideEffect(t, "verifyError", VerifyError);
    env->SetProtoMethodNoSideEffect(t, "getCipher", GetCipher);
--  env->SetProtoMethodNoSideEffect(t, "getSharedSigalgs", GetSharedSigalgs);
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   env->SetProtoMethodNoSideEffect(t, "getSharedSigalgs", GetSharedSigalgs);
++#endif
+   env->SetProtoMethodNoSideEffect(
+       t, "exportKeyingMaterial", ExportKeyingMaterial);
    env->SetProtoMethod(t, "endParser", EndParser);
-   env->SetProtoMethod(t, "certCbDone", CertCbDone);
-   env->SetProtoMethod(t, "renegotiate", Renegotiate);
-@@ -2987,16 +2968,6 @@ void SSLWrap<Base>::VerifyError(const FunctionCallbackInfo<Value>& args) {
-   if (X509* peer_cert = SSL_get_peer_certificate(w->ssl_.get())) {
-     X509_free(peer_cert);
-     x509_verify_error = SSL_get_verify_result(w->ssl_.get());
--  } else {
--    const SSL_CIPHER* curr_cipher = SSL_get_current_cipher(w->ssl_.get());
--    const SSL_SESSION* sess = SSL_get_session(w->ssl_.get());
--    // Allow no-cert for PSK authentication in TLS1.2 and lower.
--    // In TLS1.3 check that session was reused because TLS1.3 PSK
--    // looks like session resumption. Is there a better way?
--    if (SSL_CIPHER_get_auth_nid(curr_cipher) == NID_auth_psk ||
--        (SSL_SESSION_get_protocol_version(sess) == TLS1_3_VERSION &&
--         SSL_session_reused(w->ssl_.get())))
--      return args.GetReturnValue().SetNull();
-   }
- 
-   if (x509_verify_error == X509_V_OK)
-@@ -3062,9 +3033,6 @@ void SSLWrap<Base>::GetCipher(const FunctionCallbackInfo<Value>& args) {
-   const char* cipher_name = SSL_CIPHER_get_name(c);
-   info->Set(context, env->name_string(),
-             OneByteString(args.GetIsolate(), cipher_name)).Check();
--  const char* cipher_standard_name = SSL_CIPHER_standard_name(c);
--  info->Set(context, env->standard_name_string(),
--            OneByteString(args.GetIsolate(), cipher_standard_name)).Check();
-   const char* cipher_version = SSL_CIPHER_get_version(c);
-   info->Set(context, env->version_string(),
-             OneByteString(args.GetIsolate(), cipher_version)).Check();
-@@ -3073,87 +3041,6 @@ void SSLWrap<Base>::GetCipher(const FunctionCallbackInfo<Value>& args) {
+@@ -2447,6 +2431,7 @@ void SSLWrap<Base>::GetCipher(const FunctionCallbackInfo<Value>& args) {
+ }
  
  
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
  template <class Base>
--void SSLWrap<Base>::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
--  Base* w;
--  ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
--  Environment* env = w->ssl_env();
--
--  SSL* ssl = w->ssl_.get();
--  int nsig = SSL_get_shared_sigalgs(ssl, 0, nullptr, nullptr, nullptr, nullptr,
--                                    nullptr);
--  MaybeStackBuffer<Local<Value>, 16> ret_arr(nsig);
--
--  for (int i = 0; i < nsig; i++) {
--    int hash_nid;
--    int sign_nid;
--    std::string sig_with_md;
--
--    SSL_get_shared_sigalgs(ssl, i, &sign_nid, &hash_nid, nullptr, nullptr,
--                           nullptr);
--
--    switch (sign_nid) {
--      case EVP_PKEY_RSA:
--        sig_with_md = "RSA+";
--        break;
--
--      case EVP_PKEY_RSA_PSS:
--        sig_with_md = "RSA-PSS+";
--        break;
--
--      case EVP_PKEY_DSA:
--        sig_with_md = "DSA+";
--        break;
--
--      case EVP_PKEY_EC:
--        sig_with_md = "ECDSA+";
--        break;
--
--      case NID_ED25519:
--        sig_with_md = "Ed25519+";
--        break;
--
--      case NID_ED448:
--        sig_with_md = "Ed448+";
--        break;
--#ifndef OPENSSL_NO_GOST
--      case NID_id_GostR3410_2001:
--        sig_with_md = "gost2001+";
--        break;
--
--      case NID_id_GostR3410_2012_256:
--        sig_with_md = "gost2012_256+";
--        break;
--
--      case NID_id_GostR3410_2012_512:
--        sig_with_md = "gost2012_512+";
--        break;
--#endif  // !OPENSSL_NO_GOST
--      default:
--        const char* sn = OBJ_nid2sn(sign_nid);
--
--        if (sn != nullptr) {
--          sig_with_md = std::string(sn) + "+";
--        } else {
--          sig_with_md = "UNDEF+";
--        }
--        break;
--    }
--
--    const char* sn_hash = OBJ_nid2sn(hash_nid);
--    if (sn_hash != nullptr) {
--      sig_with_md += std::string(sn_hash);
--    } else {
--      sig_with_md += "UNDEF";
--    }
--    ret_arr[i] = OneByteString(env->isolate(), sig_with_md.c_str());
--  }
--
--  args.GetReturnValue().Set(
--                 Array::New(env->isolate(), ret_arr.out(), ret_arr.length()));
--}
--
--
--template <class Base>
- void SSLWrap<Base>::GetProtocol(const FunctionCallbackInfo<Value>& args) {
+ void SSLWrap<Base>::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
    Base* w;
-   ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
-@@ -5300,9 +5187,6 @@ void CheckThrow(Environment* env, SignBase::Error error) {
+@@ -2526,6 +2511,7 @@ void SSLWrap<Base>::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
+   args.GetReturnValue().Set(
+                  Array::New(env->isolate(), ret_arr.out(), ret_arr.length()));
+ }
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+ 
+ template <class Base>
+ void SSLWrap<Base>::ExportKeyingMaterial(
+@@ -4735,9 +4721,6 @@ void CheckThrow(Environment* env, SignBase::Error error) {
      case SignBase::Error::kSignNotInitialised:
        return env->ThrowError("Not initialised");
  
@@ -1057,7 +953,7 @@ index 332b6f3..934c17c 100644
      case SignBase::Error::kSignInit:
      case SignBase::Error::kSignUpdate:
      case SignBase::Error::kSignPrivateKey:
-@@ -5409,85 +5293,6 @@ static int GetDefaultSignPadding([[maybe_unused]] const ManagedEVPPKey& key) {
+@@ -4852,85 +4835,6 @@ static int GetDefaultSignPadding([[maybe_unused]] const ManagedEVPPKey& key) {
  #endif // OPENSSL_VERSION_NUMBER < 0x10100000L
  }
  
@@ -1143,7 +1039,7 @@ index 332b6f3..934c17c 100644
  
  static AllocatedBuffer Node_SignFinal(Environment* env,
                                        EVPMDPointer&& mdctx,
-@@ -5548,8 +5353,7 @@ static inline bool ValidateDSAParameters(EVP_PKEY* key) {
+@@ -4991,8 +4895,7 @@ static inline bool ValidateDSAParameters(EVP_PKEY* key) {
  Sign::SignResult Sign::SignFinal(
      const ManagedEVPPKey& pkey,
      int padding,
@@ -1153,7 +1049,7 @@ index 332b6f3..934c17c 100644
    if (!mdctx_)
      return SignResult(kSignNotInitialised);
  
-@@ -5561,10 +5365,6 @@ Sign::SignResult Sign::SignFinal(
+@@ -5004,10 +4907,6 @@ Sign::SignResult Sign::SignFinal(
    AllocatedBuffer buffer =
        Node_SignFinal(env(), std::move(mdctx), pkey, padding, salt_len);
    Error error = buffer.data() == nullptr ? kSignPrivateKey : kSignOk;
@@ -1164,7 +1060,7 @@ index 332b6f3..934c17c 100644
    return SignResult(error, std::move(buffer));
  }
  
-@@ -5592,15 +5392,10 @@ void Sign::SignFinal(const FunctionCallbackInfo<Value>& args) {
+@@ -5035,15 +4934,10 @@ void Sign::SignFinal(const FunctionCallbackInfo<Value>& args) {
      salt_len = Just<int>(args[offset + 1].As<Int32>()->Value());
    }
  
@@ -1181,7 +1077,7 @@ index 332b6f3..934c17c 100644
  
    if (ret.error != kSignOk)
      return sign->CheckThrow(ret.error);
-@@ -5644,10 +5439,6 @@ void SignOneShot(const FunctionCallbackInfo<Value>& args) {
+@@ -5087,10 +4981,6 @@ void SignOneShot(const FunctionCallbackInfo<Value>& args) {
      rsa_salt_len = Just<int>(args[offset + 3].As<Int32>()->Value());
    }
  
@@ -1192,7 +1088,7 @@ index 332b6f3..934c17c 100644
    EVP_PKEY_CTX* pkctx = nullptr;
    EVPMDPointer mdctx(EVP_MD_CTX_new());
    if (!mdctx ||
-@@ -5675,10 +5466,6 @@ void SignOneShot(const FunctionCallbackInfo<Value>& args) {
+@@ -5118,10 +5008,6 @@ void SignOneShot(const FunctionCallbackInfo<Value>& args) {
  
    signature.Resize(sig_len);
  
@@ -1203,25 +1099,15 @@ index 332b6f3..934c17c 100644
    args.GetReturnValue().Set(signature.ToBuffer().ToLocalChecked());
  }
  
-@@ -5784,17 +5571,6 @@ void Verify::VerifyFinal(const FunctionCallbackInfo<Value>& args) {
+@@ -5229,6 +5115,7 @@ void Verify::VerifyFinal(const FunctionCallbackInfo<Value>& args) {
      salt_len = Just<int>(args[offset + 2].As<Int32>()->Value());
    }
  
--  CHECK(args[offset + 3]->IsInt32());
--  DSASigEnc dsa_sig_enc =
--      static_cast<DSASigEnc>(args[offset + 3].As<Int32>()->Value());
--
--  ByteSource signature = ByteSource::Foreign(hbuf.data(), hbuf.length());
--  if (dsa_sig_enc == kSigEncP1363) {
--    signature = ConvertSignatureToDER(pkey, hbuf);
--    if (signature.get() == nullptr)
--      return verify->CheckThrow(Error::kSignMalformedSignature);
--  }
--
-   bool verify_result;
-   Error err = verify->VerifyFinal(pkey, hbuf.data(), hbuf.length(), padding,
-                                   salt_len, &verify_result);
-@@ -5838,10 +5614,6 @@ void VerifyOneShot(const FunctionCallbackInfo<Value>& args) {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   CHECK(args[offset + 3]->IsInt32());
+   DSASigEnc dsa_sig_enc =
+       static_cast<DSASigEnc>(args[offset + 3].As<Int32>()->Value());
+@@ -5286,10 +5173,6 @@ void VerifyOneShot(const FunctionCallbackInfo<Value>& args) {
      rsa_salt_len = Just<int>(args[offset + 4].As<Int32>()->Value());
    }
  
@@ -1232,7 +1118,7 @@ index 332b6f3..934c17c 100644
    EVP_PKEY_CTX* pkctx = nullptr;
    EVPMDPointer mdctx(EVP_MD_CTX_new());
    if (!mdctx ||
-@@ -5852,18 +5624,11 @@ void VerifyOneShot(const FunctionCallbackInfo<Value>& args) {
+@@ -5300,18 +5183,11 @@ void VerifyOneShot(const FunctionCallbackInfo<Value>& args) {
    if (!ApplyRSAOptions(key, pkctx, rsa_padding, rsa_salt_len))
      return CheckThrow(env, SignBase::Error::kSignPublicKey);
  
@@ -1253,7 +1139,7 @@ index 332b6f3..934c17c 100644
      reinterpret_cast<const unsigned char*>(data.data()),
      data.length());
    switch (r) {
-@@ -5887,8 +5652,6 @@ bool PublicKeyCipher::Cipher(Environment* env,
+@@ -5335,8 +5211,6 @@ bool PublicKeyCipher::Cipher(Environment* env,
                               const ManagedEVPPKey& pkey,
                               int padding,
                               const EVP_MD* digest,
@@ -1262,7 +1148,7 @@ index 332b6f3..934c17c 100644
                               const unsigned char* data,
                               int len,
                               AllocatedBuffer* out) {
-@@ -5905,17 +5668,6 @@ bool PublicKeyCipher::Cipher(Environment* env,
+@@ -5353,17 +5227,6 @@ bool PublicKeyCipher::Cipher(Environment* env,
        return false;
    }
  
@@ -1280,20 +1166,21 @@ index 332b6f3..934c17c 100644
  
    size_t out_len = 0;
    if (EVP_PKEY_cipher(ctx.get(), nullptr, &out_len, data, len) <= 0)
-@@ -5962,12 +5714,6 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+@@ -5411,11 +5274,13 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
        return THROW_ERR_OSSL_EVP_INVALID_DIGEST(env);
    }
  
--  ArrayBufferViewContents<unsigned char> oaep_label;
--  if (!args[offset + 3]->IsUndefined()) {
--    CHECK(args[offset + 3]->IsArrayBufferView());
--    oaep_label.Read(args[offset + 3].As<ArrayBufferView>());
--  }
--
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   ArrayBufferViewContents<unsigned char> oaep_label;
+   if (!args[offset + 3]->IsUndefined()) {
+     CHECK(args[offset + 3]->IsArrayBufferView());
+     oaep_label.Read(args[offset + 3].As<ArrayBufferView>());
+   }
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+ 
    AllocatedBuffer out;
  
-   ClearErrorOnReturn clear_error_on_return;
-@@ -5977,8 +5723,6 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
+@@ -5424,8 +5289,6 @@ void PublicKeyCipher::Cipher(const FunctionCallbackInfo<Value>& args) {
        pkey,
        padding,
        digest,
@@ -1302,20 +1189,22 @@ index 332b6f3..934c17c 100644
        buf.data(),
        buf.length(),
        &out);
-@@ -7709,8 +7453,6 @@ void Initialize(Local<Object> target,
+@@ -7363,8 +7226,10 @@ void Initialize(Local<Object> target,
    NODE_DEFINE_CONSTANT(target, kKeyTypeSecret);
    NODE_DEFINE_CONSTANT(target, kKeyTypePublic);
    NODE_DEFINE_CONSTANT(target, kKeyTypePrivate);
--  NODE_DEFINE_CONSTANT(target, kSigEncDER);
--  NODE_DEFINE_CONSTANT(target, kSigEncP1363);
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   NODE_DEFINE_CONSTANT(target, kSigEncDER);
+   NODE_DEFINE_CONSTANT(target, kSigEncP1363);
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+   env->SetMethodNoSideEffect(target, "statelessDH", StatelessDiffieHellman);
    env->SetMethod(target, "randomBytes", RandomBytes);
    env->SetMethod(target, "signOneShot", SignOneShot);
-   env->SetMethod(target, "verifyOneShot", VerifyOneShot);
 diff --git a/src/node_crypto.h b/src/node_crypto.h
-index 580ca6a..18ac9b5 100644
+index f61ad3d..54abc0b 100644
 --- a/src/node_crypto.h
 +++ b/src/node_crypto.h
-@@ -171,7 +171,6 @@ class SecureContext : public BaseObject {
+@@ -201,7 +201,6 @@ class SecureContext final : public BaseObject {
    static void AddRootCerts(const v8::FunctionCallbackInfo<v8::Value>& args);
    static void SetCipherSuites(const v8::FunctionCallbackInfo<v8::Value>& args);
    static void SetCiphers(const v8::FunctionCallbackInfo<v8::Value>& args);
@@ -1323,15 +1212,17 @@ index 580ca6a..18ac9b5 100644
    static void SetECDHCurve(const v8::FunctionCallbackInfo<v8::Value>& args);
    static void SetDHParam(const v8::FunctionCallbackInfo<v8::Value>& args);
    static void SetOptions(const v8::FunctionCallbackInfo<v8::Value>& args);
-@@ -304,7 +303,6 @@ class SSLWrap {
+@@ -324,7 +323,9 @@ class SSLWrap {
    static void IsSessionReused(const v8::FunctionCallbackInfo<v8::Value>& args);
    static void VerifyError(const v8::FunctionCallbackInfo<v8::Value>& args);
    static void GetCipher(const v8::FunctionCallbackInfo<v8::Value>& args);
--  static void GetSharedSigalgs(const v8::FunctionCallbackInfo<v8::Value>& args);
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   static void GetSharedSigalgs(const v8::FunctionCallbackInfo<v8::Value>& args);
++#endif
+   static void ExportKeyingMaterial(
+       const v8::FunctionCallbackInfo<v8::Value>& args);
    static void EndParser(const v8::FunctionCallbackInfo<v8::Value>& args);
-   static void CertCbDone(const v8::FunctionCallbackInfo<v8::Value>& args);
-   static void Renegotiate(const v8::FunctionCallbackInfo<v8::Value>& args);
-@@ -375,13 +373,6 @@ class ByteSource {
+@@ -396,13 +397,6 @@ class ByteSource {
    const char* get() const;
    size_t size() const;
  
@@ -1345,27 +1236,28 @@ index 580ca6a..18ac9b5 100644
    static ByteSource FromStringOrBuffer(Environment* env,
                                         v8::Local<v8::Value> value);
  
-@@ -406,6 +397,9 @@ class ByteSource {
+@@ -427,6 +421,7 @@ class ByteSource {
    size_t size_ = 0;
  
    ByteSource(const char* data, char* allocated_data, size_t size);
 +
-+  static ByteSource Allocated(char* data, size_t size);
-+  static ByteSource Foreign(const char* data, size_t size);
- };
- 
- enum PKEncodingType {
-@@ -681,8 +675,7 @@ class SignBase : public BaseObject {
+ public:
+   static ByteSource Allocated(char* data, size_t size);
+   static ByteSource Foreign(const char* data, size_t size);
+@@ -675,8 +670,10 @@ class SignBase : public BaseObject {
      kSignNotInitialised,
      kSignUpdate,
      kSignPrivateKey,
 -    kSignPublicKey,
 -    kSignMalformedSignature
 +    kSignPublicKey
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
++    , kSignMalformedSignature
++#endif
    } Error;
  
-   SignBase(Environment* env, v8::Local<v8::Object> wrap)
-@@ -703,10 +696,6 @@ class SignBase : public BaseObject {
+   SignBase(Environment* env, v8::Local<v8::Object> wrap);
+@@ -695,10 +692,6 @@ class SignBase : public BaseObject {
    EVPMDPointer mdctx_;
  };
  
