diff --git a/libretroshare/src/crypto/chacha20.cpp b/libretroshare/src/crypto/chacha20.cpp
index bee4f034e..2653a7046 100644
--- a/libretroshare/src/crypto/chacha20.cpp
+++ b/libretroshare/src/crypto/chacha20.cpp
@@ -537,6 +537,7 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3
        uint8_t computed_tag[EVP_MAX_MD_SIZE];
        unsigned int md_size ;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
        HMAC_CTX hmac_ctx ;
        HMAC_CTX_init(&hmac_ctx) ;
 
@@ -544,6 +545,17 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3
        HMAC_Update(&hmac_ctx,aad,aad_size) ;
        HMAC_Update(&hmac_ctx,data,data_size) ;
        HMAC_Final(&hmac_ctx,computed_tag,&md_size) ;
+#else
+       HMAC_CTX *hmac_ctx = HMAC_CTX_new();
+
+       HMAC_Init_ex(hmac_ctx,key,32,EVP_sha256(),NULL) ;
+       HMAC_Update(hmac_ctx,aad,aad_size) ;
+       HMAC_Update(hmac_ctx,data,data_size) ;
+       HMAC_Final(hmac_ctx,computed_tag,&md_size) ;
+
+       HMAC_CTX_free(hmac_ctx) ;
+       hmac_ctx=NULL;
+#endif
 
        assert(md_size >= 16);
 
@@ -556,6 +568,7 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3
        uint8_t computed_tag[EVP_MAX_MD_SIZE];
        unsigned int md_size ;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
        HMAC_CTX hmac_ctx ;
        HMAC_CTX_init(&hmac_ctx) ;
 
@@ -563,6 +576,17 @@ bool AEAD_chacha20_sha256(uint8_t key[32], uint8_t nonce[12],uint8_t *data,uint3
        HMAC_Update(&hmac_ctx,aad,aad_size) ;
        HMAC_Update(&hmac_ctx,data,data_size) ;
        HMAC_Final(&hmac_ctx,computed_tag,&md_size) ;
+#else
+       HMAC_CTX *hmac_ctx = HMAC_CTX_new();
+
+       HMAC_Init_ex(hmac_ctx,key,32,EVP_sha256(),NULL) ;
+       HMAC_Update(hmac_ctx,aad,aad_size) ;
+       HMAC_Update(hmac_ctx,data,data_size) ;
+       HMAC_Final(hmac_ctx,computed_tag,&md_size) ;
+
+       HMAC_CTX_free(hmac_ctx) ;
+       hmac_ctx=NULL;
+#endif
 
        // decrypt
 
diff --git a/libretroshare/src/gxs/gxssecurity.cc b/libretroshare/src/gxs/gxssecurity.cc
index 20ddc1462..ff430796c 100644
--- a/libretroshare/src/gxs/gxssecurity.cc
+++ b/libretroshare/src/gxs/gxssecurity.cc
@@ -41,20 +41,31 @@ static const uint32_t MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE  = 256 ;
         
 static RsGxsId getRsaKeyFingerprint_old_insecure_method(RSA *pubkey)
 {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
         int lenn = BN_num_bytes(pubkey -> n);
 
         RsTemporaryMemory tmp(lenn) ;
         BN_bn2bin(pubkey -> n, tmp);
+#else
+        const BIGNUM *nn=NULL,*ee=NULL ;
+        RSA_get0_key(pubkey,&nn,&ee,NULL) ;
+
+        int lenn = BN_num_bytes(nn);
+
+        RsTemporaryMemory tmp(lenn) ;
+        BN_bn2bin(nn, tmp);
+#endif
 
         // Copy first CERTSIGNLEN bytes from the hash of the public modulus and exponent
-	// We should not be using strings here, but a real ID. To be done later.
+		// We should not be using strings here, but a real ID. To be done later.
 