@@ -1376,7 +1268,7 @@ index 580ca6a..18ac9b5 100644
  class Sign : public SignBase {
   public:
    static void Initialize(Environment* env, v8::Local<v8::Object> target);
-@@ -724,8 +713,7 @@ class Sign : public SignBase {
+@@ -716,8 +709,7 @@ class Sign : public SignBase {
    SignResult SignFinal(
        const ManagedEVPPKey& pkey,
        int padding,
@@ -1386,7 +1278,7 @@ index 580ca6a..18ac9b5 100644
  
   protected:
    static void New(const v8::FunctionCallbackInfo<v8::Value>& args);
-@@ -779,8 +767,6 @@ class PublicKeyCipher {
+@@ -766,8 +758,6 @@ class PublicKeyCipher {
                       const ManagedEVPPKey& pkey,
                       int padding,
                       const EVP_MD* digest,
@@ -1395,31 +1287,83 @@ index 580ca6a..18ac9b5 100644
                       const unsigned char* data,
                       int len,
                       AllocatedBuffer* out);
+diff --git a/src/node_crypto_common.cc b/src/node_crypto_common.cc
+index e33e52e..a1b8a20 100644
+--- a/src/node_crypto_common.cc
++++ b/src/node_crypto_common.cc
+@@ -216,6 +216,7 @@ long VerifyPeerCertificate(  // NOLINT(runtime/int)
+   if (X509* peer_cert = SSL_get_peer_certificate(ssl.get())) {
+     X509_free(peer_cert);
+     err = SSL_get_verify_result(ssl.get());
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   } else {
+     const SSL_CIPHER* curr_cipher = SSL_get_current_cipher(ssl.get());
+     const SSL_SESSION* sess = SSL_get_session(ssl.get());
+@@ -227,6 +228,7 @@ long VerifyPeerCertificate(  // NOLINT(runtime/int)
+          SSL_session_reused(ssl.get()))) {
+       return X509_V_OK;
+     }
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+   }
+   return err;
+ }
+@@ -407,12 +409,16 @@ MaybeLocal<Value> GetCipherName(
+ }
+ 
+ MaybeLocal<Value> GetCipherStandardName(
+-    Environment* env,
+-    const SSL_CIPHER* cipher) {
++    [[maybe_unused]] Environment* env,
++    [[maybe_unused]] const SSL_CIPHER* cipher) {
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+   if (cipher == nullptr)
+     return Undefined(env->isolate());
+ 
+   return OneByteString(env->isolate(), SSL_CIPHER_standard_name(cipher));
++#else // OPENSSL_VERSION_NUMBER >= 0x10100000L
++  return Undefined(env->isolate());
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+ }
+ 
+ MaybeLocal<Value> GetCipherVersion(
+@@ -832,10 +838,12 @@ MaybeLocal<Object> GetCipherInfo(Environment* env, const SSLPointer& ssl) {
+                   info,
+                   env->name_string(),
+                   GetCipherName(env, ssl)) ||
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+       !Set<Value>(env->context(),
+                   info,
+                   env->standard_name_string(),
+                   GetCipherStandardName(env, ssl)) ||
++#endif // OPENSSL_VERSION_NUMBER >= 0x10100000L
+       !Set<Value>(env->context(),
+                   info,
+                   env->version_string(),
 diff --git a/src/node_errors.h b/src/node_errors.h
-index 426b059..48ae915 100644
+index ad8c272..0afd537 100644
 --- a/src/node_errors.h
 +++ b/src/node_errors.h
-@@ -58,7 +58,6 @@ void PrintErrorString(const char* format, ...);
-   V(ERR_STRING_TOO_LONG, Error)                                              \
-   V(ERR_TLS_INVALID_PROTOCOL_METHOD, TypeError)                              \
-   V(ERR_TRANSFERRING_EXTERNALIZED_SHAREDARRAYBUFFER, TypeError)              \
--  V(ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED, Error)                              \
- 
- #define V(code, type)                                                         \
-   inline v8::Local<v8::Value> code(v8::Isolate* isolate,                      \
-@@ -102,7 +101,6 @@ void PrintErrorString(const char* format, ...);
-     "Script execution was interrupted by `SIGINT`")                          \
-   V(ERR_TRANSFERRING_EXTERNALIZED_SHAREDARRAYBUFFER,                         \
-     "Cannot serialize externalized SharedArrayBuffer")                       \
--  V(ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED, "Failed to set PSK identity hint")  \
- 
- #define V(code, message)                                                     \
-   inline v8::Local<v8::Value> code(v8::Isolate* isolate) {                   \
+@@ -52,7 +52,6 @@ void OnFatalError(const char* location, const char* message);
+   V(ERR_STRING_TOO_LONG, Error)                                                \
+   V(ERR_TLS_INVALID_PROTOCOL_METHOD, TypeError)                                \
+   V(ERR_TRANSFERRING_EXTERNALIZED_SHAREDARRAYBUFFER, TypeError)                \
+-  V(ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED, Error)                                \
+   V(ERR_VM_MODULE_CACHED_DATA_REJECTED, Error)                                 \
+   V(ERR_WASI_NOT_STARTED, Error)                                               \
+   V(ERR_WORKER_INIT_FAILED, Error)                                             \
+@@ -104,7 +103,6 @@ void OnFatalError(const char* location, const char* message);
+     "Script execution was interrupted by `SIGINT`")                            \
+   V(ERR_TRANSFERRING_EXTERNALIZED_SHAREDARRAYBUFFER,                           \
+     "Cannot serialize externalized SharedArrayBuffer")                         \
+-  V(ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED, "Failed to set PSK identity hint")    \
+   V(ERR_WASI_NOT_STARTED, "wasi.start() has not been called")                  \
+   V(ERR_WORKER_INIT_FAILED, "Worker initialization failure")                   \
+   V(ERR_PROTO_ACCESS,                                                          \
 diff --git a/src/node_options.cc b/src/node_options.cc
-index 4e473ca..710d794 100644
+index 17a7e34..821502a 100644
 --- a/src/node_options.cc
 +++ b/src/node_options.cc
-@@ -572,10 +572,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
+@@ -508,10 +508,6 @@ EnvironmentOptionsParser::EnvironmentOptionsParser() {
  
    AddOption("--napi-modules", "", NoOp{}, kAllowedInEnvironment);
  
@@ -1431,10 +1375,10 @@ index 4e473ca..710d794 100644
              "set default TLS minimum to TLSv1.0 (default: TLSv1.2)",
              &EnvironmentOptions::tls_min_v1_0,
 diff --git a/src/node_options.h b/src/node_options.h
-index 60daf36..0d9aa34 100644
+index be57770..dee7e82 100644
 --- a/src/node_options.h
 +++ b/src/node_options.h
-@@ -167,7 +167,6 @@ class EnvironmentOptions : public Options {
+@@ -165,7 +165,6 @@ class EnvironmentOptions : public Options {
    bool tls_min_v1_3 = false;
    bool tls_max_v1_2 = false;
    bool tls_max_v1_3 = false;
@@ -1443,7 +1387,7 @@ index 60daf36..0d9aa34 100644
    std::vector<std::string> preload_modules;
  
 diff --git a/src/tls_wrap.cc b/src/tls_wrap.cc
-index 75cfddd..b8a55c6 100644
+index 8fda8b9..7d2e43d 100644
 --- a/src/tls_wrap.cc
 +++ b/src/tls_wrap.cc
 @@ -28,7 +28,6 @@
@@ -1466,7 +1410,7 @@ index 75cfddd..b8a55c6 100644
  using v8::Object;
  using v8::ReadOnly;
  using v8::Signature;
-@@ -1076,131 +1072,6 @@ int TLSWrap::SelectSNIContextCallback(SSL* s, int* ad, void* arg) {
+@@ -1104,131 +1100,6 @@ int TLSWrap::SelectSNIContextCallback(SSL* s, int* ad, void* arg) {
    return SSL_TLSEXT_ERR_OK;
  }
  
@@ -1598,7 +1542,7 @@ index 75cfddd..b8a55c6 100644
  
  void TLSWrap::GetWriteQueueSize(const FunctionCallbackInfo<Value>& info) {
    TLSWrap* wrap;
-@@ -1266,11 +1137,6 @@ void TLSWrap::Initialize(Local<Object> target,
+@@ -1294,11 +1165,6 @@ void TLSWrap::Initialize(Local<Object> target,
    env->SetProtoMethod(t, "destroySSL", DestroySSL);
    env->SetProtoMethod(t, "enableCertCb", EnableCertCb);
  
@@ -1674,11 +1618,15 @@ index 47e681f..0000000
 -    }
 -  ]
 -}
+diff --git a/test/parallel/test-tls-enable-keylog-cli.js b/test/known_issues/test-tls-enable-keylog-cli.js
+similarity index 100%
+rename from test/parallel/test-tls-enable-keylog-cli.js
+rename to test/known_issues/test-tls-enable-keylog-cli.js
 diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
-index 30ef7ec..c773aae 100644
+index 9b8c3f6..247da16 100644
 --- a/test/parallel/test-crypto-rsa-dsa.js
 +++ b/test/parallel/test-crypto-rsa-dsa.js
-@@ -202,21 +202,59 @@ common.expectsError(() => {
+@@ -202,21 +202,59 @@ assert.throws(() => {
  // The following RSA-OAEP test cases were created using the WebCrypto API to
  // ensure compatibility when using non-SHA1 hash functions.
  {
@@ -1752,7 +1700,7 @@ index 30ef7ec..c773aae 100644
    }
 -
 -  for (const oaepLabel of [0, false, null, Symbol(), () => {}, {}, 'foo']) {
--    common.expectsError(() => {
+-    assert.throws(() => {
 -      fn({
 -        key: rsaPubPem,
 -        oaepLabel
@@ -1765,17 +1713,18 @@ index 30ef7ec..c773aae 100644
  
  // Test RSA key signing/verification
 diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
-index d98317a..b3861dd 100644
+index b70bfcc..d5eac77 100644
 --- a/test/parallel/test-crypto-sign-verify.js
 +++ b/test/parallel/test-crypto-sign-verify.js
-@@ -501,91 +501,21 @@ common.expectsError(
+@@ -501,45 +501,44 @@ assert.throws(
  });
  
  {
 +  const privKey = fixtures.readKey('ec-key.pem');
++  const length = 64;
    const data = Buffer.from('Hello world');
--  const keys = [['ec-key.pem', 64], ['dsa_private_1025.pem', 40]];
--
+   const keys = [['ec-key.pem', 64], ['dsa_private_1025.pem', 40]];
+ 
 -  for (const [file, length] of keys) {
 -    const privKey = fixtures.readKey(file);
 -    [
@@ -1792,84 +1741,60 @@ index d98317a..b3861dd 100644
 -      );
 -      assert.strictEqual(crypto.verify('sha1', data, privKey, sig), true);
 -    });
--
++  [
++    crypto.createSign('sha1').update(data).sign(privKey),
++    crypto.sign('sha1', data, privKey),
++    crypto.sign('sha1', data, { key: privKey, dsaEncoding: 'der' })
++  ].forEach((sig) => {
++    // Signature length variability due to DER encoding
++    assert(sig.length >= length + 4 && sig.length <= length + 8);
+ 
 -    // Test (EC)DSA signature conversion.
 -    const opts = { key: privKey, dsaEncoding: 'ieee-p1363' };
 -    let sig = crypto.sign('sha1', data, opts);
 -    // Unlike DER signatures, IEEE P1363 signatures have a predictable length.
 -    assert.strictEqual(sig.length, length);
 -    assert.strictEqual(crypto.verify('sha1', data, opts, sig), true);
--
+-    assert.strictEqual(crypto.createVerify('sha1')
+-                             .update(data)
+-                             .verify(opts, sig), true);
++    assert.strictEqual(
++      crypto.createVerify('sha1').update(data).verify(privKey, sig),
++      true
++    );
++    assert.strictEqual(crypto.verify('sha1', data, privKey, sig), true);
++  });
+ 
 -    // Test invalid signature lengths.
 -    for (const i of [-2, -1, 1, 2, 4, 8]) {
 -      sig = crypto.randomBytes(length + i);
--      common.expectsError(() => {
+-      assert.throws(() => {
 -        crypto.verify('sha1', data, opts, sig);
 -      }, {
 -        message: 'Malformed signature'
 -      });
 -    }
--  }
-+  [
-+    crypto.createSign('sha1').update(data).sign(privKey),
-+    crypto.sign('sha1', data, privKey)
-+  ].forEach((sig) => {
-+    // Signature length variability due to DER encoding
-+    assert.strictEqual(sig.length >= 68, true);
- 
--  // Test verifying externally signed messages.
--  const extSig = Buffer.from('494c18ab5c8a62a72aea5041966902bcfa229821af2bf65' +
--                             '0b5b4870d1fe6aebeaed9460c62210693b5b0a300033823' +
--                             '33d9529c8abd8c5948940af944828be16c', 'hex');
--  for (const ok of [true, false]) {
-     assert.strictEqual(
--      crypto.verify('sha256', data, {
--        key: fixtures.readKey('ec-key.pem'),
--        dsaEncoding: 'ieee-p1363'
--      }, extSig),
--      ok
-+      crypto.createVerify('sha1').update(data).verify(privKey, sig),
-+      true
-     );
--
--    extSig[Math.floor(Math.random() * extSig.length)] ^= 1;
--  }
--
--  // Non-(EC)DSA keys should ignore the option.
--  const sig = crypto.sign('sha1', data, {
--    key: keyPem,
--    dsaEncoding: 'ieee-p1363'
-+    assert.strictEqual(crypto.verify('sha1', data, privKey, sig), true);
-   });
--  assert.strictEqual(crypto.verify('sha1', data, certPem, sig), true);
--  assert.strictEqual(
--    crypto.verify('sha1', data, {
--      key: certPem,
--      dsaEncoding: 'ieee-p1363'
--    }, sig),
--    true
--  );
--  assert.strictEqual(
--    crypto.verify('sha1', data, {
--      key: certPem,
--      dsaEncoding: 'der'
--    }, sig),
--    true
--  );
--
--  for (const dsaEncoding of ['foo', null, {}, 5, true, NaN]) {
--    common.expectsError(() => {
--      crypto.sign('sha1', data, {
--        key: certPem,
--        dsaEncoding
--      });
--    }, {
--      code: 'ERR_INVALID_OPT_VALUE'
--    });
--  }
- }
- 
++  // Test (EC)DSA signature conversion.
++  const opts = { key: privKey, dsaEncoding: 'ieee-p1363' };
++  let sig = crypto.sign('sha1', data, opts);
++  // Unlike DER signatures, IEEE P1363 signatures have a predictable length.
++  assert.strictEqual(sig.length, length);
++  assert.strictEqual(crypto.verify('sha1', data, opts, sig), true);
++  assert.strictEqual(crypto.createVerify('sha1')
++    .update(data)
++    .verify(opts, sig), true);
++
++  // Test invalid signature lengths.
++  for (const i of [-2, -1, 1, 2, 4, 8]) {
++    sig = crypto.randomBytes(length + i);
++    assert.throws(() => {
++      crypto.verify('sha1', data, opts, sig);
++    }, {
++      message: 'Malformed signature'
++    });
+   }
  
+   // Test verifying externally signed messages.
 diff --git a/test/parallel/test-https-agent-keylog.js b/test/parallel/test-https-agent-keylog.js
 deleted file mode 100644
 index 2fc13cb..0000000
@@ -1920,69 +1845,6 @@ index 2fc13cb..0000000
 -};
 -server.on('keylog', common.mustCall(verifyKeylog, 10));
 -https.globalAgent.on('keylog', common.mustCall(verifyKeylog, 10));
-diff --git a/test/parallel/test-tls-enable-keylog-cli.js b/test/parallel/test-tls-enable-keylog-cli.js
-deleted file mode 100644
-index 5d05069..0000000
---- a/test/parallel/test-tls-enable-keylog-cli.js
-+++ /dev/null
-@@ -1,57 +0,0 @@
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto) common.skip('missing crypto');
--const fixtures = require('../common/fixtures');
--
--// Test --tls-keylog CLI flag.
--
--const assert = require('assert');
--const path = require('path');
--const fs = require('fs');
--const { fork } = require('child_process');
--
--if (process.argv[2] === 'test')
--  return test();
--
--const tmpdir = require('../common/tmpdir');
--tmpdir.refresh();
--const file = path.resolve(tmpdir.path, 'keylog.log');
--
--const child = fork(__filename, ['test'], {
--  execArgv: ['--tls-keylog=' + file]
--});
--
--child.on('close', common.mustCall((code, signal) => {
--  assert.strictEqual(code, 0);
--  assert.strictEqual(signal, null);
--  const log = fs.readFileSync(file, 'utf8');
--  assert(/SECRET/.test(log));
--}));
--
--function test() {
--  const {
--    connect, keys
--  } = require(fixtures.path('tls-connect'));
--
--  connect({
--    client: {
--      checkServerIdentity: (servername, cert) => { },
--      ca: `${keys.agent1.cert}\n${keys.agent6.ca}`,
--    },
--    server: {
--      cert: keys.agent6.cert,
--      key: keys.agent6.key
--    },
--  }, common.mustCall((err, pair, cleanup) => {
--    if (pair.server.err) {
--      console.trace('server', pair.server.err);
--    }
--    if (pair.client.err) {
--      console.trace('client', pair.client.err);
--    }
--    assert.ifError(pair.server.err);
--    assert.ifError(pair.client.err);
--
--    return cleanup();
--  }));
--}
 diff --git a/test/parallel/test-tls-getcipher.js b/test/parallel/test-tls-getcipher.js
 index 744276a..624f8ef 100644
 --- a/test/parallel/test-tls-getcipher.js
@@ -2185,89 +2047,6 @@ index 4864a66..0000000
 -    client.on('error', common.expectsError({ code: 'ECONNRESET' }));
 -  });
 -}
-diff --git a/test/parallel/test-tls-psk-server.js b/test/parallel/test-tls-psk-server.js
-deleted file mode 100644
-index 69b850c..0000000
---- a/test/parallel/test-tls-psk-server.js
-+++ /dev/null
-@@ -1,77 +0,0 @@
--'use strict';
--const common = require('../common');
--
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--if (!common.opensslCli)
--  common.skip('missing openssl cli');
--
--const assert = require('assert');
--
--const tls = require('tls');
--const spawn = require('child_process').spawn;
--
--const CIPHERS = 'PSK+HIGH';
--const KEY = 'd731ef57be09e5204f0b205b60627028';
--const IDENTITY = 'TestUser';
--
--const server = tls.createServer({
--  ciphers: CIPHERS,
--  pskIdentityHint: IDENTITY,
--  pskCallback(socket, identity) {
--    assert.ok(socket instanceof tls.TLSSocket);
--    assert.ok(typeof identity === 'string');
--    if (identity === IDENTITY)
--      return Buffer.from(KEY, 'hex');
--  }
--});
--
--server.on('connection', common.mustCall());
--
--server.on('secureConnection', (socket) => {
--  socket.write('hello\r\n');
--
--  socket.on('data', (data) => {
--    socket.write(data);
--  });
--});
--
--let gotHello = false;
--let sentWorld = false;
--let gotWorld = false;
--
--server.listen(0, () => {
--  const client = spawn(common.opensslCli, [
--    's_client',
--    '-connect', '127.0.0.1:' + server.address().port,
--    '-cipher', CIPHERS,
--    '-psk', KEY,
--    '-psk_identity', IDENTITY
--  ]);
--
--  let out = '';
--
--  client.stdout.setEncoding('utf8');
--  client.stdout.on('data', (d) => {
--    out += d;
--
--    if (!gotHello && /hello/.test(out)) {
--      gotHello = true;
--      client.stdin.write('world\r\n');
--      sentWorld = true;
--    }
--
--    if (!gotWorld && /world/.test(out)) {
--      gotWorld = true;
--      client.stdin.end();
--    }
--  });
--
--  client.on('exit', common.mustCall((code) => {
--    assert.ok(gotHello);
--    assert.ok(sentWorld);
--    assert.ok(gotWorld);
--    assert.strictEqual(code, 0);
--    server.close();
--  }));
--});
 diff --git a/test/parallel/test-tls-set-sigalgs.js b/test/parallel/test-tls-set-sigalgs.js
 deleted file mode 100644
 index 59dc2ca..0000000
@@ -2348,108 +2127,6 @@ index 59dc2ca..0000000
 -
 -test('RSA-PSS+SHA384:ECDSA+SHA256', 'ECDSA+SHA384:RSA-PSS+SHA256',
 -     undefined, 'ECONNRESET', 'ERR_SSL_NO_SHARED_SIGNATURE_ALGORITMS');
-diff --git a/test/sequential/test-tls-psk-client.js b/test/sequential/test-tls-psk-client.js
-deleted file mode 100644
-index 7c9fb93..0000000
---- a/test/sequential/test-tls-psk-client.js
-+++ /dev/null
-@@ -1,96 +0,0 @@
--'use strict';
--const common = require('../common');
--
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--if (!common.opensslCli)
--  common.skip('missing openssl cli');
--
--const assert = require('assert');
--const tls = require('tls');
--const net = require('net');
--const { spawn } = require('child_process');
--
--const CIPHERS = 'PSK+HIGH';
--const KEY = 'd731ef57be09e5204f0b205b60627028';
--const IDENTITY = 'Client_identity';  // Hardcoded by `openssl s_server`
--
--const server = spawn(common.opensslCli, [
--  's_server',
--  '-accept', common.PORT,
--  '-cipher', CIPHERS,
--  '-psk', KEY,
--  '-psk_hint', IDENTITY,
--  '-nocert',
--  '-rev',
--]);
--
--const cleanUp = (err) => {
--  clearTimeout(timeout);
--  if (err)
--    console.log('Failed:', err);
--  server.kill();
--  process.exitCode = err ? 1 : 0;
--};
--
--const timeout = setTimeout(() => cleanUp('Timeouted'), 5000);
--
--function waitForPort(port, cb) {
--  const socket = net.connect(common.PORT, () => {
--    socket.end();
--    socket.on('end', cb);
--  });
--  socket.on('error', (e) => {
--    if (e.code === 'ENOENT' || e.code === 'ECONNREFUSED') {
--      setTimeout(() => waitForPort(port, cb), 1000);
--    } else {
--      cb(e);
--    }
--  });
--}
--
--waitForPort(common.PORT, common.mustCall((err) => {
--  if (err) {
--    cleanUp(err);
--    return;
--  }
--
--  const message = 'hello';
--  const reverse = message.split('').reverse().join('');
--  runClient(message, common.mustCall((err, data) => {
--    try {
--      if (!err) assert.strictEqual(data.trim(), reverse);
--    } finally {
--      cleanUp(err);
--    }
--  }));
--}));
--
--function runClient(message, cb) {
--  const s = tls.connect(common.PORT, {
--    ciphers: CIPHERS,
--    checkServerIdentity: () => {},
--    pskCallback(hint) {
--      // 'hint' will be null in TLS1.3.
--      if (hint === null || hint === IDENTITY) {
--        return {
--          identity: IDENTITY,
--          psk: Buffer.from(KEY, 'hex')
--        };
--      }
--    }
--  });
--  s.on('secureConnect', common.mustCall(() => {
--    let data = '';
--    s.on('data', common.mustCallAtLeast((d) => {
--      data += d;
--    }));
--    s.on('end', common.mustCall(() => {
--      cb(null, data);
--    }));
--    s.end(message);
--  }));
--  s.on('error', (e) => {
--    cb(e);
--  });
--}
 -- 
-1.8.3.1
+2.26.2
 
diff --git a/SOURCES/0003-Adjust-tests-for-missing-OpenSSL-features.patch b/SOURCES/0003-Adjust-tests-for-missing-OpenSSL-features.patch
index 2732203..638d61b 100644
--- a/SOURCES/0003-Adjust-tests-for-missing-OpenSSL-features.patch
+++ b/SOURCES/0003-Adjust-tests-for-missing-OpenSSL-features.patch
@@ -1,93 +1,80 @@
-From b9a5922c36d77d1c6bb90fdc5225b5c838e5aa39 Mon Sep 17 00:00:00 2001
+From 1fc071f7df57c32f549fe12ca15bc603aa10eaad Mon Sep 17 00:00:00 2001
 From: Zuzana Svetlikova <zsvetlik@redhat.com>
 Date: Wed, 19 Feb 2020 10:31:43 +0000
-Subject: [PATCH 3/4] fix failing tests
+Subject: [PATCH] Adjust tests for missing OpenSSL features
 
+Signed-off-by: rpm-build <rpm-build>
 ---
- doc/api/cli.md                                     |   5 +-
- test/doctool/test-make-doc.js                      |  63 ------
- test/known_issues/test-crypto-aes-wrap.js          |  62 ++++++
- test/known_issues/test-crypto-des3-wrap.js         |  25 +++
- test/known_issues/test-crypto-hash-stream-pipe.js  |  46 ++++
- test/known_issues/test-make-doc.js                 |  63 ++++++
- test/known_issues/test-tls-cli-max-version-1.3.js  |  15 ++
- test/known_issues/test-tls-cli-min-max-conflict.js |  14 ++
- test/known_issues/test-tls-cli-min-version-1.3.js  |  15 ++
- .../test-tls-client-renegotiation-13.js            |  41 ++++
- test/known_issues/test-tls-keylog-tlsv13.js        |  32 +++
- test/known_issues/test-tls-no-sslv3.js             |  49 +++++
- test/known_issues/test-tls-ticket-12.js            |  12 +
- test/known_issues/test-tls-ticket-cluster.js       | 135 ++++++++++++
- test/known_issues/test-tls-ticket.js               | 159 ++++++++++++++
- test/known_issues/test-v8-serdes.js                | 244 +++++++++++++++++++++
- test/parallel/test-crypto-aes-wrap.js              |  62 ------
- test/parallel/test-crypto-authenticated.js         |  54 +----
- test/parallel/test-crypto-des3-wrap.js             |  25 ---
- test/parallel/test-crypto-hash-stream-pipe.js      |  46 ----
- test/parallel/test-crypto-hash.js                  |  81 -------
- test/parallel/test-crypto-key-objects.js           | 175 ---------------
- test/parallel/test-crypto-keygen.js                |  54 -----
- test/parallel/test-crypto-pbkdf2.js                |  18 --
- test/parallel/test-crypto-sign-verify.js           |   8 -
- test/parallel/test-crypto.js                       |   6 +-
- test/parallel/test-https-agent-session-eviction.js |  42 +++-
- test/parallel/test-tls-alert-handling.js           |   2 +-
- test/parallel/test-tls-cli-max-version-1.3.js      |  15 --
- test/parallel/test-tls-cli-min-max-conflict.js     |  14 --
- test/parallel/test-tls-cli-min-version-1.0.js      |   2 +-
- test/parallel/test-tls-cli-min-version-1.1.js      |   2 +-
- test/parallel/test-tls-cli-min-version-1.2.js      |   2 +-
- test/parallel/test-tls-cli-min-version-1.3.js      |  15 --
- .../test-tls-client-getephemeralkeyinfo.js         |   2 -
- test/parallel/test-tls-client-renegotiation-13.js  |  41 ----
- test/parallel/test-tls-destroy-stream.js           |   2 +-
- test/parallel/test-tls-getcipher.js                |  25 +--
- test/parallel/test-tls-keylog-tlsv13.js            |  32 ---
- test/parallel/test-tls-min-max-version.js          |  29 +--
- test/parallel/test-tls-multi-key.js                |   4 +-
- test/parallel/test-tls-multi-pfx.js                |   4 +-
- test/parallel/test-tls-no-sslv3.js                 |  49 -----
- test/parallel/test-tls-passphrase.js               |   2 +-
- test/parallel/test-tls-set-ciphers.js              |  27 +--
- test/parallel/test-tls-ticket-12.js                |  12 -
- test/parallel/test-tls-ticket-cluster.js           | 135 ------------
- test/parallel/test-tls-ticket.js                   | 159 --------------
- test/parallel/test-v8-serdes.js                    | 244 ---------------------
- 49 files changed, 973 insertions(+), 1397 deletions(-)
- delete mode 100644 test/doctool/test-make-doc.js
- create mode 100644 test/known_issues/test-crypto-aes-wrap.js
- create mode 100644 test/known_issues/test-crypto-des3-wrap.js
- create mode 100644 test/known_issues/test-crypto-hash-stream-pipe.js
- create mode 100644 test/known_issues/test-make-doc.js
- create mode 100644 test/known_issues/test-tls-cli-max-version-1.3.js
- create mode 100644 test/known_issues/test-tls-cli-min-max-conflict.js
- create mode 100644 test/known_issues/test-tls-cli-min-version-1.3.js
- create mode 100644 test/known_issues/test-tls-client-renegotiation-13.js
- create mode 100644 test/known_issues/test-tls-keylog-tlsv13.js
- create mode 100644 test/known_issues/test-tls-no-sslv3.js
- create mode 100644 test/known_issues/test-tls-ticket-12.js
- create mode 100644 test/known_issues/test-tls-ticket-cluster.js
- create mode 100644 test/known_issues/test-tls-ticket.js
- create mode 100644 test/known_issues/test-v8-serdes.js
- delete mode 100644 test/parallel/test-crypto-aes-wrap.js
- delete mode 100644 test/parallel/test-crypto-des3-wrap.js
- delete mode 100644 test/parallel/test-crypto-hash-stream-pipe.js
- delete mode 100644 test/parallel/test-tls-cli-max-version-1.3.js
- delete mode 100644 test/parallel/test-tls-cli-min-max-conflict.js
- delete mode 100644 test/parallel/test-tls-cli-min-version-1.3.js
- delete mode 100644 test/parallel/test-tls-client-renegotiation-13.js
- delete mode 100644 test/parallel/test-tls-keylog-tlsv13.js
- delete mode 100644 test/parallel/test-tls-no-sslv3.js
- delete mode 100644 test/parallel/test-tls-ticket-12.js
- delete mode 100644 test/parallel/test-tls-ticket-cluster.js
- delete mode 100644 test/parallel/test-tls-ticket.js
- delete mode 100644 test/parallel/test-v8-serdes.js
+ doc/api/cli.md                                |   5 +-
+ .../test-crypto-aes-wrap.js                   |   0
+ .../test-crypto-certificate.js                |   0
+ .../test-crypto-des3-wrap.js                  |   0
+ .../test-crypto-hash-stream-pipe.js           |   0
+ .../test-make-doc.js                          |   0
+ .../test-tls-cli-max-version-1.3.js           |   0
+ .../test-tls-cli-min-max-conflict.js          |   0
+ .../test-tls-cli-min-version-1.3.js           |   0
+ .../test-tls-client-renegotiation-13.js       |   0
+ .../test-tls-exportkeyingmaterial.js          |   0
+ .../test-tls-keylog-tlsv13.js                 |   0
+ .../test-tls-no-sslv3.js                      |   0
+ .../test-tls-psk-server.js                    |   0
+ .../test-tls-server-capture-rejection.js      |   0
+ .../test-tls-ticket-12.js                     |   0
+ .../test-tls-ticket-cluster.js                |   0
+ .../test-tls-ticket.js                        |   0
+ .../test-v8-serdes.js                         |   0
+ test/parallel/test-crypto-authenticated.js    |  54 +-----
+ test/parallel/test-crypto-dh-stateless.js     |  17 --
+ test/parallel/test-crypto-dh.js               |   6 +-
+ test/parallel/test-crypto-hash.js             |  81 --------
+ test/parallel/test-crypto-key-objects.js      | 175 ------------------
+ test/parallel/test-crypto-keygen.js           |  54 ------
+ test/parallel/test-crypto-pbkdf2.js           |  18 --
+ test/parallel/test-crypto-sign-verify.js      |  91 +--------
+ test/parallel/test-crypto.js                  |   6 +-
+ .../test-https-agent-create-connection.js     |   2 +-
+ .../test-https-agent-session-eviction.js      |  42 ++++-
+ .../test-https-agent-session-reuse.js         |   4 +-
+ test/parallel/test-tls-alert-handling.js      |   2 +-
+ test/parallel/test-tls-cli-min-version-1.0.js |   2 +-
+ test/parallel/test-tls-cli-min-version-1.1.js |   2 +-
+ test/parallel/test-tls-cli-min-version-1.2.js |   2 +-
+ .../test-tls-client-getephemeralkeyinfo.js    |   2 -
+ test/parallel/test-tls-destroy-stream.js      |   2 +-
+ test/parallel/test-tls-empty-sni-context.js   |   2 +-
+ test/parallel/test-tls-env-bad-extra-ca.js    |   2 +-
+ test/parallel/test-tls-getcipher.js           |  25 +--
+ test/parallel/test-tls-min-max-version.js     |  29 +--
+ test/parallel/test-tls-multi-key.js           |   4 +-
+ test/parallel/test-tls-multi-pfx.js           |   4 +-
+ test/parallel/test-tls-passphrase.js          |   2 +-
+ test/parallel/test-tls-set-ciphers.js         |  27 +--
+ 45 files changed, 70 insertions(+), 592 deletions(-)
+ rename test/{parallel => known_issues}/test-crypto-aes-wrap.js (100%)
+ rename test/{parallel => known_issues}/test-crypto-certificate.js (100%)
+ rename test/{parallel => known_issues}/test-crypto-des3-wrap.js (100%)
+ rename test/{parallel => known_issues}/test-crypto-hash-stream-pipe.js (100%)
+ rename test/{doctool => known_issues}/test-make-doc.js (100%)
+ rename test/{parallel => known_issues}/test-tls-cli-max-version-1.3.js (100%)
+ rename test/{parallel => known_issues}/test-tls-cli-min-max-conflict.js (100%)
+ rename test/{parallel => known_issues}/test-tls-cli-min-version-1.3.js (100%)
+ rename test/{parallel => known_issues}/test-tls-client-renegotiation-13.js (100%)
+ rename test/{parallel => known_issues}/test-tls-exportkeyingmaterial.js (100%)
+ rename test/{parallel => known_issues}/test-tls-keylog-tlsv13.js (100%)
+ rename test/{parallel => known_issues}/test-tls-no-sslv3.js (100%)
+ rename test/{parallel => known_issues}/test-tls-psk-server.js (100%)
+ rename test/{parallel => known_issues}/test-tls-server-capture-rejection.js (100%)
+ rename test/{parallel => known_issues}/test-tls-ticket-12.js (100%)
+ rename test/{parallel => known_issues}/test-tls-ticket-cluster.js (100%)
+ rename test/{parallel => known_issues}/test-tls-ticket.js (100%)
+ rename test/{parallel => known_issues}/test-v8-serdes.js (100%)
 
 diff --git a/doc/api/cli.md b/doc/api/cli.md
-index ecf7632..15124c5 100644
+index 2ea0732..91bef02 100644
 --- a/doc/api/cli.md
 +++ b/doc/api/cli.md
-@@ -711,8 +711,7 @@ with crypto support (default).
+@@ -758,8 +758,7 @@ with crypto support (default).
  added: v12.0.0
  -->
  