-	assert(lenn >= CERTSIGNLEN) ;
+		assert(lenn >= CERTSIGNLEN) ;
 
-        return RsGxsId((unsigned char*)tmp) ;
+		return RsGxsId((unsigned char*)tmp) ;
 }
 static RsGxsId getRsaKeyFingerprint(RSA *pubkey)
 {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
         int lenn = BN_num_bytes(pubkey -> n);
         int lene = BN_num_bytes(pubkey -> e);
 
@@ -62,6 +73,18 @@ static RsGxsId getRsaKeyFingerprint(RSA *pubkey)
 
         BN_bn2bin(pubkey -> n, tmp);
         BN_bn2bin(pubkey -> e, &tmp[lenn]);
+#else
+        const BIGNUM *nn=NULL,*ee=NULL ;
+        RSA_get0_key(pubkey,&nn,&ee,NULL) ;
+
+        int lenn = BN_num_bytes(nn);
+        int lene = BN_num_bytes(ee);
+
+        RsTemporaryMemory tmp(lenn+lene) ;
+
+        BN_bn2bin(nn, tmp);
+        BN_bn2bin(ee, &tmp[lenn]);
+#endif
 
 	Sha1CheckSum s = RsDirUtil::sha1sum(tmp,lenn+lene) ;
 
@@ -530,11 +553,10 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u
 		return false;
 	}
 
-	EVP_CIPHER_CTX ctx;
+	EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
 	int eklen, net_ekl;
 	unsigned char *ek;
 	unsigned char iv[EVP_MAX_IV_LENGTH];
-	EVP_CIPHER_CTX_init(&ctx);
 	int out_currOffset = 0;
 	int out_offset = 0;
 
@@ -551,7 +573,7 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u
 	int max_outlen = inlen + cipher_block_size + EVP_MAX_IV_LENGTH + max_evp_key_size + size_net_ekl;
 
 	// intialize context and send store encrypted cipher in ek
-	if(!EVP_SealInit(&ctx, EVP_aes_128_cbc(), &ek, &eklen, iv, &public_key, 1)) return false;
+	if(!EVP_SealInit(ctx, EVP_aes_128_cbc(), &ek, &eklen, iv, &public_key, 1)) return false;
 
 	// now assign memory to out accounting for data, and cipher block size, key length, and key length val
 	out = (uint8_t*)rs_malloc(inlen + cipher_block_size + size_net_ekl + eklen + EVP_MAX_IV_LENGTH) ;
@@ -570,7 +592,7 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u
 	out_offset += EVP_MAX_IV_LENGTH;
 
 	// now encrypt actual data
-	if(!EVP_SealUpdate(&ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen)) 
+	if(!EVP_SealUpdate(ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen))
 	{
 		free(out) ;
 		out = NULL ;
@@ -581,7 +603,7 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u
 	out_offset += out_currOffset;
 
 	// add padding
-	if(!EVP_SealFinal(&ctx, (unsigned char*) out + out_offset, &out_currOffset)) 
+	if(!EVP_SealFinal(ctx, (unsigned char*) out + out_offset, &out_currOffset))
 	{
 		free(out) ;
 		out = NULL ;
@@ -602,7 +624,7 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u
 	// free encrypted key data
 	free(ek);
 
-	EVP_CIPHER_CTX_cleanup(&ctx);
+	EVP_CIPHER_CTX_free(ctx);
     
 	outlen = out_offset;
 	return true;
@@ -613,152 +635,151 @@ bool GxsSecurity::encrypt(uint8_t *& out, uint32_t &outlen, const uint8_t *in, u
 #ifdef DISTRIB_DEBUG
 	std::cerr << "GxsSecurity::encrypt() " << std::endl;
 #endif
-        // Encrypts (in,inlen) into (out,outlen) using the given RSA public key.
-        // The format of the encrypted data is:
-        //
-        //   [--- ID ---|--- number of encrypted keys---|  n * (--- Encrypted session keys ---)    |---      IV     ---|---- Encrypted data ---]
-    	//      2 bytes              2 byte = n                            256 bytes                  EVP_MAX_IV_LENGTH       Rest of packet
-        //
+	// Encrypts (in,inlen) into (out,outlen) using the given RSA public key.
+	// The format of the encrypted data is:
+	//
+	//   [--- ID ---|--- number of encrypted keys---|  n * (--- Encrypted session keys ---)    |---      IV     ---|---- Encrypted data ---]
+	//      2 bytes              2 byte = n                            256 bytes                  EVP_MAX_IV_LENGTH       Rest of packet
+	//
 