@@ -97,7 +84,7 @@ index ecf7632..15124c5 100644
  
  ### `--tls-min-v1.0`
  <!-- YAML
-@@ -1094,11 +1093,9 @@ Node.js options that are allowed are:
+@@ -1166,11 +1165,9 @@ Node.js options that are allowed are:
  * `--title`
  * `--tls-cipher-list`
  * `--tls-max-v1.2`
@@ -109,1141 +96,80 @@ index ecf7632..15124c5 100644
  * `--trace-deprecation`
  * `--trace-event-categories`
  * `--trace-event-file-pattern`
-diff --git a/test/doctool/test-make-doc.js b/test/doctool/test-make-doc.js
-deleted file mode 100644
-index 7f4f3ae..0000000
---- a/test/doctool/test-make-doc.js
-+++ /dev/null
-@@ -1,63 +0,0 @@
--'use strict';
--const common = require('../common');
--if (common.isWindows) {
--  common.skip('`make doc` does not run on Windows');
--}
--
--// This tests that `make doc` generates the documentation properly.
--// Note that for this test to pass, `make doc` must be run first.
--
--const assert = require('assert');
--const fs = require('fs');
--const path = require('path');
--
--const apiPath = path.resolve(__dirname, '..', '..', 'out', 'doc', 'api');
--const mdPath = path.resolve(__dirname, '..', '..', 'doc', 'api');
--const allMD = fs.readdirSync(mdPath);
--const allDocs = fs.readdirSync(apiPath);
--assert.ok(allDocs.includes('index.html'));
--
--const actualDocs = allDocs.filter(
--  (name) => {
--    const extension = path.extname(name);
--    return extension === '.html' || extension === '.json';
--  }
--);
--
--for (const name of actualDocs) {
--  if (name.startsWith('all.')) continue;
--
--  assert.ok(
--    allMD.includes(name.replace(/\.\w+$/, '.md')),
--    `Unexpected output: out/doc/api/${name}, remove and rerun.`
--  );
--}
--
--const toc = fs.readFileSync(path.resolve(apiPath, 'index.html'), 'utf8');
--const re = /href="([^/]+\.html)"/;
--const globalRe = new RegExp(re, 'g');
--const links = toc.match(globalRe);
--assert.notStrictEqual(links, null);
--
--// Filter out duplicate links, leave just filenames, add expected JSON files.
--const linkedHtmls = [...new Set(links)].map((link) => link.match(re)[1]);
--const expectedJsons = linkedHtmls
--                       .map((name) => name.replace('.html', '.json'));
--const expectedDocs = linkedHtmls.concat(expectedJsons);
--
--// Test that all the relative links in the TOC match to the actual documents.
--for (const expectedDoc of expectedDocs) {
--  assert.ok(actualDocs.includes(expectedDoc), `${expectedDoc} does not exist`);
--}
--
--// Test that all the actual documents match to the relative links in the TOC
--// and that they are not empty files.
--for (const actualDoc of actualDocs) {
--  assert.ok(
--    expectedDocs.includes(actualDoc), `${actualDoc} does not match TOC`);
--
--  assert.ok(
--    fs.statSync(path.join(apiPath, actualDoc)).size !== 0,
--    `${actualDoc} is empty`
--  );
--}
-diff --git a/test/known_issues/test-crypto-aes-wrap.js b/test/known_issues/test-crypto-aes-wrap.js
-new file mode 100644
-index 0000000..6fe3525
---- /dev/null
-+++ b/test/known_issues/test-crypto-aes-wrap.js
-@@ -0,0 +1,62 @@
-+'use strict';
-+const common = require('../common');
-+if (!common.hasCrypto)
-+  common.skip('missing crypto');
-+
-+const assert = require('assert');
-+const crypto = require('crypto');
-+
-+const test = [
-+  {
-+    algorithm: 'aes128-wrap',
-+    key: 'b26f309fbe57e9b3bb6ae5ef31d54450',
-+    iv: '3fd838af4093d749',
-+    text: '12345678123456781234567812345678'
-+  },
-+  {
-+    algorithm: 'id-aes128-wrap-pad',
-+    key: 'b26f309fbe57e9b3bb6ae5ef31d54450',
-+    iv: '3fd838af',
-+    text: '12345678123456781234567812345678123'
-+  },
-+  {
-+    algorithm: 'aes192-wrap',
-+    key: '40978085d68091f7dfca0d7dfc7a5ee76d2cc7f2f345a304',
-+    iv: '3fd838af4093d749',
-+    text: '12345678123456781234567812345678'
-+  },
-+  {
-+    algorithm: 'id-aes192-wrap-pad',
-+    key: '40978085d68091f7dfca0d7dfc7a5ee76d2cc7f2f345a304',
-+    iv: '3fd838af',
-+    text: '12345678123456781234567812345678123'
-+  },
-+  {
-+    algorithm: 'aes256-wrap',
-+    key: '29c9eab5ed5ad44134a1437fe2e673b4d88a5b7c72e68454fea08721392b7323',
-+    iv: '3fd838af4093d749',
-+    text: '12345678123456781234567812345678'
-+  },
-+  {
-+    algorithm: 'id-aes256-wrap-pad',
-+    key: '29c9eab5ed5ad44134a1437fe2e673b4d88a5b7c72e68454fea08721392b7323',
-+    iv: '3fd838af',
-+    text: '12345678123456781234567812345678123'
-+  },
-+];
-+
-+test.forEach((data) => {
-+  const cipher = crypto.createCipheriv(
-+    data.algorithm,
-+    Buffer.from(data.key, 'hex'),
-+    Buffer.from(data.iv, 'hex'));
-+  const ciphertext = cipher.update(data.text, 'utf8');
-+
-+  const decipher = crypto.createDecipheriv(
-+    data.algorithm,
-+    Buffer.from(data.key, 'hex'),
-+    Buffer.from(data.iv, 'hex'));
-+  const msg = decipher.update(ciphertext, 'buffer', 'utf8');
-+
-+  assert.strictEqual(msg, data.text, `${data.algorithm} test case failed`);
-+});
-diff --git a/test/known_issues/test-crypto-des3-wrap.js b/test/known_issues/test-crypto-des3-wrap.js
-new file mode 100644
-index 0000000..75c8cd5
---- /dev/null
-+++ b/test/known_issues/test-crypto-des3-wrap.js
-@@ -0,0 +1,25 @@
-+'use strict';
-+const common = require('../common');
-+if (!common.hasCrypto)
-+  common.skip('missing crypto');
-+
-+const assert = require('assert');
-+const crypto = require('crypto');
-+
-+// Test case for des-ede3 wrap/unwrap. des3-wrap needs extra 2x blocksize
-+// then plaintext to store ciphertext.
-+const test = {
-+  key: Buffer.from('3c08e25be22352910671cfe4ba3652b1220a8a7769b490ba', 'hex'),
-+  iv: Buffer.alloc(0),
-+  plaintext: '32|RmVZZkFUVmpRRkp0TmJaUm56ZU9qcnJkaXNNWVNpTTU*|iXmckfRWZBG' +
-+    'WWELweCBsThSsfUHLeRe0KCsK8ooHgxie0zOINpXxfZi/oNG7uq9JWFVCk70gfzQH8ZU' +
-+    'JjAfaFg**'
-+};
-+
-+const cipher = crypto.createCipheriv('des3-wrap', test.key, test.iv);
-+const ciphertext = cipher.update(test.plaintext, 'utf8');
-+
-+const decipher = crypto.createDecipheriv('des3-wrap', test.key, test.iv);
-+const msg = decipher.update(ciphertext, 'buffer', 'utf8');
-+
-+assert.strictEqual(msg, test.plaintext);
-diff --git a/test/known_issues/test-crypto-hash-stream-pipe.js b/test/known_issues/test-crypto-hash-stream-pipe.js
-new file mode 100644
-index 0000000..d22281a
---- /dev/null
-+++ b/test/known_issues/test-crypto-hash-stream-pipe.js
-@@ -0,0 +1,46 @@
-+// Copyright Joyent, Inc. and other Node contributors.
-+//
-+// Permission is hereby granted, free of charge, to any person obtaining a
-+// copy of this software and associated documentation files (the
-+// "Software"), to deal in the Software without restriction, including
-+// without limitation the rights to use, copy, modify, merge, publish,
-+// distribute, sublicense, and/or sell copies of the Software, and to permit
-+// persons to whom the Software is furnished to do so, subject to the
-+// following conditions:
-+//
-+// The above copyright notice and this permission notice shall be included
-+// in all copies or substantial portions of the Software.
-+//
-+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-+// USE OR OTHER DEALINGS IN THE SOFTWARE.
-+
-+'use strict';
-+const common = require('../common');
-+
-+if (!common.hasCrypto)
-+  common.skip('missing crypto');
-+
-+const assert = require('assert');
-+const crypto = require('crypto');
-+
-+const stream = require('stream');
-+const s = new stream.PassThrough();
-+const h = crypto.createHash('sha3-512');
-+const expect = '36a38a2a35e698974d4e5791a3f05b05' +
-+               '198235381e864f91a0e8cd6a26b677ec' +
-+               'dcde8e2b069bd7355fabd68abd6fc801' +
-+               '19659f25e92f8efc961ee3a7c815c758';
-+
-+s.pipe(h).on('data', common.mustCall(function(c) {
-+  assert.strictEqual(c, expect);
-+  // Calling digest() after piping into a stream with SHA3 should not cause
-+  // a segmentation fault, see https://github.com/nodejs/node/issues/28245.
-+  assert.strictEqual(h.digest('hex'), expect);
-+})).setEncoding('hex');
-+
-+s.end('aoeu');
-diff --git a/test/known_issues/test-make-doc.js b/test/known_issues/test-make-doc.js
-new file mode 100644
-index 0000000..7f4f3ae
---- /dev/null
-+++ b/test/known_issues/test-make-doc.js
-@@ -0,0 +1,63 @@
-+'use strict';
-+const common = require('../common');
-+if (common.isWindows) {
-+  common.skip('`make doc` does not run on Windows');
-+}
-+
-+// This tests that `make doc` generates the documentation properly.
-+// Note that for this test to pass, `make doc` must be run first.
-+
-+const assert = require('assert');
-+const fs = require('fs');
-+const path = require('path');
-+
-+const apiPath = path.resolve(__dirname, '..', '..', 'out', 'doc', 'api');
-+const mdPath = path.resolve(__dirname, '..', '..', 'doc', 'api');
-+const allMD = fs.readdirSync(mdPath);
-+const allDocs = fs.readdirSync(apiPath);
-+assert.ok(allDocs.includes('index.html'));
-+
-+const actualDocs = allDocs.filter(
-+  (name) => {
-+    const extension = path.extname(name);
-+    return extension === '.html' || extension === '.json';
-+  }
-+);
-+
-+for (const name of actualDocs) {
-+  if (name.startsWith('all.')) continue;
-+
-+  assert.ok(
-+    allMD.includes(name.replace(/\.\w+$/, '.md')),
-+    `Unexpected output: out/doc/api/${name}, remove and rerun.`
-+  );
-+}
-+
-+const toc = fs.readFileSync(path.resolve(apiPath, 'index.html'), 'utf8');
-+const re = /href="([^/]+\.html)"/;
-+const globalRe = new RegExp(re, 'g');
-+const links = toc.match(globalRe);
-+assert.notStrictEqual(links, null);
-+
-+// Filter out duplicate links, leave just filenames, add expected JSON files.
-+const linkedHtmls = [...new Set(links)].map((link) => link.match(re)[1]);
-+const expectedJsons = linkedHtmls
-+                       .map((name) => name.replace('.html', '.json'));
-+const expectedDocs = linkedHtmls.concat(expectedJsons);
-+
-+// Test that all the relative links in the TOC match to the actual documents.
-+for (const expectedDoc of expectedDocs) {
-+  assert.ok(actualDocs.includes(expectedDoc), `${expectedDoc} does not exist`);
-+}
-+
-+// Test that all the actual documents match to the relative links in the TOC
-+// and that they are not empty files.
-+for (const actualDoc of actualDocs) {
-+  assert.ok(
-+    expectedDocs.includes(actualDoc), `${actualDoc} does not match TOC`);
-+
-+  assert.ok(
-+    fs.statSync(path.join(apiPath, actualDoc)).size !== 0,
-+    `${actualDoc} is empty`
-+  );
-+}
-diff --git a/test/known_issues/test-tls-cli-max-version-1.3.js b/test/known_issues/test-tls-cli-max-version-1.3.js
-new file mode 100644
-index 0000000..c04354f
---- /dev/null
-+++ b/test/known_issues/test-tls-cli-max-version-1.3.js
-@@ -0,0 +1,15 @@
-+// Flags: --tls-max-v1.3
-+'use strict';
-+const common = require('../common');
-+if (!common.hasCrypto) common.skip('missing crypto');
-+
-+// Check that node `--tls-max-v1.3` is supported.
-+
-+const assert = require('assert');
-+const tls = require('tls');
-+
-+assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
-+assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.2');
-+
-+// Check the min-max version protocol versions against these CLI settings.
-+require('./test-tls-min-max-version.js');
-diff --git a/test/known_issues/test-tls-cli-min-max-conflict.js b/test/known_issues/test-tls-cli-min-max-conflict.js
-new file mode 100644
-index 0000000..68aae4c
---- /dev/null
-+++ b/test/known_issues/test-tls-cli-min-max-conflict.js
-@@ -0,0 +1,14 @@
-+'use strict';
-+const common = require('../common');
-+if (!common.hasCrypto) common.skip('missing crypto');
-+
-+// Check that conflicting TLS protocol versions are not allowed
-+
-+const assert = require('assert');
-+const child_process = require('child_process');
-+
-+const args = ['--tls-min-v1.3', '--tls-max-v1.2', '-p', 'process.version'];
-+child_process.execFile(process.argv[0], args, (err) => {
-+  assert(err);
-+  assert(/not both/.test(err.message));
-+});
-diff --git a/test/known_issues/test-tls-cli-min-version-1.3.js b/test/known_issues/test-tls-cli-min-version-1.3.js
-new file mode 100644
-index 0000000..1bccc2f
---- /dev/null
-+++ b/test/known_issues/test-tls-cli-min-version-1.3.js
-@@ -0,0 +1,15 @@
-+// Flags: --tls-min-v1.3
-+'use strict';
-+const common = require('../common');
-+if (!common.hasCrypto) common.skip('missing crypto');
-+
-+// Check that node `--tls-min-v1.3` is supported.
-+
-+const assert = require('assert');
-+const tls = require('tls');
-+
-+assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
-+assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.3');
-+
-+// Check the min-max version protocol versions against these CLI settings.
-+require('./test-tls-min-max-version.js');
-diff --git a/test/known_issues/test-tls-client-renegotiation-13.js b/test/known_issues/test-tls-client-renegotiation-13.js
-new file mode 100644
-index 0000000..075eb70
---- /dev/null
-+++ b/test/known_issues/test-tls-client-renegotiation-13.js
-@@ -0,0 +1,41 @@
-+'use strict';
-+
-+const common = require('../common');
-+const fixtures = require('../common/fixtures');
-+
-+// Confirm that for TLSv1.3, renegotiate() is disallowed.
-+
-+const {
-+  assert, connect, keys
-+} = require(fixtures.path('tls-connect'));
-+
-+const server = keys.agent10;
-+
-+connect({
-+  client: {
-+    ca: server.ca,
-+    checkServerIdentity: common.mustCall(),
-+  },
-+  server: {
-+    key: server.key,
-+    cert: server.cert,
-+  },
-+}, function(err, pair, cleanup) {
-+  assert.ifError(err);
-+
-+  const client = pair.client.conn;
-+
-+  assert.strictEqual(client.getProtocol(), 'TLSv1.3');
-+
-+  const ok = client.renegotiate({}, common.mustCall((err) => {
-+    assert.throws(() => { throw err; }, {
-+      message: 'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
-+      code: 'ERR_SSL_WRONG_SSL_VERSION',
-+      library: 'SSL routines',
-+      reason: 'wrong ssl version',
-+    });
-+    cleanup();
-+  }));
-+
-+  assert.strictEqual(ok, false);
-+});
-diff --git a/test/known_issues/test-tls-keylog-tlsv13.js b/test/known_issues/test-tls-keylog-tlsv13.js
-new file mode 100644
-index 0000000..0f65564
---- /dev/null
-+++ b/test/known_issues/test-tls-keylog-tlsv13.js
-@@ -0,0 +1,32 @@
-+'use strict';
-+
-+const common = require('../common');
-+if (!common.hasCrypto)
-+  common.skip('missing crypto');
-+
-+const assert = require('assert');
-+const tls = require('tls');
-+const fixtures = require('../common/fixtures');
-+
-+const server = tls.createServer({
-+  key: fixtures.readKey('agent2-key.pem'),
-+  cert: fixtures.readKey('agent2-cert.pem'),
-+  // Amount of keylog events depends on negotiated protocol
-+  // version, so force a specific one:
-+  minVersion: 'TLSv1.3',
-+  maxVersion: 'TLSv1.3',
-+}).listen(() => {
-+  const client = tls.connect({
-+    port: server.address().port,
-+    rejectUnauthorized: false,
-+  });
-+
-+  const verifyBuffer = (line) => assert(Buffer.isBuffer(line));
-+  server.on('keylog', common.mustCall(verifyBuffer, 5));
-+  client.on('keylog', common.mustCall(verifyBuffer, 5));
-+
-+  client.once('secureConnect', () => {
-+    server.close();
-+    client.end();
-+  });
-+});
-diff --git a/test/known_issues/test-tls-no-sslv3.js b/test/known_issues/test-tls-no-sslv3.js
-new file mode 100644
-index 0000000..1acb1f9
---- /dev/null
-+++ b/test/known_issues/test-tls-no-sslv3.js
-@@ -0,0 +1,49 @@
-+'use strict';
-+const common = require('../common');
-+if (!common.hasCrypto)
-+  common.skip('missing crypto');
-+
-+if (common.opensslCli === false)
-+  common.skip('node compiled without OpenSSL CLI.');
-+
-+const assert = require('assert');
-+const tls = require('tls');
-+const spawn = require('child_process').spawn;
-+const fixtures = require('../common/fixtures');
-+
-+const cert = fixtures.readKey('rsa_cert.crt');
-+const key = fixtures.readKey('rsa_private.pem');
-+const server = tls.createServer({ cert, key }, common.mustNotCall());
-+const errors = [];
-+let stderr = '';
-+
-+server.listen(0, '127.0.0.1', function() {
-+  const address = `${this.address().address}:${this.address().port}`;
-+  const args = ['s_client',
-+                '-ssl3',
-+                '-connect', address];
-+
-+  const client = spawn(common.opensslCli, args, { stdio: 'pipe' });
-+  client.stdout.pipe(process.stdout);
-+  client.stderr.pipe(process.stderr);
-+  client.stderr.setEncoding('utf8');
-+  client.stderr.on('data', (data) => stderr += data);
-+
-+  client.once('exit', common.mustCall(function(exitCode) {
-+    assert.strictEqual(exitCode, 1);
-+    server.close();
-+  }));
-+});
-+
-+server.on('tlsClientError', (err) => errors.push(err));
-+
-+process.on('exit', function() {
-+  if (/unknown option -ssl3/.test(stderr)) {
-+    common.printSkipMessage('`openssl s_client -ssl3` not supported.');
-+  } else {
-+    assert.strictEqual(errors.length, 1);
-+    // OpenSSL 1.0.x and 1.1.x report invalid client versions differently.
-+    assert(/:wrong version number/.test(errors[0].message) ||
-+           /:version too low/.test(errors[0].message));
-+  }
-+});
-diff --git a/test/known_issues/test-tls-ticket-12.js b/test/known_issues/test-tls-ticket-12.js
-new file mode 100644
-index 0000000..600c571
---- /dev/null
-+++ b/test/known_issues/test-tls-ticket-12.js
-@@ -0,0 +1,12 @@
-+'use strict';
-+const common = require('../common');
-+if (!common.hasCrypto)
-+  common.skip('missing crypto');
-+
-+// Run test-tls-ticket.js with TLS1.2
-+
-+const tls = require('tls');
-+
-+tls.DEFAULT_MAX_VERSION = 'TLSv1.2';
-+
-+require('./test-tls-ticket.js');
-diff --git a/test/known_issues/test-tls-ticket-cluster.js b/test/known_issues/test-tls-ticket-cluster.js
-new file mode 100644
-index 0000000..cc4f46e
---- /dev/null
-+++ b/test/known_issues/test-tls-ticket-cluster.js
-@@ -0,0 +1,135 @@
-+// Copyright Joyent, Inc. and other Node contributors.
-+//
-+// Permission is hereby granted, free of charge, to any person obtaining a
-+// copy of this software and associated documentation files (the
-+// "Software"), to deal in the Software without restriction, including
-+// without limitation the rights to use, copy, modify, merge, publish,
-+// distribute, sublicense, and/or sell copies of the Software, and to permit
-+// persons to whom the Software is furnished to do so, subject to the
-+// following conditions:
-+//
-+// The above copyright notice and this permission notice shall be included
-+// in all copies or substantial portions of the Software.
-+//
-+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-+// USE OR OTHER DEALINGS IN THE SOFTWARE.
-+
-+'use strict';
-+const common = require('../common');
-+if (!common.hasCrypto)
-+  common.skip('missing crypto');
-+
-+const assert = require('assert');
-+const tls = require('tls');
-+const cluster = require('cluster');
-+const fixtures = require('../common/fixtures');
-+
-+const workerCount = 4;
-+const expectedReqCount = 16;
-+
-+if (cluster.isMaster) {
-+  let reusedCount = 0;
-+  let reqCount = 0;
-+  let lastSession = null;
-+  let shootOnce = false;
-+  let workerPort = null;
-+
-+  function shoot() {
-+    console.error('[master] connecting', workerPort, 'session?', !!lastSession);
-+    const c = tls.connect(workerPort, {
-+      session: lastSession,
-+      rejectUnauthorized: false
-+    }, () => {
-+      c.end();
-+    }).on('close', () => {
-+      // Wait for close to shoot off another connection. We don't want to shoot
-+      // until a new session is allocated, if one will be. The new session is
-+      // not guaranteed on secureConnect (it depends on TLS1.2 vs TLS1.3), but
-+      // it is guaranteed to happen before the connection is closed.
-+      if (++reqCount === expectedReqCount) {
-+        Object.keys(cluster.workers).forEach(function(id) {
-+          cluster.workers[id].send('die');
-+        });
-+      } else {
-+        shoot();
-+      }
-+    }).once('session', (session) => {
-+      assert(!lastSession);
-+      lastSession = session;
-+    });
-+
-+    c.resume(); // See close_notify comment in server
-+  }
-+
-+  function fork() {
-+    const worker = cluster.fork();
-+    worker.on('message', ({ msg, port }) => {
-+      console.error('[master] got %j', msg);
-+      if (msg === 'reused') {
-+        ++reusedCount;
-+      } else if (msg === 'listening' && !shootOnce) {
-+        workerPort = port || workerPort;
-+        shootOnce = true;
-+        shoot();
-+      }
-+    });
-+
-+    worker.on('exit', () => {
-+      console.error('[master] worker died');
-+    });
-+  }
-+  for (let i = 0; i < workerCount; i++) {
-+    fork();
-+  }
-+
-+  process.on('exit', () => {
-+    assert.strictEqual(reqCount, expectedReqCount);
-+    assert.strictEqual(reusedCount + 1, reqCount);
-+  });
-+  return;
-+}
-+
-+const key = fixtures.readKey('rsa_private.pem');
-+const cert = fixtures.readKey('rsa_cert.crt');
-+
-+const options = { key, cert };
-+
-+const server = tls.createServer(options, (c) => {
-+  console.error('[worker] connection reused?', c.isSessionReused());
-+  if (c.isSessionReused()) {
-+    process.send({ msg: 'reused' });
-+  } else {
-+    process.send({ msg: 'not-reused' });
-+  }
-+  // Used to just .end(), but that means client gets close_notify before
-+  // NewSessionTicket. Send data until that problem is solved.
-+  c.end('x');
-+});
-+
-+server.listen(0, () => {
-+  const { port } = server.address();
-+  process.send({
-+    msg: 'listening',
-+    port,
-+  });
-+});
-+
-+process.on('message', function listener(msg) {
-+  console.error('[worker] got %j', msg);
-+  if (msg === 'die') {
-+    server.close(() => {
-+      console.error('[worker] server close');
-+
-+      process.exit();
-+    });
-+  }
-+});
-+
-+process.on('exit', () => {
-+  console.error('[worker] exit');
-+});
-diff --git a/test/known_issues/test-tls-ticket.js b/test/known_issues/test-tls-ticket.js
-new file mode 100644
-index 0000000..8d9cd8c
---- /dev/null
-+++ b/test/known_issues/test-tls-ticket.js
-@@ -0,0 +1,159 @@
-+// Copyright Joyent, Inc. and other Node contributors.
-+//
-+// Permission is hereby granted, free of charge, to any person obtaining a
-+// copy of this software and associated documentation files (the
-+// "Software"), to deal in the Software without restriction, including
-+// without limitation the rights to use, copy, modify, merge, publish,
-+// distribute, sublicense, and/or sell copies of the Software, and to permit
-+// persons to whom the Software is furnished to do so, subject to the
-+// following conditions:
-+//
-+// The above copyright notice and this permission notice shall be included
-+// in all copies or substantial portions of the Software.
-+//
-+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
-+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
-+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
-+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
-+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
-+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
-+// USE OR OTHER DEALINGS IN THE SOFTWARE.
-+
-+'use strict';
-+const common = require('../common');
-+if (!common.hasCrypto)
-+  common.skip('missing crypto');
-+
-+const assert = require('assert');
-+const tls = require('tls');
-+const net = require('net');
-+const crypto = require('crypto');
-+const fixtures = require('../common/fixtures');
-+
-+const keys = crypto.randomBytes(48);
-+const serverLog = [];
-+const ticketLog = [];
-+
-+let s;
-+
-+let serverCount = 0;
-+function createServer() {
-+  const id = serverCount++;
-+
-+  let counter = 0;
-+  let previousKey = null;
-+
-+  const server = tls.createServer({
-+    key: fixtures.readKey('agent1-key.pem'),
-+    cert: fixtures.readKey('agent1-cert.pem'),
-+    ticketKeys: keys
-+  }, function(c) {
-+    serverLog.push(id);
-+    // TODO(@sam-github) Triggers close_notify before NewSessionTicket bug.
-+    // c.end();
-+    c.end('x');
-+
-+    counter++;
-+
-+    // Rotate ticket keys
-+    //
-+    // Take especial care to account for TLS1.2 and TLS1.3 differences around
-+    // when ticket keys are encrypted. In TLS1.2, they are encrypted before the
-+    // handshake complete callback, but in TLS1.3, they are encrypted after.
-+    // There is no callback or way for us to know when they were sent, so hook
-+    // the client's reception of the keys, and use it as proof that the current
-+    // keys were used, and its safe to rotate them.
-+    //
-+    // Rotation can occur right away if the session was reused, the keys were
-+    // already decrypted or we wouldn't have a reused session.
-+    function setTicketKeys(keys) {
-+      if (c.isSessionReused())
-+        server.setTicketKeys(keys);
-+      else
-+        s.once('session', () => {
-+          server.setTicketKeys(keys);
-+        });
-+    }
-+    if (counter === 1) {
-+      previousKey = server.getTicketKeys();
-+      assert.strictEqual(previousKey.compare(keys), 0);
-+      setTicketKeys(crypto.randomBytes(48));
-+    } else if (counter === 2) {
-+      setTicketKeys(previousKey);
-+    } else if (counter === 3) {
-+      // Use keys from counter=2
-+    } else {
-+      throw new Error('UNREACHABLE');
-+    }
-+  });
-+
-+  return server;
-+}
-+
-+const naturalServers = [ createServer(), createServer(), createServer() ];
-+
-+// 3x servers
-+const servers = naturalServers.concat(naturalServers).concat(naturalServers);
-+
-+// Create one TCP server and balance sockets to multiple TLS server instances
-+const shared = net.createServer(function(c) {
-+  servers.shift().emit('connection', c);
-+}).listen(0, function() {
-+  start(function() {
-+    shared.close();
-+  });
-+});
-+
-+// 'session' events only occur for new sessions. The first connection is new.
-+// After, for each set of 3 connections, the middle connection is made when the
-+// server has random keys set, so the client's ticket is silently ignored, and a
-+// new ticket is sent.
-+const onNewSession = common.mustCall((s, session) => {
-+  assert(session);
-+  assert.strictEqual(session.compare(s.getSession()), 0);
-+}, 4);
-+
-+function start(callback) {
-+  let sess = null;
-+  let left = servers.length;
-+
-+  function connect() {
-+    s = tls.connect(shared.address().port, {
-+      session: sess,
-+      rejectUnauthorized: false
-+    }, function() {
-+      if (s.isSessionReused())
-+        ticketLog.push(s.getTLSTicket().toString('hex'));
-+    });
-+    s.on('data', () => {
-+      s.end();
-+    });
-+    s.on('close', function() {
-+      if (--left === 0)
-+        callback();
-+      else
-+        connect();
-+    });
-+    s.on('session', (session) => {
-+      sess = sess || session;
-+    });
-+    s.once('session', (session) => onNewSession(s, session));
-+    s.once('session', () => ticketLog.push(s.getTLSTicket().toString('hex')));
-+  }
-+
-+  connect();
-+}
-+
-+process.on('exit', function() {
-+  assert.strictEqual(ticketLog.length, serverLog.length);
-+  for (let i = 0; i < naturalServers.length - 1; i++) {
-+    assert.notStrictEqual(serverLog[i], serverLog[i + 1]);
-+    assert.strictEqual(ticketLog[i], ticketLog[i + 1]);
-+
-+    // 2nd connection should have different ticket
-+    assert.notStrictEqual(ticketLog[i], ticketLog[i + naturalServers.length]);
-+
-+    // 3rd connection should have the same ticket
-+    assert.strictEqual(ticketLog[i], ticketLog[i + naturalServers.length * 2]);
-+  }
-+});
-diff --git a/test/known_issues/test-v8-serdes.js b/test/known_issues/test-v8-serdes.js
-new file mode 100644
-index 0000000..a992ba4
---- /dev/null
-+++ b/test/known_issues/test-v8-serdes.js
-@@ -0,0 +1,244 @@
-+// Flags: --expose-internals
-+
-+'use strict';
-+
-+const common = require('../common');
-+const fixtures = require('../common/fixtures');
-+const { internalBinding } = require('internal/test/binding');
-+const assert = require('assert');
-+const v8 = require('v8');
-+const os = require('os');
-+
-+const circular = {};
-+circular.circular = circular;
-+
-+const wasmModule = new WebAssembly.Module(fixtures.readSync('simple.wasm'));
-+
-+const objects = [
-+  { foo: 'bar' },
-+  { bar: 'baz' },
-+  new Uint8Array([1, 2, 3, 4]),
-+  new Uint32Array([1, 2, 3, 4]),
-+  Buffer.from([1, 2, 3, 4]),
-+  undefined,
-+  null,
-+  42,
-+  circular,
-+  wasmModule
-+];
-+
-+const hostObject = new (internalBinding('js_stream').JSStream)();
-+
-+const serializerTypeError =
-+  /^TypeError: Class constructor Serializer cannot be invoked without 'new'$/;
-+const deserializerTypeError =
-+  /^TypeError: Class constructor Deserializer cannot be invoked without 'new'$/;
-+
-+{
-+  const ser = new v8.DefaultSerializer();
-+  ser.writeHeader();
-+  for (const obj of objects) {
-+    ser.writeValue(obj);
-+  }
-+
-+  const des = new v8.DefaultDeserializer(ser.releaseBuffer());
-+  des.readHeader();
-+
-+  for (const obj of objects) {
-+    assert.deepStrictEqual(des.readValue(), obj);
-+  }
-+}
-+
-+{
-+  for (const obj of objects) {
-+    assert.deepStrictEqual(v8.deserialize(v8.serialize(obj)), obj);
-+  }
-+}
-+
-+{
-+  const ser = new v8.DefaultSerializer();
-+  ser._getDataCloneError = common.mustCall((message) => {
-+    assert.strictEqual(message, '[object Object] could not be cloned.');
-+    return new Error('foobar');
-+  });
-+
-+  ser.writeHeader();
-+
-+  assert.throws(() => {
-+    ser.writeValue(new Proxy({}, {}));
-+  }, /foobar/);
-+}
-+
-+{
-+  const ser = new v8.DefaultSerializer();
-+  ser._writeHostObject = common.mustCall((object) => {
-+    assert.strictEqual(object, hostObject);
-+    const buf = Buffer.from('hostObjectTag');
-+
-+    ser.writeUint32(buf.length);
-+    ser.writeRawBytes(buf);
-+
-+    ser.writeUint64(1, 2);
-+    ser.writeDouble(-0.25);
-+  });
-+
-+  ser.writeHeader();
-+  ser.writeValue({ val: hostObject });
-+
-+  const des = new v8.DefaultDeserializer(ser.releaseBuffer());
-+  des._readHostObject = common.mustCall(() => {
-+    const length = des.readUint32();
-+    const buf = des.readRawBytes(length);
-+
-+    assert.strictEqual(buf.toString(), 'hostObjectTag');
-+
-+    assert.deepStrictEqual(des.readUint64(), [1, 2]);
-+    assert.strictEqual(des.readDouble(), -0.25);
-+    return hostObject;
-+  });
-+
-+  des.readHeader();
-+
-+  assert.strictEqual(des.readValue().val, hostObject);
-+}
-+
-+// This test ensures that `v8.Serializer.writeRawBytes()` support
-+// `TypedArray` and `DataView`.
-+{
-+  const text = 'hostObjectTag';
-+  const data = Buffer.from(text);
-+  const arrayBufferViews = common.getArrayBufferViews(data);
-+
-+  // `buf` is one of `TypedArray` or `DataView`.
-+  function testWriteRawBytes(buf) {
-+    let writeHostObjectCalled = false;
-+    const ser = new v8.DefaultSerializer();
-+
-+    ser._writeHostObject = common.mustCall((object) => {
-+      writeHostObjectCalled = true;
-+      ser.writeUint32(buf.byteLength);
-+      ser.writeRawBytes(buf);
-+    });
-+
-+    ser.writeHeader();
-+    ser.writeValue({ val: hostObject });
-+
-+    const des = new v8.DefaultDeserializer(ser.releaseBuffer());
-+    des._readHostObject = common.mustCall(() => {
-+      assert.strictEqual(writeHostObjectCalled, true);
-+      const length = des.readUint32();
-+      const buf = des.readRawBytes(length);
-+      assert.strictEqual(buf.toString(), text);
-+
-+      return hostObject;
-+    });
-+
-+    des.readHeader();
-+
-+    assert.strictEqual(des.readValue().val, hostObject);
-+  }
-+
-+  arrayBufferViews.forEach((buf) => {
-+    testWriteRawBytes(buf);
-+  });
-+}
-+
-+{
-+  const ser = new v8.DefaultSerializer();
-+  ser._writeHostObject = common.mustCall((object) => {
-+    throw new Error('foobar');
-+  });
-+
-+  ser.writeHeader();
-+  assert.throws(() => {
-+    ser.writeValue({ val: hostObject });
-+  }, /foobar/);
-+}
-+
-+{
-+  assert.throws(() => v8.serialize(hostObject), {
-+    constructor: Error,
-+    message: 'Unserializable host object: JSStream {}'
-+  });
-+}
-+
-+{
-+  const buf = Buffer.from('ff0d6f2203666f6f5e007b01', 'hex');
-+
-+  const des = new v8.DefaultDeserializer(buf);
-+  des.readHeader();
-+
-+  const ser = new v8.DefaultSerializer();
-+  ser.writeHeader();
-+
-+  ser.writeValue(des.readValue());
-+
-+  assert.deepStrictEqual(buf, ser.releaseBuffer());
-+  assert.strictEqual(des.getWireFormatVersion(), 0x0d);
-+}
-+
-+{
-+  // Unaligned Uint16Array read, with padding in the underlying array buffer.
-+  let buf = Buffer.alloc(32 + 9);
-+  buf.write('ff0d5c0404addeefbe', 32, 'hex');
-+  buf = buf.slice(32);
-+
-+  const expectedResult = os.endianness() === 'LE' ?
-+    new Uint16Array([0xdead, 0xbeef]) : new Uint16Array([0xadde, 0xefbe]);
-+
-+  assert.deepStrictEqual(v8.deserialize(buf), expectedResult);
-+}
-+
-+{
-+  assert.throws(v8.Serializer, serializerTypeError);
-+  assert.throws(v8.Deserializer, deserializerTypeError);
-+}
-+
-+
-+// `v8.deserialize()` and `new v8.Deserializer()` should support both
-+// `TypedArray` and `DataView`.
-+{
-+  for (const obj of objects) {
-+    const buf = v8.serialize(obj);
-+
-+    for (const arrayBufferView of common.getArrayBufferViews(buf)) {
-+      assert.deepStrictEqual(v8.deserialize(arrayBufferView), obj);
-+    }
-+
-+    for (const arrayBufferView of common.getArrayBufferViews(buf)) {
-+      const deserializer = new v8.DefaultDeserializer(arrayBufferView);
-+      deserializer.readHeader();
-+      const value = deserializer.readValue();
-+      assert.deepStrictEqual(value, obj);
-+
-+      const serializer = new v8.DefaultSerializer();
-+      serializer.writeHeader();
-+      serializer.writeValue(value);
-+      assert.deepStrictEqual(buf, serializer.releaseBuffer());
-+    }
-+  }
-+}
-+
-+{
-+  const INVALID_SOURCE = 'INVALID_SOURCE_TYPE';
-+  const serializer = new v8.Serializer();
-+  serializer.writeHeader();
-+  assert.throws(
-+    () => serializer.writeRawBytes(INVALID_SOURCE),
-+    /^TypeError: source must be a TypedArray or a DataView$/,
-+  );
-+  assert.throws(
-+    () => v8.deserialize(INVALID_SOURCE),
-+    /^TypeError: buffer must be a TypedArray or a DataView$/,
-+  );
-+  assert.throws(
-+    () => new v8.Deserializer(INVALID_SOURCE),
-+    /^TypeError: buffer must be a TypedArray or a DataView$/,
-+  );
-+}
-+
-+{
-+  const deserializedWasmModule = v8.deserialize(v8.serialize(wasmModule));
-+  const instance = new WebAssembly.Instance(deserializedWasmModule);
-+  assert.strictEqual(instance.exports.add(10, 20), 30);
-+}
-diff --git a/test/parallel/test-crypto-aes-wrap.js b/test/parallel/test-crypto-aes-wrap.js
-deleted file mode 100644
-index 6fe3525..0000000
---- a/test/parallel/test-crypto-aes-wrap.js
-+++ /dev/null
-@@ -1,62 +0,0 @@
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--
--const assert = require('assert');
--const crypto = require('crypto');
--
--const test = [
--  {
--    algorithm: 'aes128-wrap',
--    key: 'b26f309fbe57e9b3bb6ae5ef31d54450',
--    iv: '3fd838af4093d749',
--    text: '12345678123456781234567812345678'
--  },
--  {
--    algorithm: 'id-aes128-wrap-pad',
--    key: 'b26f309fbe57e9b3bb6ae5ef31d54450',
--    iv: '3fd838af',
--    text: '12345678123456781234567812345678123'
--  },
--  {
--    algorithm: 'aes192-wrap',
--    key: '40978085d68091f7dfca0d7dfc7a5ee76d2cc7f2f345a304',
--    iv: '3fd838af4093d749',
--    text: '12345678123456781234567812345678'
--  },
--  {
--    algorithm: 'id-aes192-wrap-pad',
--    key: '40978085d68091f7dfca0d7dfc7a5ee76d2cc7f2f345a304',
--    iv: '3fd838af',
--    text: '12345678123456781234567812345678123'
--  },
--  {
--    algorithm: 'aes256-wrap',
--    key: '29c9eab5ed5ad44134a1437fe2e673b4d88a5b7c72e68454fea08721392b7323',
--    iv: '3fd838af4093d749',
--    text: '12345678123456781234567812345678'
--  },
--  {
--    algorithm: 'id-aes256-wrap-pad',
--    key: '29c9eab5ed5ad44134a1437fe2e673b4d88a5b7c72e68454fea08721392b7323',
--    iv: '3fd838af',
--    text: '12345678123456781234567812345678123'
--  },
--];
--
--test.forEach((data) => {
--  const cipher = crypto.createCipheriv(
--    data.algorithm,
--    Buffer.from(data.key, 'hex'),
--    Buffer.from(data.iv, 'hex'));
--  const ciphertext = cipher.update(data.text, 'utf8');
--
--  const decipher = crypto.createDecipheriv(
--    data.algorithm,
--    Buffer.from(data.key, 'hex'),
--    Buffer.from(data.iv, 'hex'));
--  const msg = decipher.update(ciphertext, 'buffer', 'utf8');
--
--  assert.strictEqual(msg, data.text, `${data.algorithm} test case failed`);
--});
+diff --git a/test/parallel/test-crypto-aes-wrap.js b/test/known_issues/test-crypto-aes-wrap.js
+similarity index 100%
+rename from test/parallel/test-crypto-aes-wrap.js
+rename to test/known_issues/test-crypto-aes-wrap.js
+diff --git a/test/parallel/test-crypto-certificate.js b/test/known_issues/test-crypto-certificate.js
+similarity index 100%
+rename from test/parallel/test-crypto-certificate.js
+rename to test/known_issues/test-crypto-certificate.js
+diff --git a/test/parallel/test-crypto-des3-wrap.js b/test/known_issues/test-crypto-des3-wrap.js
+similarity index 100%
+rename from test/parallel/test-crypto-des3-wrap.js
+rename to test/known_issues/test-crypto-des3-wrap.js
+diff --git a/test/parallel/test-crypto-hash-stream-pipe.js b/test/known_issues/test-crypto-hash-stream-pipe.js
+similarity index 100%
+rename from test/parallel/test-crypto-hash-stream-pipe.js
+rename to test/known_issues/test-crypto-hash-stream-pipe.js
+diff --git a/test/doctool/test-make-doc.js b/test/known_issues/test-make-doc.js
+similarity index 100%
+rename from test/doctool/test-make-doc.js
+rename to test/known_issues/test-make-doc.js
+diff --git a/test/parallel/test-tls-cli-max-version-1.3.js b/test/known_issues/test-tls-cli-max-version-1.3.js
+similarity index 100%
+rename from test/parallel/test-tls-cli-max-version-1.3.js
+rename to test/known_issues/test-tls-cli-max-version-1.3.js
+diff --git a/test/parallel/test-tls-cli-min-max-conflict.js b/test/known_issues/test-tls-cli-min-max-conflict.js
+similarity index 100%
+rename from test/parallel/test-tls-cli-min-max-conflict.js
+rename to test/known_issues/test-tls-cli-min-max-conflict.js
+diff --git a/test/parallel/test-tls-cli-min-version-1.3.js b/test/known_issues/test-tls-cli-min-version-1.3.js
+similarity index 100%
+rename from test/parallel/test-tls-cli-min-version-1.3.js
+rename to test/known_issues/test-tls-cli-min-version-1.3.js
+diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/known_issues/test-tls-client-renegotiation-13.js
+similarity index 100%
+rename from test/parallel/test-tls-client-renegotiation-13.js
+rename to test/known_issues/test-tls-client-renegotiation-13.js
+diff --git a/test/parallel/test-tls-exportkeyingmaterial.js b/test/known_issues/test-tls-exportkeyingmaterial.js
+similarity index 100%
+rename from test/parallel/test-tls-exportkeyingmaterial.js
+rename to test/known_issues/test-tls-exportkeyingmaterial.js
+diff --git a/test/parallel/test-tls-keylog-tlsv13.js b/test/known_issues/test-tls-keylog-tlsv13.js
+similarity index 100%
+rename from test/parallel/test-tls-keylog-tlsv13.js
+rename to test/known_issues/test-tls-keylog-tlsv13.js
+diff --git a/test/parallel/test-tls-no-sslv3.js b/test/known_issues/test-tls-no-sslv3.js
+similarity index 100%
+rename from test/parallel/test-tls-no-sslv3.js
+rename to test/known_issues/test-tls-no-sslv3.js
+diff --git a/test/parallel/test-tls-psk-server.js b/test/known_issues/test-tls-psk-server.js
+similarity index 100%
+rename from test/parallel/test-tls-psk-server.js
+rename to test/known_issues/test-tls-psk-server.js
+diff --git a/test/parallel/test-tls-server-capture-rejection.js b/test/known_issues/test-tls-server-capture-rejection.js
+similarity index 100%
+rename from test/parallel/test-tls-server-capture-rejection.js
+rename to test/known_issues/test-tls-server-capture-rejection.js
+diff --git a/test/parallel/test-tls-ticket-12.js b/test/known_issues/test-tls-ticket-12.js
+similarity index 100%
+rename from test/parallel/test-tls-ticket-12.js
+rename to test/known_issues/test-tls-ticket-12.js
+diff --git a/test/parallel/test-tls-ticket-cluster.js b/test/known_issues/test-tls-ticket-cluster.js
+similarity index 100%
+rename from test/parallel/test-tls-ticket-cluster.js
+rename to test/known_issues/test-tls-ticket-cluster.js
+diff --git a/test/parallel/test-tls-ticket.js b/test/known_issues/test-tls-ticket.js
+similarity index 100%
+rename from test/parallel/test-tls-ticket.js
+rename to test/known_issues/test-tls-ticket.js
+diff --git a/test/parallel/test-v8-serdes.js b/test/known_issues/test-v8-serdes.js
+similarity index 100%
+rename from test/parallel/test-v8-serdes.js
+rename to test/known_issues/test-v8-serdes.js
 diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
-index 8be7296..c9bf961 100644
+index 863907b..e831f5a 100644
 --- a/test/parallel/test-crypto-authenticated.js
 +++ b/test/parallel/test-crypto-authenticated.js
 @@ -404,7 +404,7 @@ for (const test of TEST_CASES) {
@@ -1325,94 +251,62 @@ index 8be7296..c9bf961 100644
 -    function H(length) { return '00'.repeat(length); }
 -  }
 -}
-diff --git a/test/parallel/test-crypto-des3-wrap.js b/test/parallel/test-crypto-des3-wrap.js
-deleted file mode 100644
-index 75c8cd5..0000000
---- a/test/parallel/test-crypto-des3-wrap.js
-+++ /dev/null
-@@ -1,25 +0,0 @@
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--
--const assert = require('assert');
--const crypto = require('crypto');
--
--// Test case for des-ede3 wrap/unwrap. des3-wrap needs extra 2x blocksize
--// then plaintext to store ciphertext.
--const test = {
--  key: Buffer.from('3c08e25be22352910671cfe4ba3652b1220a8a7769b490ba', 'hex'),
--  iv: Buffer.alloc(0),
--  plaintext: '32|RmVZZkFUVmpRRkp0TmJaUm56ZU9qcnJkaXNNWVNpTTU*|iXmckfRWZBG' +
--    'WWELweCBsThSsfUHLeRe0KCsK8ooHgxie0zOINpXxfZi/oNG7uq9JWFVCk70gfzQH8ZU' +
--    'JjAfaFg**'
--};
--
--const cipher = crypto.createCipheriv('des3-wrap', test.key, test.iv);
--const ciphertext = cipher.update(test.plaintext, 'utf8');
--
--const decipher = crypto.createDecipheriv('des3-wrap', test.key, test.iv);
--const msg = decipher.update(ciphertext, 'buffer', 'utf8');
--
--assert.strictEqual(msg, test.plaintext);
-diff --git a/test/parallel/test-crypto-hash-stream-pipe.js b/test/parallel/test-crypto-hash-stream-pipe.js
-deleted file mode 100644
-index d22281a..0000000
---- a/test/parallel/test-crypto-hash-stream-pipe.js
-+++ /dev/null
-@@ -1,46 +0,0 @@
--// Copyright Joyent, Inc. and other Node contributors.
--//
--// Permission is hereby granted, free of charge, to any person obtaining a
--// copy of this software and associated documentation files (the
--// "Software"), to deal in the Software without restriction, including
--// without limitation the rights to use, copy, modify, merge, publish,
--// distribute, sublicense, and/or sell copies of the Software, and to permit
--// persons to whom the Software is furnished to do so, subject to the
--// following conditions:
--//
--// The above copyright notice and this permission notice shall be included
--// in all copies or substantial portions of the Software.
--//
--// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
--// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
--// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
--// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
--// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
--// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
--// USE OR OTHER DEALINGS IN THE SOFTWARE.
--
--'use strict';
--const common = require('../common');
--
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--
--const assert = require('assert');
--const crypto = require('crypto');
--
--const stream = require('stream');
--const s = new stream.PassThrough();
--const h = crypto.createHash('sha3-512');
--const expect = '36a38a2a35e698974d4e5791a3f05b05' +
--               '198235381e864f91a0e8cd6a26b677ec' +
--               'dcde8e2b069bd7355fabd68abd6fc801' +
--               '19659f25e92f8efc961ee3a7c815c758';
--
--s.pipe(h).on('data', common.mustCall(function(c) {
--  assert.strictEqual(c, expect);
--  // Calling digest() after piping into a stream with SHA3 should not cause
--  // a segmentation fault, see https://github.com/nodejs/node/issues/28245.
--  assert.strictEqual(h.digest('hex'), expect);
--})).setEncoding('hex');
--
--s.end('aoeu');
+diff --git a/test/parallel/test-crypto-dh-stateless.js b/test/parallel/test-crypto-dh-stateless.js
+index b01cea7..b91d15f 100644
+--- a/test/parallel/test-crypto-dh-stateless.js
++++ b/test/parallel/test-crypto-dh-stateless.js
+@@ -204,20 +204,3 @@ assert.throws(() => {
+   name: 'Error',
+   code: 'ERR_OSSL_EVP_DIFFERENT_PARAMETERS'
+ });
+-
+-// Test ECDH-ES.
+-
+-test(crypto.generateKeyPairSync('x448'),
+-     crypto.generateKeyPairSync('x448'));
+-
+-test(crypto.generateKeyPairSync('x25519'),
+-     crypto.generateKeyPairSync('x25519'));
+-
+-assert.throws(() => {
+-  test(crypto.generateKeyPairSync('x448'),
+-       crypto.generateKeyPairSync('x25519'));
+-}, {
+-  name: 'Error',
+-  code: 'ERR_CRYPTO_INCOMPATIBLE_KEY',
+-  message: 'Incompatible key types for Diffie-Hellman: x448 and x25519'
+-});
+diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
+index 6db0d95..e9439ec 100644
+--- a/test/parallel/test-crypto-dh.js
++++ b/test/parallel/test-crypto-dh.js
+@@ -54,9 +54,8 @@ for (const bits of [-1, 0, 1]) {
+ 
+ for (const g of [-1, 1]) {
+   const ex = {
+-    code: 'ERR_OSSL_DH_BAD_GENERATOR',
+     name: 'Error',
+-    message: /bad generator/,
++    message: /bad generator|Initialization failed/,
+   };
+   assert.throws(() => crypto.createDiffieHellman('abcdef', g), ex);
+   assert.throws(() => crypto.createDiffieHellman('abcdef', 'hex', g), ex);
+@@ -68,9 +67,8 @@ for (const g of [Buffer.from([]),
+                  Buffer.from([0]),
+                  Buffer.from([1])]) {
+   const ex = {
+-    code: 'ERR_OSSL_DH_BAD_GENERATOR',
+     name: 'Error',
+-    message: /bad generator/,
++    message: /bad generator|Initialization failed/,
+   };
+   assert.throws(() => crypto.createDiffieHellman('abcdef', g), ex);
+   assert.throws(() => crypto.createDiffieHellman('abcdef', 'hex', g), ex);
 diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
-index 0ccc300..996b885 100644
+index f3f4df9..e0a8240 100644
 --- a/test/parallel/test-crypto-hash.js
 +++ b/test/parallel/test-crypto-hash.js
-@@ -182,87 +182,6 @@ common.expectsError(
+@@ -182,87 +182,6 @@ assert.throws(
                                     ' when called without `new`');
  }
  
@@ -1480,20 +374,20 @@ index 0ccc300..996b885 100644
 -                     '15a2b01f828ea62ac5b3e42f');
 -
 -  // Passing invalid sizes should throw during creation.
--  common.expectsError(() => {
+-  assert.throws(() => {
 -    crypto.createHash('sha256', { outputLength: 28 });
 -  }, {
 -    code: 'ERR_OSSL_EVP_NOT_XOF_OR_INVALID_LENGTH'
 -  });
 -
 -  for (const outputLength of [null, {}, 'foo', false]) {
--    common.expectsError(() => crypto.createHash('sha256', { outputLength }),
--                        { code: 'ERR_INVALID_ARG_TYPE' });
+-    assert.throws(() => crypto.createHash('sha256', { outputLength }),
+-                  { code: 'ERR_INVALID_ARG_TYPE' });
 -  }
 -
 -  for (const outputLength of [-1, .5, Infinity, 2 ** 90]) {
--    common.expectsError(() => crypto.createHash('sha256', { outputLength }),
--                        { code: 'ERR_OUT_OF_RANGE' });
+-    assert.throws(() => crypto.createHash('sha256', { outputLength }),
+-                  { code: 'ERR_OUT_OF_RANGE' });
 -  }
 -}
 -
@@ -1501,7 +395,7 @@ index 0ccc300..996b885 100644
    const h = crypto.createHash('sha512');
    h.digest();
 diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
-index c830343..be32895 100644
+index d3011db..a2e700c 100644
 --- a/test/parallel/test-crypto-key-objects.js
 +++ b/test/parallel/test-crypto-key-objects.js
 @@ -241,42 +241,6 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
@@ -1547,10 +441,11 @@ index c830343..be32895 100644
  