-    out = NULL ;
-    EVP_CIPHER_CTX ctx;
-    EVP_CIPHER_CTX_init(&ctx);
-    std::vector<EVP_PKEY *> public_keys(keys.size(),NULL);
-    
-    try
-    {
-        for(uint32_t i=0;i<keys.size();++i)
-	{
-		RSA *tmpkey = ::extractPublicKey(keys[i]) ;
-		RSA *rsa_publish_pub = RSAPublicKey_dup(tmpkey) ;
-		RSA_free(tmpkey) ;
-
-		if(rsa_publish_pub  != NULL)
-		{
-			public_keys[i] = EVP_PKEY_new();
-			EVP_PKEY_assign_RSA(public_keys[i], rsa_publish_pub);
-		}
-		else
-		{
-			std::cerr << "GxsSecurity(): Could not generate public key for key id " << keys[i].keyId << std::endl;
-			throw std::runtime_error("Cannot extract public key") ;
-		}
-	}
-
-	unsigned char iv[EVP_MAX_IV_LENGTH];
-
-    	std::vector<unsigned char *> ek(keys.size(),NULL) ;
-        std::vector<int> eklen(keys.size(),0) ;
-        
-        for(uint32_t i=0;i<keys.size();++i)
-        {
-		int max_evp_key_size = EVP_PKEY_size(public_keys[i]);
-            
-            	if(max_evp_key_size != MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE)
-			throw std::runtime_error("EVP_PKEY_size should be equal to 256. It's not!") ;
-                
-		ek[i] = (unsigned char*)rs_malloc(max_evp_key_size);
-    		if(ek[i] == NULL)
-			throw std::runtime_error("malloc error on encrypted keys") ;
-        }
-        
-	const EVP_CIPHER *cipher = EVP_aes_128_cbc();
-	int cipher_block_size = EVP_CIPHER_block_size(cipher);
-
-	// intialize context and send store encrypted cipher in ek
-	if(!EVP_SealInit(&ctx, EVP_aes_128_cbc(), ek.data(), eklen.data(), iv, public_keys.data(), keys.size())) 
-       		 return false;
-
-    	// now we can release the encryption keys
-    	for(uint32_t i=0;i<public_keys.size();++i)
-            EVP_PKEY_free(public_keys[i]) ;
-        public_keys.clear() ;
-    
-    	int total_ek_size = MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE * keys.size() ;
-        
-	int max_outlen = MULTI_ENCRYPTION_FORMAT_v001_HEADER_SIZE + MULTI_ENCRYPTION_FORMAT_v001_NUMBER_OF_KEYS_SIZE + total_ek_size + EVP_MAX_IV_LENGTH + (inlen + cipher_block_size) ;
-    
-	// now assign memory to out accounting for data, and cipher block size, key length, and key length val
-	out = (uint8_t*)rs_malloc(max_outlen);
-
-	if(out == NULL)
-		return false ;
-
-	int out_offset = 0;
-    
-    	// header
-    
-    	out[out_offset++] =  MULTI_ENCRYPTION_FORMAT_v001_HEADER       & 0xff ;
-    	out[out_offset++] = (MULTI_ENCRYPTION_FORMAT_v001_HEADER >> 8) & 0xff ;
-        
-        // number of keys
-        
-        out[out_offset++] =   keys.size()       & 0xff ;
-        out[out_offset++] =  (keys.size() >> 8) & 0xff ;
-                
-        // encrypted keys, each preceeded with its length
-        
-        for(uint32_t i=0;i<keys.size();++i)
-        {
-            if(eklen[i] != MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE)
-            {
-                std::cerr << "(EE) eklen[i]=" << eklen[i] << " in " << __PRETTY_FUNCTION__ << " for key id " << keys[i].keyId << ". This is unexpected. Cannot encrypt." << std::endl;
-                throw std::runtime_error("Encryption error") ;
-            }
-            
-            memcpy((unsigned char*)out + out_offset, ek[i],eklen[i]) ;
-            out_offset += eklen[i] ;
-        }
-        
-	memcpy((unsigned char*)out + out_offset, iv, EVP_MAX_IV_LENGTH);
-	out_offset += EVP_MAX_IV_LENGTH;
-
-	int out_currOffset = 0;
-    
-	// now encrypt actual data
-	if(!EVP_SealUpdate(&ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen)) 
-	    throw std::runtime_error("Encryption error in SealUpdate()") ;
-
-	// move along to partial block space
-	out_offset += out_currOffset;
-
-	// add padding
-	if(!EVP_SealFinal(&ctx, (unsigned char*) out + out_offset, &out_currOffset)) 
-	    throw std::runtime_error("Encryption error in SealFinal()") ;
-
-	// move to end
-	out_offset += out_currOffset;
-
-	// make sure offset has not gone passed valid memory bounds
-    
-	if(out_offset > max_outlen) 
-	    throw std::runtime_error("Memory used by encryption exceeds allocated memory block") ;
-
-	// free encrypted key data
-    
-    	for(uint32_t i=0;i<keys.size();++i)
-	    if(ek[i]) free(ek[i]);
-
-	outlen = out_offset;
-    
-	EVP_CIPHER_CTX_cleanup(&ctx);
-	return true;
-    }
-    catch(std::exception& e)
-    {
-        std::cerr << "(EE) Exception caught while encrypting: " << e.what() << std::endl;
-        
-	EVP_CIPHER_CTX_cleanup(&ctx);
-    