  {
    // Reading an encrypted key without a passphrase should fail.
-@@ -324,145 +288,6 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
+@@ -323,145 +287,6 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
+ 
  }
  
- {
+-{
 -  // Test RSA-PSS.
 -  {
 -    // This key pair does not restrict the message digest algorithm or salt
@@ -1589,7 +484,7 @@ index c830343..be32895 100644
 -
 -    // Exporting the key using PKCS#1 should not work since this would discard
 -    // any algorithm restrictions.
--    common.expectsError(() => {
+-    assert.throws(() => {
 -      publicKey.export({ format: 'pem', type: 'pkcs1' });
 -    }, {
 -      code: 'ERR_CRYPTO_INCOMPATIBLE_KEY_OPTIONS'
@@ -1689,18 +584,18 @@ index c830343..be32895 100644
 -  }
 -}
 -
--{
+ {
    // Exporting an encrypted private key requires a cipher
    const privateKey = createPrivateKey(privatePem);
-   common.expectsError(() => {
 diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
-index 605a374..05a2d80 100644
+index 1f059c4..3856ed1 100644
 --- a/test/parallel/test-crypto-keygen.js
 +++ b/test/parallel/test-crypto-keygen.js
-@@ -266,43 +266,6 @@ const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
+@@ -265,43 +265,6 @@ const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
+   }));
  }
  
- {
+-{
 -  // Test RSA-PSS.
 -  generateKeyPair('rsa-pss', {
 -    modulusLength: 512,
@@ -1737,11 +632,10 @@ index 605a374..05a2d80 100644
 -  }));
 -}
 -
--{
+ {
    const privateKeyEncoding = {
      type: 'pkcs8',
-     format: 'der'
-@@ -964,23 +927,6 @@ const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
+@@ -965,23 +928,6 @@ const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
    }));
  }
  
@@ -1762,9 +656,9 @@ index 605a374..05a2d80 100644
 -  }
 -}
 -
- // Test invalid key encoding types.
+ // Test classic Diffie-Hellman key generation.
  {
-   // Invalid public key type.
+   generateKeyPair('dh', {
 diff --git a/test/parallel/test-crypto-pbkdf2.js b/test/parallel/test-crypto-pbkdf2.js
 index 5ab37ac..5ef4f1f 100644
 --- a/test/parallel/test-crypto-pbkdf2.js
@@ -1792,10 +686,10 @@ index 5ab37ac..5ef4f1f 100644
 -  }
 -);
 diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
-index b3861dd..1bd5f71 100644
+index d5eac77..37d98f6 100644
 --- a/test/parallel/test-crypto-sign-verify.js
 +++ b/test/parallel/test-crypto-sign-verify.js
-@@ -419,14 +419,6 @@ common.expectsError(
+@@ -419,14 +419,6 @@ assert.throws(
  }
  
  [
@@ -1810,11 +704,114 @@ index b3861dd..1bd5f71 100644
    { private: fixtures.readKey('rsa_private_2048.pem', 'ascii'),
      public: fixtures.readKey('rsa_public_2048.pem', 'ascii'),
      algo: 'sha1',
+@@ -502,17 +494,14 @@ assert.throws(
+ 
+ {
+   const privKey = fixtures.readKey('ec-key.pem');
+-  const length = 64;
+   const data = Buffer.from('Hello world');
+-  const keys = [['ec-key.pem', 64], ['dsa_private_1025.pem', 40]];
+ 
+   [
+     crypto.createSign('sha1').update(data).sign(privKey),
+-    crypto.sign('sha1', data, privKey),
+-    crypto.sign('sha1', data, { key: privKey, dsaEncoding: 'der' })
++    crypto.sign('sha1', data, privKey)
+   ].forEach((sig) => {
+     // Signature length variability due to DER encoding
+-    assert(sig.length >= length + 4 && sig.length <= length + 8);
++    assert(sig.length >= 68);
+ 
+     assert.strictEqual(
+       crypto.createVerify('sha1').update(data).verify(privKey, sig),
+@@ -520,82 +509,6 @@ assert.throws(
+     );
+     assert.strictEqual(crypto.verify('sha1', data, privKey, sig), true);
+   });
+-
+-  // Test (EC)DSA signature conversion.
+-  const opts = { key: privKey, dsaEncoding: 'ieee-p1363' };
+-  let sig = crypto.sign('sha1', data, opts);
+-  // Unlike DER signatures, IEEE P1363 signatures have a predictable length.
+-  assert.strictEqual(sig.length, length);
+-  assert.strictEqual(crypto.verify('sha1', data, opts, sig), true);
+-  assert.strictEqual(crypto.createVerify('sha1')
+-    .update(data)
+-    .verify(opts, sig), true);
+-
+-  // Test invalid signature lengths.
+-  for (const i of [-2, -1, 1, 2, 4, 8]) {
+-    sig = crypto.randomBytes(length + i);
+-    assert.throws(() => {
+-      crypto.verify('sha1', data, opts, sig);
+-    }, {
+-      message: 'Malformed signature'
+-    });
+-  }
+-
+-  // Test verifying externally signed messages.
+-  const extSig = Buffer.from('494c18ab5c8a62a72aea5041966902bcfa229821af2bf65' +
+-                             '0b5b4870d1fe6aebeaed9460c62210693b5b0a300033823' +
+-                             '33d9529c8abd8c5948940af944828be16c', 'hex');
+-  for (const ok of [true, false]) {
+-    assert.strictEqual(
+-      crypto.verify('sha256', data, {
+-        key: fixtures.readKey('ec-key.pem'),
+-        dsaEncoding: 'ieee-p1363'
+-      }, extSig),
+-      ok
+-    );
+-
+-    assert.strictEqual(
+-      crypto.createVerify('sha256').update(data).verify({
+-        key: fixtures.readKey('ec-key.pem'),
+-        dsaEncoding: 'ieee-p1363'
+-      }, extSig),
+-      ok
+-    );
+-
+-    extSig[Math.floor(Math.random() * extSig.length)] ^= 1;
+-  }
+-
+-  // Non-(EC)DSA keys should ignore the option.
+-  const sig = crypto.sign('sha1', data, {
+-    key: keyPem,
+-    dsaEncoding: 'ieee-p1363'
+-  });
+-  assert.strictEqual(crypto.verify('sha1', data, certPem, sig), true);
+-  assert.strictEqual(
+-    crypto.verify('sha1', data, {
+-      key: certPem,
+-      dsaEncoding: 'ieee-p1363'
+-    }, sig),
+-    true
+-  );
+-  assert.strictEqual(
+-    crypto.verify('sha1', data, {
+-      key: certPem,
+-      dsaEncoding: 'der'
+-    }, sig),
+-    true
+-  );
+-
+-  for (const dsaEncoding of ['foo', null, {}, 5, true, NaN]) {
+-    assert.throws(() => {
+-      crypto.sign('sha1', data, {
+-        key: certPem,
+-        dsaEncoding
+-      });
+-    }, {
+-      code: 'ERR_INVALID_OPT_VALUE'
+-    });
+-  }
+ }
+ 
+ 
 diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
-index 9337621..ac1fcce 100644
+index 7216523..6e4102c 100644
 --- a/test/parallel/test-crypto.js
 +++ b/test/parallel/test-crypto.js
-@@ -129,7 +129,7 @@ validateList(cryptoCiphers);
+@@ -125,7 +125,7 @@ validateList(cryptoCiphers);
  // Assume that we have at least AES256-SHA.
  const tlsCiphers = tls.getCiphers();
  assert(tls.getCiphers().includes('aes256-sha'));
@@ -1823,7 +820,7 @@ index 9337621..ac1fcce 100644
  // There should be no capital letters in any element.
  const noCapitals = /^[^A-Z]+$/;
  assert(tlsCiphers.every((value) => noCapitals.test(value)));
-@@ -235,9 +235,9 @@ assert.throws(function() {
+@@ -224,9 +224,9 @@ assert.throws(() => {
  }, (err) => {
    // Do the standard checks, but then do some custom checks afterwards.
    assert.throws(() => { throw err; }, {
@@ -1835,6 +832,19 @@ index 9337621..ac1fcce 100644
      reason: 'wrong tag',
      code: 'ERR_OSSL_ASN1_WRONG_TAG',
    });
+diff --git a/test/parallel/test-https-agent-create-connection.js b/test/parallel/test-https-agent-create-connection.js
+index d484029..dcd1927 100644
+--- a/test/parallel/test-https-agent-create-connection.js
++++ b/test/parallel/test-https-agent-create-connection.js
+@@ -145,7 +145,7 @@ function createServer() {
+     };
+ 
+     const socket = agent.createConnection(port, host, options);
+-    socket.on('connect', common.mustCall((data) => {
++    socket.on('secure', common.mustCall((data) => {
+       socket.end();
+     }));
+     socket.on('end', common.mustCall(() => {
 diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
 index 3f5cd36..8e13b15 100644
 --- a/test/parallel/test-https-agent-session-eviction.js
@@ -1896,6 +906,21 @@ index 3f5cd36..8e13b15 100644
 +  req.on('error', common.mustNotCall());
    req.end();
  }
+diff --git a/test/parallel/test-https-agent-session-reuse.js b/test/parallel/test-https-agent-session-reuse.js
+index 0717a3f..af7c3b3 100644
+--- a/test/parallel/test-https-agent-session-reuse.js
++++ b/test/parallel/test-https-agent-session-reuse.js
+@@ -120,8 +120,8 @@ process.on('exit', function() {
+                         clientSessions['before-drop'].toString('hex'));
+   assert.notStrictEqual(clientSessions['cipher-change'].toString('hex'),
+                         clientSessions['before-drop'].toString('hex'));
+-  assert.notStrictEqual(clientSessions['before-drop'].toString('hex'),
+-                        clientSessions['after-drop'].toString('hex'));
++  // assert.notStrictEqual(clientSessions['before-drop'].toString('hex'),
++  //                       clientSessions['after-drop'].toString('hex'));
+   assert.strictEqual(clientSessions['after-drop'].toString('hex'),
+                      clientSessions['after-drop-reuse'].toString('hex'));
+ });
 diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
 index f9f42e2..9dc4637 100644
 --- a/test/parallel/test-tls-alert-handling.js
@@ -1909,47 +934,6 @@ index f9f42e2..9dc4637 100644
    assert.strictEqual(err.reason, 'wrong version number');
    errorReceived = true;
    if (canCloseServer())
-diff --git a/test/parallel/test-tls-cli-max-version-1.3.js b/test/parallel/test-tls-cli-max-version-1.3.js
-deleted file mode 100644
-index c04354f..0000000
---- a/test/parallel/test-tls-cli-max-version-1.3.js
-+++ /dev/null
-@@ -1,15 +0,0 @@
--// Flags: --tls-max-v1.3
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto) common.skip('missing crypto');
--
--// Check that node `--tls-max-v1.3` is supported.
--
--const assert = require('assert');
--const tls = require('tls');
--
--assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
--assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.2');
--
--// Check the min-max version protocol versions against these CLI settings.
--require('./test-tls-min-max-version.js');
-diff --git a/test/parallel/test-tls-cli-min-max-conflict.js b/test/parallel/test-tls-cli-min-max-conflict.js
-deleted file mode 100644
-index 68aae4c..0000000
---- a/test/parallel/test-tls-cli-min-max-conflict.js
-+++ /dev/null
-@@ -1,14 +0,0 @@
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto) common.skip('missing crypto');
--
--// Check that conflicting TLS protocol versions are not allowed
--
--const assert = require('assert');
--const child_process = require('child_process');
--
--const args = ['--tls-min-v1.3', '--tls-max-v1.2', '-p', 'process.version'];
--child_process.execFile(process.argv[0], args, (err) => {
--  assert(err);
--  assert(/not both/.test(err.message));
--});
 diff --git a/test/parallel/test-tls-cli-min-version-1.0.js b/test/parallel/test-tls-cli-min-version-1.0.js
 index 5775627..0a227c0 100644
 --- a/test/parallel/test-tls-cli-min-version-1.0.js
@@ -1989,27 +973,6 @@ index 8385eab..058dc18 100644
  assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.2');
  
  // Check the min-max version protocol versions against these CLI settings.
-diff --git a/test/parallel/test-tls-cli-min-version-1.3.js b/test/parallel/test-tls-cli-min-version-1.3.js
-deleted file mode 100644
-index 1bccc2f..0000000
---- a/test/parallel/test-tls-cli-min-version-1.3.js
-+++ /dev/null
-@@ -1,15 +0,0 @@
--// Flags: --tls-min-v1.3
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto) common.skip('missing crypto');
--
--// Check that node `--tls-min-v1.3` is supported.
--
--const assert = require('assert');
--const tls = require('tls');
--
--assert.strictEqual(tls.DEFAULT_MAX_VERSION, 'TLSv1.3');
--assert.strictEqual(tls.DEFAULT_MIN_VERSION, 'TLSv1.3');
--
--// Check the min-max version protocol versions against these CLI settings.
--require('./test-tls-min-max-version.js');
 diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
 index 5993069..cdfe5de 100644
 --- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
@@ -2020,53 +983,6 @@ index 5993069..cdfe5de 100644
  test(521, 'ECDH', 'secp521r1', 'ECDHE-RSA-AES128-GCM-SHA256');
 -test(253, 'ECDH', 'X25519', 'ECDHE-RSA-AES128-GCM-SHA256');
 -test(448, 'ECDH', 'X448', 'ECDHE-RSA-AES128-GCM-SHA256');
-diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/parallel/test-tls-client-renegotiation-13.js
-deleted file mode 100644
-index 075eb70..0000000
---- a/test/parallel/test-tls-client-renegotiation-13.js
-+++ /dev/null
-@@ -1,41 +0,0 @@
--'use strict';
--
--const common = require('../common');
--const fixtures = require('../common/fixtures');
--
--// Confirm that for TLSv1.3, renegotiate() is disallowed.
--
--const {
--  assert, connect, keys
--} = require(fixtures.path('tls-connect'));
--
--const server = keys.agent10;
--
--connect({
--  client: {
--    ca: server.ca,
--    checkServerIdentity: common.mustCall(),
--  },
--  server: {
--    key: server.key,
--    cert: server.cert,
--  },
--}, function(err, pair, cleanup) {
--  assert.ifError(err);
--
--  const client = pair.client.conn;
--
--  assert.strictEqual(client.getProtocol(), 'TLSv1.3');
--
--  const ok = client.renegotiate({}, common.mustCall((err) => {
--    assert.throws(() => { throw err; }, {
--      message: 'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
--      code: 'ERR_SSL_WRONG_SSL_VERSION',
--      library: 'SSL routines',
--      reason: 'wrong ssl version',
--    });
--    cleanup();
--  }));
--
--  assert.strictEqual(ok, false);
--});
 diff --git a/test/parallel/test-tls-destroy-stream.js b/test/parallel/test-tls-destroy-stream.js
 index a49e985..1964f67 100644
 --- a/test/parallel/test-tls-destroy-stream.js
@@ -2080,6 +996,31 @@ index a49e985..1964f67 100644
  
  // This test ensures that an instance of StreamWrap should emit "end" and
  // "close" when the socket on the other side call `destroy()` instead of
+diff --git a/test/parallel/test-tls-empty-sni-context.js b/test/parallel/test-tls-empty-sni-context.js
+index 9b963e6..fe8753c 100644
+--- a/test/parallel/test-tls-empty-sni-context.js
++++ b/test/parallel/test-tls-empty-sni-context.js
+@@ -26,6 +26,6 @@ const server = tls.createServer(options, (c) => {
+   }, common.mustNotCall());
+ 
+   c.on('error', common.mustCall((err) => {
+-    assert(/Client network socket disconnected/.test(err.message));
++    assert(/Client network socket disconnected|handshake failure/.test(err.message));
+   }));
+ }));
+diff --git a/test/parallel/test-tls-env-bad-extra-ca.js b/test/parallel/test-tls-env-bad-extra-ca.js
+index 5ba1e22..0af6756 100644
+--- a/test/parallel/test-tls-env-bad-extra-ca.js
++++ b/test/parallel/test-tls-env-bad-extra-ca.js
+@@ -37,7 +37,7 @@ fork(__filename, opts)
+     // TODO(addaleax): Make `SafeGetenv` work like `process.env`
+     // encoding-wise
+     if (!common.isWindows) {
+-      const re = /Warning: Ignoring extra certs from.*no-such-file-exists-🐢.* load failed:.*No such file or directory/;
++      const re = /Warning: Ignoring extra certs from.*no-such-file-exists-🐢.* load failed:.*/;
+       assert(re.test(stderr), stderr);
+     }
+   }))
 diff --git a/test/parallel/test-tls-getcipher.js b/test/parallel/test-tls-getcipher.js
 index 624f8ef..93ad1f6 100644
 --- a/test/parallel/test-tls-getcipher.js
@@ -2123,49 +1064,11 @@ index 624f8ef..93ad1f6 100644
 -    client.end();
 -  }));
 -}));
-diff --git a/test/parallel/test-tls-keylog-tlsv13.js b/test/parallel/test-tls-keylog-tlsv13.js
-deleted file mode 100644
-index 0f65564..0000000
---- a/test/parallel/test-tls-keylog-tlsv13.js
-+++ /dev/null
-@@ -1,32 +0,0 @@
--'use strict';
--
--const common = require('../common');
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--
--const assert = require('assert');
--const tls = require('tls');
--const fixtures = require('../common/fixtures');
--
--const server = tls.createServer({
--  key: fixtures.readKey('agent2-key.pem'),
--  cert: fixtures.readKey('agent2-cert.pem'),
--  // Amount of keylog events depends on negotiated protocol
--  // version, so force a specific one:
--  minVersion: 'TLSv1.3',
--  maxVersion: 'TLSv1.3',
--}).listen(() => {
--  const client = tls.connect({
--    port: server.address().port,
--    rejectUnauthorized: false,
--  });
--
--  const verifyBuffer = (line) => assert(Buffer.isBuffer(line));
--  server.on('keylog', common.mustCall(verifyBuffer, 5));
--  client.on('keylog', common.mustCall(verifyBuffer, 5));
--
--  client.once('secureConnect', () => {
--    server.close();
--    client.end();
--  });
--});
 diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
-index 179ae1f..8b5435b 100644
+index 7ef0f12..336d2e9 100644
 --- a/test/parallel/test-tls-min-max-version.js
 +++ b/test/parallel/test-tls-min-max-version.js
-@@ -126,9 +126,9 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.3') {
+@@ -127,9 +127,9 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.3') {
  
  if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
    test(U, U, 'TLSv1_1_method', U, U, 'SSLv23_method',
@@ -2177,7 +1080,7 @@ index 179ae1f..8b5435b 100644
    test(U, U, 'SSLv23_method', U, U, 'TLSv1_1_method',
         U, 'ERR_SSL_UNSUPPORTED_PROTOCOL', 'ERR_SSL_WRONG_VERSION_NUMBER');
    test(U, U, 'SSLv23_method', U, U, 'TLSv1_method',
-@@ -138,7 +138,7 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
+@@ -139,7 +139,7 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
  if (DEFAULT_MIN_VERSION === 'TLSv1.1') {
    test(U, U, 'TLSv1_1_method', U, U, 'SSLv23_method', 'TLSv1.1');
    test(U, U, 'TLSv1_method', U, U, 'SSLv23_method',
@@ -2186,7 +1089,7 @@ index 179ae1f..8b5435b 100644
    test(U, U, 'SSLv23_method', U, U, 'TLSv1_1_method', 'TLSv1.1');
    test(U, U, 'SSLv23_method', U, U, 'TLSv1_method',
         U, 'ERR_SSL_UNSUPPORTED_PROTOCOL', 'ERR_SSL_WRONG_VERSION_NUMBER');
-@@ -160,9 +160,9 @@ test(U, U, 'TLSv1_method', U, U, 'TLSv1_method', 'TLSv1');
+@@ -161,9 +161,9 @@ test(U, U, 'TLSv1_method', U, U, 'TLSv1_method', 'TLSv1');
  // The default default.
  if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
    test(U, U, 'TLSv1_1_method', U, U, U,
@@ -2198,7 +1101,7 @@ index 179ae1f..8b5435b 100644
  
    if (DEFAULT_MAX_VERSION === 'TLSv1.2') {
      test(U, U, U, U, U, 'TLSv1_1_method',
-@@ -182,7 +182,7 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
+@@ -183,7 +183,7 @@ if (DEFAULT_MIN_VERSION === 'TLSv1.2') {
  if (DEFAULT_MIN_VERSION === 'TLSv1.1') {
    test(U, U, 'TLSv1_1_method', U, U, U, 'TLSv1.1');
    test(U, U, 'TLSv1_method', U, U, U,
@@ -2207,7 +1110,7 @@ index 179ae1f..8b5435b 100644
    test(U, U, U, U, U, 'TLSv1_1_method', 'TLSv1.1');
  
    if (DEFAULT_MAX_VERSION === 'TLSv1.2') {
-@@ -213,26 +213,9 @@ test(U, U, 'TLSv1_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1');
+@@ -214,26 +214,9 @@ test(U, U, 'TLSv1_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1');
  test(U, U, 'TLSv1_1_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1.1');
  test(U, U, 'TLSv1_2_method', 'TLSv1', 'TLSv1.2', U, 'TLSv1.2');
  
@@ -2272,61 +1175,6 @@ index 3b0c059..28cd945 100644
 +    version: 'TLSv1/SSLv3'
    }]);
  });
-diff --git a/test/parallel/test-tls-no-sslv3.js b/test/parallel/test-tls-no-sslv3.js
-deleted file mode 100644
-index 1acb1f9..0000000
---- a/test/parallel/test-tls-no-sslv3.js
-+++ /dev/null
-@@ -1,49 +0,0 @@
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--
--if (common.opensslCli === false)
--  common.skip('node compiled without OpenSSL CLI.');
--
--const assert = require('assert');
--const tls = require('tls');
--const spawn = require('child_process').spawn;
--const fixtures = require('../common/fixtures');
--
--const cert = fixtures.readKey('rsa_cert.crt');
--const key = fixtures.readKey('rsa_private.pem');
--const server = tls.createServer({ cert, key }, common.mustNotCall());
--const errors = [];
--let stderr = '';
--
--server.listen(0, '127.0.0.1', function() {
--  const address = `${this.address().address}:${this.address().port}`;
--  const args = ['s_client',
--                '-ssl3',
--                '-connect', address];
--
--  const client = spawn(common.opensslCli, args, { stdio: 'pipe' });
--  client.stdout.pipe(process.stdout);
--  client.stderr.pipe(process.stderr);
--  client.stderr.setEncoding('utf8');
--  client.stderr.on('data', (data) => stderr += data);
--
--  client.once('exit', common.mustCall(function(exitCode) {
--    assert.strictEqual(exitCode, 1);
--    server.close();
--  }));
--});
--
--server.on('tlsClientError', (err) => errors.push(err));
--
--process.on('exit', function() {
--  if (/unknown option -ssl3/.test(stderr)) {
--    common.printSkipMessage('`openssl s_client -ssl3` not supported.');
--  } else {
--    assert.strictEqual(errors.length, 1);
--    // OpenSSL 1.0.x and 1.1.x report invalid client versions differently.
--    assert(/:wrong version number/.test(errors[0].message) ||
--           /:version too low/.test(errors[0].message));
--  }
--});
 diff --git a/test/parallel/test-tls-passphrase.js b/test/parallel/test-tls-passphrase.js
 index c3a99c3..4bbabb4 100644
 --- a/test/parallel/test-tls-passphrase.js
@@ -2341,10 +1189,10 @@ index c3a99c3..4bbabb4 100644
  // Missing passphrase
  assert.throws(function() {
 diff --git a/test/parallel/test-tls-set-ciphers.js b/test/parallel/test-tls-set-ciphers.js
-index fbca83b..79fb178 100644
+index 50fb6ed..e98aa2b 100644
 --- a/test/parallel/test-tls-set-ciphers.js
 +++ b/test/parallel/test-tls-set-ciphers.js
-@@ -68,36 +68,11 @@ const U = undefined;
+@@ -71,36 +71,11 @@ const U = undefined;
  test(U, 'AES256-SHA', 'AES256-SHA');
  test('AES256-SHA', U, 'AES256-SHA');
  
@@ -2382,580 +1230,6 @@ index fbca83b..79fb178 100644
 -// Using '' is synonymous for "use default ciphers"
 -test('TLS_AES_256_GCM_SHA384', '', 'TLS_AES_256_GCM_SHA384');
 -test('', 'TLS_AES_256_GCM_SHA384', 'TLS_AES_256_GCM_SHA384');
-diff --git a/test/parallel/test-tls-ticket-12.js b/test/parallel/test-tls-ticket-12.js
-deleted file mode 100644
-index 600c571..0000000
---- a/test/parallel/test-tls-ticket-12.js
-+++ /dev/null
-@@ -1,12 +0,0 @@
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--
--// Run test-tls-ticket.js with TLS1.2
--
--const tls = require('tls');
--
--tls.DEFAULT_MAX_VERSION = 'TLSv1.2';
--
--require('./test-tls-ticket.js');
-diff --git a/test/parallel/test-tls-ticket-cluster.js b/test/parallel/test-tls-ticket-cluster.js
-deleted file mode 100644
-index cc4f46e..0000000
---- a/test/parallel/test-tls-ticket-cluster.js
-+++ /dev/null
-@@ -1,135 +0,0 @@
--// Copyright Joyent, Inc. and other Node contributors.
--//
--// Permission is hereby granted, free of charge, to any person obtaining a
--// copy of this software and associated documentation files (the
--// "Software"), to deal in the Software without restriction, including
--// without limitation the rights to use, copy, modify, merge, publish,
--// distribute, sublicense, and/or sell copies of the Software, and to permit
--// persons to whom the Software is furnished to do so, subject to the
--// following conditions:
--//
--// The above copyright notice and this permission notice shall be included
--// in all copies or substantial portions of the Software.
--//
--// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
--// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
--// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
--// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
--// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
--// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
--// USE OR OTHER DEALINGS IN THE SOFTWARE.
--
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--
--const assert = require('assert');
--const tls = require('tls');
--const cluster = require('cluster');
--const fixtures = require('../common/fixtures');
--
--const workerCount = 4;
--const expectedReqCount = 16;
--
--if (cluster.isMaster) {
--  let reusedCount = 0;
--  let reqCount = 0;
--  let lastSession = null;
--  let shootOnce = false;
--  let workerPort = null;
--
--  function shoot() {
--    console.error('[master] connecting', workerPort, 'session?', !!lastSession);
--    const c = tls.connect(workerPort, {
--      session: lastSession,
--      rejectUnauthorized: false
--    }, () => {
--      c.end();
--    }).on('close', () => {
--      // Wait for close to shoot off another connection. We don't want to shoot
--      // until a new session is allocated, if one will be. The new session is
--      // not guaranteed on secureConnect (it depends on TLS1.2 vs TLS1.3), but
--      // it is guaranteed to happen before the connection is closed.
--      if (++reqCount === expectedReqCount) {
--        Object.keys(cluster.workers).forEach(function(id) {
--          cluster.workers[id].send('die');
--        });
--      } else {
--        shoot();
--      }
--    }).once('session', (session) => {
--      assert(!lastSession);
--      lastSession = session;
--    });
--
--    c.resume(); // See close_notify comment in server
--  }
--
--  function fork() {
--    const worker = cluster.fork();
--    worker.on('message', ({ msg, port }) => {
--      console.error('[master] got %j', msg);
--      if (msg === 'reused') {
--        ++reusedCount;
--      } else if (msg === 'listening' && !shootOnce) {
--        workerPort = port || workerPort;
--        shootOnce = true;
--        shoot();
--      }
--    });
--
--    worker.on('exit', () => {
--      console.error('[master] worker died');
--    });
--  }
--  for (let i = 0; i < workerCount; i++) {
--    fork();
--  }
--
--  process.on('exit', () => {
--    assert.strictEqual(reqCount, expectedReqCount);
--    assert.strictEqual(reusedCount + 1, reqCount);
--  });
--  return;
--}
--
--const key = fixtures.readKey('rsa_private.pem');
--const cert = fixtures.readKey('rsa_cert.crt');
--
--const options = { key, cert };
--
--const server = tls.createServer(options, (c) => {
--  console.error('[worker] connection reused?', c.isSessionReused());
--  if (c.isSessionReused()) {
--    process.send({ msg: 'reused' });
--  } else {
--    process.send({ msg: 'not-reused' });
--  }
--  // Used to just .end(), but that means client gets close_notify before
--  // NewSessionTicket. Send data until that problem is solved.
--  c.end('x');
--});
--
--server.listen(0, () => {
--  const { port } = server.address();
--  process.send({
--    msg: 'listening',
--    port,
--  });
--});
--
--process.on('message', function listener(msg) {
--  console.error('[worker] got %j', msg);
--  if (msg === 'die') {
--    server.close(() => {
--      console.error('[worker] server close');
--
--      process.exit();
--    });
--  }
--});
--
--process.on('exit', () => {
--  console.error('[worker] exit');
--});
-diff --git a/test/parallel/test-tls-ticket.js b/test/parallel/test-tls-ticket.js
-deleted file mode 100644
-index 8d9cd8c..0000000
---- a/test/parallel/test-tls-ticket.js
-+++ /dev/null
-@@ -1,159 +0,0 @@
--// Copyright Joyent, Inc. and other Node contributors.
--//
--// Permission is hereby granted, free of charge, to any person obtaining a
--// copy of this software and associated documentation files (the
--// "Software"), to deal in the Software without restriction, including
--// without limitation the rights to use, copy, modify, merge, publish,
--// distribute, sublicense, and/or sell copies of the Software, and to permit
--// persons to whom the Software is furnished to do so, subject to the
--// following conditions:
--//
--// The above copyright notice and this permission notice shall be included
--// in all copies or substantial portions of the Software.
--//
--// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
--// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
--// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
--// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
--// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
--// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
--// USE OR OTHER DEALINGS IN THE SOFTWARE.
--
--'use strict';
--const common = require('../common');
--if (!common.hasCrypto)
--  common.skip('missing crypto');
--
--const assert = require('assert');
--const tls = require('tls');
--const net = require('net');
--const crypto = require('crypto');
--const fixtures = require('../common/fixtures');
--
--const keys = crypto.randomBytes(48);
--const serverLog = [];
--const ticketLog = [];
--
--let s;
--
--let serverCount = 0;
--function createServer() {
--  const id = serverCount++;
--
--  let counter = 0;
--  let previousKey = null;
--
--  const server = tls.createServer({
--    key: fixtures.readKey('agent1-key.pem'),
--    cert: fixtures.readKey('agent1-cert.pem'),
--    ticketKeys: keys
--  }, function(c) {
--    serverLog.push(id);
--    // TODO(@sam-github) Triggers close_notify before NewSessionTicket bug.
--    // c.end();
--    c.end('x');
--
--    counter++;
--
--    // Rotate ticket keys
--    //
--    // Take especial care to account for TLS1.2 and TLS1.3 differences around
--    // when ticket keys are encrypted. In TLS1.2, they are encrypted before the
--    // handshake complete callback, but in TLS1.3, they are encrypted after.
--    // There is no callback or way for us to know when they were sent, so hook
--    // the client's reception of the keys, and use it as proof that the current
--    // keys were used, and its safe to rotate them.
--    //
--    // Rotation can occur right away if the session was reused, the keys were
--    // already decrypted or we wouldn't have a reused session.
--    function setTicketKeys(keys) {
--      if (c.isSessionReused())
--        server.setTicketKeys(keys);
--      else
--        s.once('session', () => {
--          server.setTicketKeys(keys);
--        });
--    }
--    if (counter === 1) {
--      previousKey = server.getTicketKeys();
--      assert.strictEqual(previousKey.compare(keys), 0);
--      setTicketKeys(crypto.randomBytes(48));
--    } else if (counter === 2) {
--      setTicketKeys(previousKey);
--    } else if (counter === 3) {
--      // Use keys from counter=2
--    } else {
--      throw new Error('UNREACHABLE');
--    }
--  });
--
--  return server;
--}
--
--const naturalServers = [ createServer(), createServer(), createServer() ];
--
--// 3x servers
--const servers = naturalServers.concat(naturalServers).concat(naturalServers);
--
--// Create one TCP server and balance sockets to multiple TLS server instances
--const shared = net.createServer(function(c) {
--  servers.shift().emit('connection', c);
--}).listen(0, function() {
--  start(function() {
--    shared.close();
--  });
--});
--
--// 'session' events only occur for new sessions. The first connection is new.
--// After, for each set of 3 connections, the middle connection is made when the
--// server has random keys set, so the client's ticket is silently ignored, and a
--// new ticket is sent.
--const onNewSession = common.mustCall((s, session) => {
--  assert(session);
--  assert.strictEqual(session.compare(s.getSession()), 0);
--}, 4);
--
--function start(callback) {
--  let sess = null;
--  let left = servers.length;
--
--  function connect() {
--    s = tls.connect(shared.address().port, {
--      session: sess,
--      rejectUnauthorized: false
--    }, function() {
--      if (s.isSessionReused())
--        ticketLog.push(s.getTLSTicket().toString('hex'));
--    });
--    s.on('data', () => {
--      s.end();
--    });
--    s.on('close', function() {
--      if (--left === 0)
--        callback();
--      else
--        connect();
--    });
--    s.on('session', (session) => {
--      sess = sess || session;
--    });
--    s.once('session', (session) => onNewSession(s, session));
--    s.once('session', () => ticketLog.push(s.getTLSTicket().toString('hex')));
--  }
--
--  connect();
--}
--
--process.on('exit', function() {
--  assert.strictEqual(ticketLog.length, serverLog.length);
--  for (let i = 0; i < naturalServers.length - 1; i++) {
--    assert.notStrictEqual(serverLog[i], serverLog[i + 1]);
--    assert.strictEqual(ticketLog[i], ticketLog[i + 1]);
--
--    // 2nd connection should have different ticket
--    assert.notStrictEqual(ticketLog[i], ticketLog[i + naturalServers.length]);
--
--    // 3rd connection should have the same ticket
--    assert.strictEqual(ticketLog[i], ticketLog[i + naturalServers.length * 2]);
--  }
--});
-diff --git a/test/parallel/test-v8-serdes.js b/test/parallel/test-v8-serdes.js
-deleted file mode 100644
-index a992ba4..0000000
---- a/test/parallel/test-v8-serdes.js
-+++ /dev/null
-@@ -1,244 +0,0 @@
--// Flags: --expose-internals
--
--'use strict';
--
--const common = require('../common');
--const fixtures = require('../common/fixtures');
--const { internalBinding } = require('internal/test/binding');
--const assert = require('assert');
--const v8 = require('v8');
--const os = require('os');
--
--const circular = {};
--circular.circular = circular;
--
--const wasmModule = new WebAssembly.Module(fixtures.readSync('simple.wasm'));
--
--const objects = [
--  { foo: 'bar' },
--  { bar: 'baz' },
--  new Uint8Array([1, 2, 3, 4]),
--  new Uint32Array([1, 2, 3, 4]),
--  Buffer.from([1, 2, 3, 4]),
--  undefined,
--  null,
--  42,
--  circular,
--  wasmModule
--];
--
--const hostObject = new (internalBinding('js_stream').JSStream)();
--
--const serializerTypeError =
--  /^TypeError: Class constructor Serializer cannot be invoked without 'new'$/;
--const deserializerTypeError =
--  /^TypeError: Class constructor Deserializer cannot be invoked without 'new'$/;
--
--{
--  const ser = new v8.DefaultSerializer();
--  ser.writeHeader();
--  for (const obj of objects) {
--    ser.writeValue(obj);
--  }
--
--  const des = new v8.DefaultDeserializer(ser.releaseBuffer());
--  des.readHeader();
--
--  for (const obj of objects) {
--    assert.deepStrictEqual(des.readValue(), obj);
--  }
--}
--
--{
--  for (const obj of objects) {
--    assert.deepStrictEqual(v8.deserialize(v8.serialize(obj)), obj);
--  }
--}
--
--{
--  const ser = new v8.DefaultSerializer();
--  ser._getDataCloneError = common.mustCall((message) => {
--    assert.strictEqual(message, '[object Object] could not be cloned.');
--    return new Error('foobar');
--  });
--
--  ser.writeHeader();
--
--  assert.throws(() => {
--    ser.writeValue(new Proxy({}, {}));
--  }, /foobar/);
--}
--
--{
--  const ser = new v8.DefaultSerializer();
--  ser._writeHostObject = common.mustCall((object) => {
--    assert.strictEqual(object, hostObject);
--    const buf = Buffer.from('hostObjectTag');
--
--    ser.writeUint32(buf.length);
--    ser.writeRawBytes(buf);
--
--    ser.writeUint64(1, 2);
--    ser.writeDouble(-0.25);
--  });
--
--  ser.writeHeader();
--  ser.writeValue({ val: hostObject });
--
--  const des = new v8.DefaultDeserializer(ser.releaseBuffer());
--  des._readHostObject = common.mustCall(() => {
--    const length = des.readUint32();
--    const buf = des.readRawBytes(length);
--
--    assert.strictEqual(buf.toString(), 'hostObjectTag');
--
--    assert.deepStrictEqual(des.readUint64(), [1, 2]);
--    assert.strictEqual(des.readDouble(), -0.25);
--    return hostObject;
--  });
--
--  des.readHeader();
--
--  assert.strictEqual(des.readValue().val, hostObject);
--}
--
--// This test ensures that `v8.Serializer.writeRawBytes()` support
--// `TypedArray` and `DataView`.
--{
--  const text = 'hostObjectTag';
--  const data = Buffer.from(text);
--  const arrayBufferViews = common.getArrayBufferViews(data);
--
--  // `buf` is one of `TypedArray` or `DataView`.
--  function testWriteRawBytes(buf) {
--    let writeHostObjectCalled = false;
--    const ser = new v8.DefaultSerializer();
--
--    ser._writeHostObject = common.mustCall((object) => {
--      writeHostObjectCalled = true;
--      ser.writeUint32(buf.byteLength);
--      ser.writeRawBytes(buf);
--    });
--
--    ser.writeHeader();
--    ser.writeValue({ val: hostObject });
--
--    const des = new v8.DefaultDeserializer(ser.releaseBuffer());
--    des._readHostObject = common.mustCall(() => {
--      assert.strictEqual(writeHostObjectCalled, true);
--      const length = des.readUint32();
--      const buf = des.readRawBytes(length);
--      assert.strictEqual(buf.toString(), text);
--
--      return hostObject;
--    });
--
--    des.readHeader();
--
--    assert.strictEqual(des.readValue().val, hostObject);
--  }
--
--  arrayBufferViews.forEach((buf) => {
--    testWriteRawBytes(buf);
--  });
--}
--
--{
--  const ser = new v8.DefaultSerializer();
--  ser._writeHostObject = common.mustCall((object) => {
--    throw new Error('foobar');
--  });
--
--  ser.writeHeader();
--  assert.throws(() => {
--    ser.writeValue({ val: hostObject });
--  }, /foobar/);
--}
--
--{
--  assert.throws(() => v8.serialize(hostObject), {
--    constructor: Error,
--    message: 'Unserializable host object: JSStream {}'
--  });
--}
--
--{
--  const buf = Buffer.from('ff0d6f2203666f6f5e007b01', 'hex');
--
--  const des = new v8.DefaultDeserializer(buf);
--  des.readHeader();
--
--  const ser = new v8.DefaultSerializer();
--  ser.writeHeader();
--
--  ser.writeValue(des.readValue());
--
--  assert.deepStrictEqual(buf, ser.releaseBuffer());
--  assert.strictEqual(des.getWireFormatVersion(), 0x0d);
--}
--
--{
--  // Unaligned Uint16Array read, with padding in the underlying array buffer.
--  let buf = Buffer.alloc(32 + 9);
--  buf.write('ff0d5c0404addeefbe', 32, 'hex');
--  buf = buf.slice(32);
--
--  const expectedResult = os.endianness() === 'LE' ?
--    new Uint16Array([0xdead, 0xbeef]) : new Uint16Array([0xadde, 0xefbe]);
--
--  assert.deepStrictEqual(v8.deserialize(buf), expectedResult);
--}
--
--{
--  assert.throws(v8.Serializer, serializerTypeError);
--  assert.throws(v8.Deserializer, deserializerTypeError);
--}
--
--
--// `v8.deserialize()` and `new v8.Deserializer()` should support both
--// `TypedArray` and `DataView`.
--{
--  for (const obj of objects) {
--    const buf = v8.serialize(obj);
--
--    for (const arrayBufferView of common.getArrayBufferViews(buf)) {
--      assert.deepStrictEqual(v8.deserialize(arrayBufferView), obj);
--    }
--
--    for (const arrayBufferView of common.getArrayBufferViews(buf)) {
--      const deserializer = new v8.DefaultDeserializer(arrayBufferView);
--      deserializer.readHeader();
--      const value = deserializer.readValue();
--      assert.deepStrictEqual(value, obj);
--
--      const serializer = new v8.DefaultSerializer();
--      serializer.writeHeader();
--      serializer.writeValue(value);
--      assert.deepStrictEqual(buf, serializer.releaseBuffer());
--    }
--  }
--}
--
--{
--  const INVALID_SOURCE = 'INVALID_SOURCE_TYPE';
--  const serializer = new v8.Serializer();
--  serializer.writeHeader();
--  assert.throws(
--    () => serializer.writeRawBytes(INVALID_SOURCE),
--    /^TypeError: source must be a TypedArray or a DataView$/,
--  );
--  assert.throws(
--    () => v8.deserialize(INVALID_SOURCE),
--    /^TypeError: buffer must be a TypedArray or a DataView$/,
--  );
--  assert.throws(
--    () => new v8.Deserializer(INVALID_SOURCE),
--    /^TypeError: buffer must be a TypedArray or a DataView$/,
--  );
--}
--
--{
--  const deserializedWasmModule = v8.deserialize(v8.serialize(wasmModule));
--  const instance = new WebAssembly.Instance(deserializedWasmModule);
--  assert.strictEqual(instance.exports.add(10, 20), 30);
--}
 -- 
-1.8.3.1
+2.26.2
 