-	if(out) free(out) ;
 	out = NULL ;
-        
-    	for(uint32_t i=0;i<public_keys.size();++i)
-            EVP_PKEY_free(public_keys[i]) ;
-        public_keys.clear() ;
-        
-        return false ;
-    }
+	EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
+	std::vector<EVP_PKEY *> public_keys(keys.size(),NULL);
+
+	try
+	{
+		for(uint32_t i=0;i<keys.size();++i)
+		{
+			RSA *tmpkey = ::extractPublicKey(keys[i]) ;
+			RSA *rsa_publish_pub = RSAPublicKey_dup(tmpkey) ;
+			RSA_free(tmpkey) ;
+
+			if(rsa_publish_pub  != NULL)
+			{
+				public_keys[i] = EVP_PKEY_new();
+				EVP_PKEY_assign_RSA(public_keys[i], rsa_publish_pub);
+			}
+			else
+			{
+				std::cerr << "GxsSecurity(): Could not generate public key for key id " << keys[i].keyId << std::endl;
+				throw std::runtime_error("Cannot extract public key") ;
+			}
+		}
+
+		unsigned char iv[EVP_MAX_IV_LENGTH];
+
+		std::vector<unsigned char *> ek(keys.size(),NULL) ;
+		std::vector<int> eklen(keys.size(),0) ;
+
+		for(uint32_t i=0;i<keys.size();++i)
+		{
+			int max_evp_key_size = EVP_PKEY_size(public_keys[i]);
+
+			if(max_evp_key_size != MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE)
+				throw std::runtime_error("EVP_PKEY_size should be equal to 256. It's not!") ;
+
+			ek[i] = (unsigned char*)rs_malloc(max_evp_key_size);
+			if(ek[i] == NULL)
+				throw std::runtime_error("malloc error on encrypted keys") ;
+		}
+
+		const EVP_CIPHER *cipher = EVP_aes_128_cbc();
+		int cipher_block_size = EVP_CIPHER_block_size(cipher);
+
+		// intialize context and send store encrypted cipher in ek
+		if(!EVP_SealInit(ctx, EVP_aes_128_cbc(), ek.data(), eklen.data(), iv, public_keys.data(), keys.size()))
+			return false;
+
+		// now we can release the encryption keys
+		for(uint32_t i=0;i<public_keys.size();++i)
+			EVP_PKEY_free(public_keys[i]) ;
+		public_keys.clear() ;
+
+		int total_ek_size = MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE * keys.size() ;
+
+		int max_outlen = MULTI_ENCRYPTION_FORMAT_v001_HEADER_SIZE + MULTI_ENCRYPTION_FORMAT_v001_NUMBER_OF_KEYS_SIZE + total_ek_size + EVP_MAX_IV_LENGTH + (inlen + cipher_block_size) ;
+
+		// now assign memory to out accounting for data, and cipher block size, key length, and key length val
+		out = (uint8_t*)rs_malloc(max_outlen);
+
+		if(out == NULL)
+			return false ;
+
+		int out_offset = 0;
+
+		// header
+
+		out[out_offset++] =  MULTI_ENCRYPTION_FORMAT_v001_HEADER       & 0xff ;
+		out[out_offset++] = (MULTI_ENCRYPTION_FORMAT_v001_HEADER >> 8) & 0xff ;
+
+		// number of keys
+
+		out[out_offset++] =   keys.size()       & 0xff ;
+		out[out_offset++] =  (keys.size() >> 8) & 0xff ;
+
+		// encrypted keys, each preceeded with its length
+
+		for(uint32_t i=0;i<keys.size();++i)
+		{
+			if(eklen[i] != MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE)
+			{
+				std::cerr << "(EE) eklen[i]=" << eklen[i] << " in " << __PRETTY_FUNCTION__ << " for key id " << keys[i].keyId << ". This is unexpected. Cannot encrypt." << std::endl;
+				throw std::runtime_error("Encryption error") ;
+			}
+
+			memcpy((unsigned char*)out + out_offset, ek[i],eklen[i]) ;
+			out_offset += eklen[i] ;
+		}
+
+		memcpy((unsigned char*)out + out_offset, iv, EVP_MAX_IV_LENGTH);
+		out_offset += EVP_MAX_IV_LENGTH;
+
+		int out_currOffset = 0;
+
+		// now encrypt actual data
+		if(!EVP_SealUpdate(ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen))
+			throw std::runtime_error("Encryption error in SealUpdate()") ;
+
+		// move along to partial block space
+		out_offset += out_currOffset;
+
+		// add padding
+		if(!EVP_SealFinal(ctx, (unsigned char*) out + out_offset, &out_currOffset))
+			throw std::runtime_error("Encryption error in SealFinal()") ;
+
+		// move to end
+		out_offset += out_currOffset;
+
+		// make sure offset has not gone passed valid memory bounds
+
+		if(out_offset > max_outlen)
+			throw std::runtime_error("Memory used by encryption exceeds allocated memory block") ;
+
+		// free encrypted key data
+
+		for(uint32_t i=0;i<keys.size();++i)
+			if(ek[i]) free(ek[i]);
+
+		outlen = out_offset;
+
+		EVP_CIPHER_CTX_free(ctx);
+		return true;
+	}
+	catch(std::exception& e)
+	{
+		std::cerr << "(EE) Exception caught while encrypting: " << e.what() << std::endl;
+
+		EVP_CIPHER_CTX_free(ctx);
+
+		if(out) free(out) ;
+		out = NULL ;
+
+		for(uint32_t i=0;i<public_keys.size();++i)
+			EVP_PKEY_free(public_keys[i]) ;
+		public_keys.clear() ;
+
+		return false ;
+	}
 }
 
 bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in, uint32_t inlen, const RsTlvPrivateRSAKey &key)
@@ -794,7 +815,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
 	}
 
 
-    EVP_CIPHER_CTX ctx;
+    EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
     int eklen = 0, net_ekl = 0;
 	unsigned char *ek = (unsigned char*)rs_malloc(EVP_PKEY_size(privateKey));
     
@@ -802,7 +823,6 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
         return false ;
     
     unsigned char iv[EVP_MAX_IV_LENGTH];
-    EVP_CIPHER_CTX_init(&ctx);
 
     int in_offset = 0, out_currOffset = 0;
     int size_net_ekl = sizeof(net_ekl);
@@ -827,7 +847,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
 
     const EVP_CIPHER* cipher = EVP_aes_128_cbc();
 
-    if(!EVP_OpenInit(&ctx, cipher, ek, eklen, iv, privateKey)) 
+    if(!EVP_OpenInit(ctx, cipher, ek, eklen, iv, privateKey))
     {
         std::cerr << "(EE) Cannot decrypt data. Most likely reason: private GXS key is missing." << std::endl;
         return false;
@@ -843,7 +863,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
     if(out == NULL)
          return false;
 
-    if(!EVP_OpenUpdate(&ctx, (unsigned char*) out, &out_currOffset, (unsigned char*)in + in_offset, inlen - in_offset)) 
+    if(!EVP_OpenUpdate(ctx, (unsigned char*) out, &out_currOffset, (unsigned char*)in + in_offset, inlen - in_offset))
 	 {
          free(out) ;
 		 out = NULL ;
@@ -852,7 +872,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
 
     outlen = out_currOffset;
 