diff --git a/SOURCES/0004-deps-Remove-statx-from-libuv.patch b/SOURCES/0004-deps-Remove-statx-from-libuv.patch
index c0c678b..86d1161 100644
--- a/SOURCES/0004-deps-Remove-statx-from-libuv.patch
+++ b/SOURCES/0004-deps-Remove-statx-from-libuv.patch
@@ -1,19 +1,20 @@
-From b432ec3d812467099f3a632e2e69a00371de39c4 Mon Sep 17 00:00:00 2001
+From f8d6f549073709287fa26f3306b850d9030bb5c5 Mon Sep 17 00:00:00 2001
 From: Zuzana Svetlikova <zsvetlik@redhat.com>
 Date: Wed, 19 Feb 2020 10:32:33 +0000
-Subject: [PATCH 4/4] fix libuv
+Subject: [PATCH] deps: Remove statx from libuv
 
+Signed-off-by: rpm-build <rpm-build>
 ---
- deps/uv/src/unix/fs.c             | 91 ---------------------------------------
- deps/uv/src/unix/linux-syscalls.c | 32 --------------
- deps/uv/src/unix/linux-syscalls.h | 35 ---------------
+ deps/uv/src/unix/fs.c             | 91 -------------------------------
+ deps/uv/src/unix/linux-syscalls.c | 32 -----------
+ deps/uv/src/unix/linux-syscalls.h | 35 ------------
  3 files changed, 158 deletions(-)
 
 diff --git a/deps/uv/src/unix/fs.c b/deps/uv/src/unix/fs.c
-index 916d710..c227f4c 100644
+index 5f5d36a..856dc4e 100644
 --- a/deps/uv/src/unix/fs.c
 +++ b/deps/uv/src/unix/fs.c
-@@ -1278,93 +1278,10 @@ static void uv__to_stat(struct stat* src, uv_stat_t* dst) {
+@@ -1341,93 +1341,10 @@ static void uv__to_stat(struct stat* src, uv_stat_t* dst) {
  }
  
  
@@ -107,7 +108,7 @@ index 916d710..c227f4c 100644
    ret = stat(path, &pbuf);
    if (ret == 0)
      uv__to_stat(&pbuf, buf);
-@@ -1377,10 +1294,6 @@ static int uv__fs_lstat(const char *path, uv_stat_t *buf) {
+@@ -1440,10 +1357,6 @@ static int uv__fs_lstat(const char *path, uv_stat_t *buf) {
    struct stat pbuf;
    int ret;
  
@@ -118,7 +119,7 @@ index 916d710..c227f4c 100644
    ret = lstat(path, &pbuf);
    if (ret == 0)
      uv__to_stat(&pbuf, buf);
-@@ -1393,10 +1306,6 @@ static int uv__fs_fstat(int fd, uv_stat_t *buf) {
+@@ -1456,10 +1369,6 @@ static int uv__fs_fstat(int fd, uv_stat_t *buf) {
    struct stat pbuf;
    int ret;
  
@@ -130,10 +131,10 @@ index 916d710..c227f4c 100644
    if (ret == 0)
      uv__to_stat(&pbuf, buf);
 diff --git a/deps/uv/src/unix/linux-syscalls.c b/deps/uv/src/unix/linux-syscalls.c
-index 9503878..9560fe6 100644
+index 742f26a..2c949f0 100644
 --- a/deps/uv/src/unix/linux-syscalls.c
 +++ b/deps/uv/src/unix/linux-syscalls.c
-@@ -187,22 +187,6 @@
+@@ -94,22 +94,6 @@
  # endif
  #endif /* __NR_pwritev */
  
@@ -156,7 +157,7 @@ index 9503878..9560fe6 100644
  #ifndef __NR_getrandom
  # if defined(__x86_64__)
  #  define __NR_getrandom 318
-@@ -369,22 +353,6 @@ int uv__dup3(int oldfd, int newfd, int flags) {
+@@ -180,22 +164,6 @@ int uv__dup3(int oldfd, int newfd, int flags) {
  }
  
  
@@ -180,12 +181,12 @@ index 9503878..9560fe6 100644
  #if defined(__NR_getrandom)
    return syscall(__NR_getrandom, buf, buflen, flags);
 diff --git a/deps/uv/src/unix/linux-syscalls.h b/deps/uv/src/unix/linux-syscalls.h
-index b7729b8..7312b0c 100644
+index 2e8fa2a..2f1bc11 100644
 --- a/deps/uv/src/unix/linux-syscalls.h
 +++ b/deps/uv/src/unix/linux-syscalls.h
-@@ -80,36 +80,6 @@
- #define UV__IN_DELETE_SELF    0x400
- #define UV__IN_MOVE_SELF      0x800
+@@ -31,44 +31,9 @@
+ #include <sys/time.h>
+ #include <sys/socket.h>
  
 -struct uv__statx_timestamp {
 -  int64_t tv_sec;
@@ -217,10 +218,6 @@ index b7729b8..7312b0c 100644
 -  uint64_t unused1[14];
 -};
 -
- struct uv__inotify_event {
-   int32_t wd;
-   uint32_t mask;
-@@ -143,11 +113,6 @@ int uv__sendmmsg(int fd,
  ssize_t uv__preadv(int fd, const struct iovec *iov, int iovcnt, int64_t offset);
  ssize_t uv__pwritev(int fd, const struct iovec *iov, int iovcnt, int64_t offset);
  int uv__dup3(int oldfd, int newfd, int flags);
@@ -233,5 +230,5 @@ index b7729b8..7312b0c 100644
  
  #endif /* UV_LINUX_SYSCALL_H_ */
 -- 
-1.8.3.1
+2.26.2
 
diff --git a/SPECS/nodejs.spec b/SPECS/nodejs.spec
index d47d3cf..4f05ddc 100644
--- a/SPECS/nodejs.spec
+++ b/SPECS/nodejs.spec
@@ -5,6 +5,10 @@
 
 %{!?_with_bootstrap: %global bootstrap 1}
 
+# When running parallel build, ld tends to run out of memory/be killed by signal 9
+# Put parallel compilation behind bcond for now
+%bcond_with parallel_build
+
 # ARM builds currently break on the Debug builds, so we'll just
 # build the standard runtime until that gets sorted out.
 %ifarch %{arm} aarch64 %{power64}
@@ -17,8 +21,8 @@
 # feature releases that are only supported for nine months, which is shorter
 # than a Fedora release lifecycle.
 %global nodejs_major 12
-%global nodejs_minor 16
-%global nodejs_patch 1
+%global nodejs_minor 18
+%global nodejs_patch 2
 %global nodejs_abi %{nodejs_major}.%{nodejs_minor}
 %global nodejs_version %{nodejs_major}.%{nodejs_minor}.%{nodejs_patch}
 %global nodejs_release 1
@@ -35,7 +39,7 @@
 
 # c-ares - from deps/cares/include/ares_version.h
 %global c_ares_major 1
-%global c_ares_minor 15
+%global c_ares_minor 16
 %global c_ares_patch 0
 %global c_ares_version %{c_ares_major}.%{c_ares_minor}.%{c_ares_patch}
 
@@ -51,16 +55,16 @@
 %global llhttp_patch 4
 %global llhttp_version %{llhttp_major}.%{llhttp_minor}.%{llhttp_patch}
 
-# libuv - from deps/uv/include/uv-version/h
+# libuv - from deps/uv/include/uv/version.h
 %global libuv_major 1
-%global libuv_minor 34
+%global libuv_minor 38
 %global libuv_patch 0
 %global libuv_version %{libuv_major}.%{libuv_minor}.%{libuv_patch}
 
 # nghttp2 - from deps/nghttp2/lib/includes/nghttp2/nghttp2ver.h
 
 %global nghttp2_major 1
-%global nghttp2_minor 40
+%global nghttp2_minor 41
 %global nghttp2_patch 0
 %global nghttp2_version %{nghttp2_major}.%{nghttp2_minor}.%{nghttp2_patch}
 
@@ -69,28 +73,34 @@
 # Note: this will be unmerged in v7 or v8
 %global punycode_major 2
 %global punycode_minor 1
-%global punycode_patch 1
+%global punycode_patch 0
 %global punycode_version %{punycode_major}.%{punycode_minor}.%{punycode_patch}
 
 # npm - from deps/npm/package.json
 %global npm_major 6
-%global npm_minor 13
-%global npm_patch 4
+%global npm_minor 14
+%global npm_patch 5
 %global npm_version %{npm_major}.%{npm_minor}.%{npm_patch}
 
 # uvwasi - from deps/uvwasi/include/uvwasi.h
 %global uvwasi_major 0
 %global uvwasi_minor 0
-%global uvwasi_patch 3
+%global uvwasi_patch 9
 %global uvwasi_version %{uvwasi_major}.%{uvwasi_minor}.%{uvwasi_patch}
 
-# zlib version - from deps/zlib/CMakeLists.txt
+# zlib version - from deps/zlib/zlib.h
 # Note: Only required/bundled on RHEL-7
 %global zlib_major 1
 %global zlib_minor 2
 %global zlib_patch 11
 %global zlib_version %{zlib_major}.%{zlib_minor}.%{zlib_patch}
 
+# histogram_c - assumed from timestamps
+%global histogram_major 0
+%global histogram_minor 9
+%global histogram_patch 7
+%global histogram_version %{histogram_major}.%{histogram_minor}.%{histogram_patch}
+
 # In order to avoid needing to keep incrementing the release version for the
 # main package forever, we will just construct one for npm that is guaranteed
 # to increment safely. Changing this can only be done during an update when the
@@ -129,13 +139,13 @@ Patch4: 0004-deps-Remove-statx-from-libuv.patch
 BuildRequires: python-devel
 #BuildRequires: libicu-devel
 BuildRequires: zlib-devel
-BuildRequires: devtoolset-8-gcc
-BuildRequires: devtoolset-8-gcc-c++
+BuildRequires: devtoolset-9-gcc
+BuildRequires: devtoolset-9-gcc-c++
 # needed for tests
 BuildRequires: procps-ng
 BuildRequires: systemtap-sdt-devel
 BuildRequires: chrpath
-BuildRequires: devtoolset-8-libatomic-devel
+BuildRequires: devtoolset-9-libatomic-devel
 
 
 BuildRequires: openssl-devel >= 1:1.0.2
@@ -200,6 +210,8 @@ Provides: bundled(%{?scl_prefix}zlib) = %{zlib_version}
 # Bundle uvwasi, since it is not available on RHEL7
 Provides: bundled(%{?scl_prefix}uvwasi) = %{uvwasi_version}
 
+Provides: bundled(%{?scl_prefix}histogram} = %{histogram_version}
+
 # Make sure we keep NPM up to date when we update Node.js
 Requires: %{?scl_prefix}npm = %{npm_version}-%{npm_release}%{?dist}
 
@@ -262,7 +274,7 @@ find deps/ -name '*.c' -o -name '*.h' -exec chmod 0644 '{}' +
 
 %build
 
-%{?scl:scl enable %{scl} devtoolset-8 - << \EOF}
+%{?scl:scl enable %{scl} devtoolset-9 - << \EOF}
 
 # _pkgdocdir does not support subpackage with different version
 %{?rhel7:%global _pkgdocdir %{_docdir}/%{name}-%{nodejs_version}}
@@ -309,10 +321,9 @@ export CXXFLAGS="$(echo ${CXXFLAGS} | tr '\n\\' '  ')"
            --openssl-use-def-ca-store
 %endif
 
-# make BUILDTYPE=Release %%{?_smp_mflags}
-make BUILDTYPE=Release -j4
+make BUILDTYPE=Release %{?with_parallel_build:-j4}
 %if 0%{?with_debug} == 1
-make BUILDTYPE=Debug %{?_smp_mflags}
+make BUILDTYPE=Debug %{?with_parallel_build:%{?_smp_mflags}}
 %endif
 
 %{?scl:EOF}
@@ -397,7 +408,7 @@ done
 
 
 #%check
-%{?scl:scl enable %{scl} devtoolset-8 - << \EOF}
+%{?scl:scl enable %{scl} devtoolset-9 - << \EOF}
 set -ex
 # Fail the build if the versions don't match
 #%{buildroot}/%{_bindir}/node -e "require('assert').equal(process.versions.node, '%{nodejs_version}')"
@@ -441,10 +452,10 @@ python2 tools/test.py "${RUN_SUITES[@]}" || :
 %dir %{_prefix}/lib/dtrace
 %{_prefix}/lib/dtrace/node.d
 
-#%{_rpmconfigdir}/fileattrs/nodejs_native.attr
-#%{_rpmconfigdir}/nodejs_native.req
+#%%{_rpmconfigdir}/fileattrs/nodejs_native.attr
+#%%{_rpmconfigdir}/nodejs_native.req
 %license LICENSE
-%doc AUTHORS CHANGELOG.md COLLABORATOR_GUIDE.md GOVERNANCE.md README.md
+%doc AUTHORS CHANGELOG.md onboarding.md GOVERNANCE.md README.md
 
 %files devel
 %if 0%{?with_debug} == 1
@@ -487,9 +498,16 @@ python2 tools/test.py "${RUN_SUITES[@]}" || :
 
 
 %changelog
+* Tue Jun 30 2020 Jan Staněk <jstanek@redhat.com> - 12.18.2-1
+- Rebase to 12.18.2
+
+* Wed Jun 24 2020 Jan Staněk <jstanek@redhat.com> - 12.18.1-1
+- Rebase to 12.18.1
+- Use devtoolset-9
+
 * Wed Feb 19 2020 Zuzana Svetlikova <zsvetlik@redhat.com> - 12.16.1
-- Resolves: RHBZ#1800402, RHBZ#1800401, RHBZ#1800377, RHBZ#1774113
-- also 1788310, 1788305, 1788301 (December security release)
+- Resolves: RHBZ#1800404, RHBZ#1800403, RHBZ#1800378, RHBZ#1774113
+- Resolves: RHBZ#1803154, RHBZ#1803157, RHBZ#1803160 (nmp CVEs)
 - also 1793482
 - use devtoolset-8, build with -j4
 - added uvwasi bundled dependency