-    if(!EVP_OpenFinal(&ctx, (unsigned char*)out + out_currOffset, &out_currOffset)) 
+    if(!EVP_OpenFinal(ctx, (unsigned char*)out + out_currOffset, &out_currOffset))
 	 {
          free(out) ;
 		 out = NULL ;
@@ -862,7 +882,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
     outlen += out_currOffset;
     free(ek);
 
-	EVP_CIPHER_CTX_cleanup(&ctx);
+	EVP_CIPHER_CTX_free(ctx);
 	 return true;
 }
 
@@ -879,8 +899,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
 #ifdef DISTRIB_DEBUG
 	std::cerr << "GxsSecurity::decrypt() " << std::endl;
 #endif
-	EVP_CIPHER_CTX ctx;
-	    EVP_CIPHER_CTX_init(&ctx);
+	EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
     
     try
     {
@@ -951,10 +970,10 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
 
 		    for(uint32_t i=0;i<number_of_keys && !succeed;++i)
 		    {
-			    succeed = EVP_OpenInit(&ctx, EVP_aes_128_cbc(),in + encrypted_keys_offset + i*MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE , MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE, in+IV_offset, privateKey);
+			    succeed = EVP_OpenInit(ctx, EVP_aes_128_cbc(),in + encrypted_keys_offset + i*MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE , MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE, in+IV_offset, privateKey);
 
 			if(!succeed)
-					EVP_CIPHER_CTX_cleanup(&ctx);
+					EVP_CIPHER_CTX_cleanup(ctx);
                             
 #ifdef GXS_SECURITY_DEBUG
 			    std::cerr << "    encrypted key at offset " << encrypted_keys_offset + i*MULTI_ENCRYPTION_FORMAT_v001_ENCRYPTED_KEY_SIZE << ": " << succeed << std::endl;
@@ -978,12 +997,12 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
 
 	    int out_currOffset = 0 ;
 
-	    if(!EVP_OpenUpdate(&ctx, (unsigned char*) out, &out_currOffset, (unsigned char*)in + encrypted_block_offset, encrypted_block_size)) 
+	    if(!EVP_OpenUpdate(ctx, (unsigned char*) out, &out_currOffset, (unsigned char*)in + encrypted_block_offset, encrypted_block_size))
 		    throw std::runtime_error("Decryption error in EVP_OpenUpdate") ;
 
 	    outlen = out_currOffset;
 
-	    if(!EVP_OpenFinal(&ctx, (unsigned char*)out + out_currOffset, &out_currOffset)) 
+	    if(!EVP_OpenFinal(ctx, (unsigned char*)out + out_currOffset, &out_currOffset))
 		    throw std::runtime_error("Decryption error in EVP_OpenFinal") ;
 
 	    outlen += out_currOffset;
@@ -991,7 +1010,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
 #ifdef GXS_SECURITY_DEBUG
         	std::cerr << "  successfully decrypted block of size " << outlen << std::endl;
 #endif
-	    EVP_CIPHER_CTX_cleanup(&ctx);
+	    EVP_CIPHER_CTX_free(ctx);
 	    return true;
     }
     catch(std::exception& e)
@@ -1007,7 +1026,7 @@ bool GxsSecurity::decrypt(uint8_t *& out, uint32_t & outlen, const uint8_t *in,
             out = NULL ;
         }
         
-	EVP_CIPHER_CTX_cleanup(&ctx);
+	EVP_CIPHER_CTX_free(ctx);
         return false;
     }
 }
diff --git a/libretroshare/src/gxstunnel/p3gxstunnel.cc b/libretroshare/src/gxstunnel/p3gxstunnel.cc
index a05ba34d0..3ad4198a9 100644
--- a/libretroshare/src/gxstunnel/p3gxstunnel.cc
+++ b/libretroshare/src/gxstunnel/p3gxstunnel.cc
@@ -1055,7 +1055,13 @@ bool p3GxsTunnelService::locked_sendDHPublicKey(const DH *dh,const RsGxsId& own_
 	}
 
 	RsGxsTunnelDHPublicKeyItem *dhitem = new RsGxsTunnelDHPublicKeyItem ;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	dhitem->public_key = BN_dup(dh->pub_key) ;
+#else
+    const BIGNUM *pub_key=NULL ;
+    DH_get0_key(dh,&pub_key,NULL) ;
+	dhitem->public_key = BN_dup(pub_key) ;
+#endif
 
 	// we should also sign the data and check the signature on the other end.
 	//
@@ -1133,8 +1139,18 @@ bool p3GxsTunnelService::locked_initDHSessionKey(DH *& dh)
         return false ;
     }
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     BN_hex2bn(&dh->p,dh_prime_2048_hex.c_str()) ;
     BN_hex2bn(&dh->g,"5") ;
+#else
+    BIGNUM *pp=NULL ;
+    BIGNUM *gg=NULL ;
+
+    BN_hex2bn(&pp,dh_prime_2048_hex.c_str()) ;
+    BN_hex2bn(&gg,"5") ;
+
+    DH_set0_pqg(dh,pp,NULL,gg) ;
+#endif
 
     int codes = 0 ;
 
diff --git a/libretroshare/src/pqi/authssl.cc b/libretroshare/src/pqi/authssl.cc
index 07c12b942..4191e0b4f 100644
--- a/libretroshare/src/pqi/authssl.cc
+++ b/libretroshare/src/pqi/authssl.cc
@@ -245,12 +245,18 @@ sslcert::sslcert(X509 *x509, const RsPeerId& pid)
 {
 	certificate = x509;
 	id = pid;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	name = getX509CNString(x509->cert_info->subject);
 	org = getX509OrgString(x509->cert_info->subject);
 	location = getX509LocString(x509->cert_info->subject);
-	email = "";
-
 	issuer = RsPgpId(std::string(getX509CNString(x509->cert_info->issuer)));
+#else
+	name = getX509CNString(X509_get_subject_name(x509));
+	org = getX509OrgString(X509_get_subject_name(x509));
+	location = getX509LocString(X509_get_subject_name(x509));
+	issuer = RsPgpId(std::string(getX509CNString(X509_get_issuer_name(x509))));
+#endif
+	email = "";
 
 	authed = false;
 }
@@ -371,8 +377,17 @@ static  int initLib = 0;
 
 	if (dh)
 	{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 		BN_hex2bn(&dh->p,dh_prime_4096_hex.c_str()) ;
 		BN_hex2bn(&dh->g,"5") ;
+#else
+        BIGNUM *pp=NULL,*gg=NULL ;
+
+        BN_hex2bn(&pp,dh_prime_4096_hex.c_str()) ;
+        BN_hex2bn(&gg,"5");
+
+        DH_set0_pqg(dh,pp,NULL,gg) ;
+#endif
 
 		std::cout.flush() ;
 
@@ -776,47 +791,72 @@ X509 *AuthSSLimpl::SignX509ReqWithGPG(X509_REQ *req, long /*days*/)
         std::cerr << "X509 Cert, prepared for signing" << std::endl;
 
         /*** NOW The Manual signing bit (HACKED FROM asn1/a_sign.c) ***/
+        //
+        // The code has been copied in order to use the PGP signing instead of supplying the
+        // private EVP_KEY to ASN1_sign(), which would be another alternative.
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
         int (*i2d)(X509_CINF*, unsigned char**) = i2d_X509_CINF;
         X509_ALGOR *algor1 = x509->cert_info->signature;
         X509_ALGOR *algor2 = x509->sig_alg;
         ASN1_BIT_STRING *signature = x509->signature;
         X509_CINF *data = x509->cert_info;
+#else
+        const X509_ALGOR *algor1 = X509_get0_tbs_sigalg(x509) ;
+        const X509_ALGOR *algor2 = NULL ;
+
+        const ASN1_BIT_STRING *tmp_signature = NULL ;
+
+        X509_get0_signature(&tmp_signature,&algor2,x509);
+
+        ASN1_BIT_STRING *signature = const_cast<ASN1_BIT_STRING*>(tmp_signature);
+#endif
         //EVP_PKEY *pkey = NULL;
         const EVP_MD *type = EVP_sha1();
 
-        EVP_MD_CTX ctx;
+        EVP_MD_CTX *ctx = EVP_MD_CTX_create();
         unsigned char *p,*buf_in=NULL;
         unsigned char *buf_hashout=NULL,*buf_sigout=NULL;
         int inl=0,hashoutl=0;
         int sigoutl=0;
         X509_ALGOR *a;
 
-        EVP_MD_CTX_init(&ctx);
-
         /* FIX ALGORITHMS */
 
-        a = algor1;
+        a = const_cast<X509_ALGOR*>(algor1);
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
         ASN1_TYPE_free(a->parameter);
         a->parameter=ASN1_TYPE_new();
         a->parameter->type=V_ASN1_NULL;
 
         ASN1_OBJECT_free(a->algorithm);
         a->algorithm=OBJ_nid2obj(type->pkey_type);
+#else
+        X509_ALGOR_set0(a,OBJ_nid2obj(EVP_MD_pkey_type(type)),V_ASN1_NULL,NULL);
+#endif
 
-        a = algor2;
+        a = const_cast<X509_ALGOR*>(algor2);
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
         ASN1_TYPE_free(a->parameter);
         a->parameter=ASN1_TYPE_new();
         a->parameter->type=V_ASN1_NULL;
 
         ASN1_OBJECT_free(a->algorithm);
-        a->algorithm=OBJ_nid2obj(type->pkey_type);
+		a->algorithm=OBJ_nid2obj(type->pkey_type);
+#else
+        X509_ALGOR_set0(a,OBJ_nid2obj(EVP_MD_pkey_type(type)),V_ASN1_NULL,NULL);
+#endif
 
 
         std::cerr << "Algorithms Fixed" << std::endl;
 
         /* input buffer */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
         inl=i2d(data,NULL);
         buf_in=(unsigned char *)OPENSSL_malloc((unsigned int)inl);
+#else
+        inl=i2d_re_X509_tbs(x509,&buf_in) ;	// this does the i2d over x509->cert_info
+#endif
 
         hashoutl=EVP_MD_size(type);
         buf_hashout=(unsigned char *)OPENSSL_malloc((unsigned int)hashoutl);
@@ -831,15 +871,17 @@ X509 *AuthSSLimpl::SignX509ReqWithGPG(X509_REQ *req, long /*days*/)
                 fprintf(stderr, "AuthSSLimpl::SignX509Req: ASN1err(ASN1_F_ASN1_SIGN,ERR_R_MALLOC_FAILURE)\n");
                 goto err;
                 }
-        p=buf_in;
-
         std::cerr << "Buffers Allocated" << std::endl;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+        p=buf_in;
         i2d(data,&p);
+#endif
+
         /* data in buf_in, ready to be hashed */
-        EVP_DigestInit_ex(&ctx,type, NULL);
-        EVP_DigestUpdate(&ctx,(unsigned char *)buf_in,inl);
-        if (!EVP_DigestFinal(&ctx,(unsigned char *)buf_hashout,
+        EVP_DigestInit_ex(ctx,type, NULL);
+        EVP_DigestUpdate(ctx,(unsigned char *)buf_in,inl);
+        if (!EVP_DigestFinal(ctx,(unsigned char *)buf_hashout,
                         (unsigned int *)&hashoutl))
                 {
                 hashoutl=0;
@@ -879,6 +921,8 @@ X509 *AuthSSLimpl::SignX509ReqWithGPG(X509_REQ *req, long /*days*/)
 
         std::cerr << "Certificate Complete" << std::endl;
 
+        EVP_MD_CTX_destroy(ctx) ;
+
         return x509;
 
 	/* XXX CLEANUP */
@@ -915,7 +959,11 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic)
 	}
 
 	/* extract CN for peer Id */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	RsPgpId issuer(std::string(getX509CNString(x509->cert_info->issuer)));
+#else
+	RsPgpId issuer(std::string(getX509CNString(X509_get_issuer_name(x509))));
+#endif
 	RsPeerDetails pd;
 #ifdef AUTHSSL_DEBUG
 	std::cerr << "Checking GPG issuer : " << issuer.toStdString() << std::endl ;
@@ -930,22 +978,33 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic)
 
 	/*** NOW The Manual signing bit (HACKED FROM asn1/a_sign.c) ***/
 	int (*i2d)(X509_CINF*, unsigned char**) = i2d_X509_CINF;
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	ASN1_BIT_STRING *signature = x509->signature;
 	X509_CINF *data = x509->cert_info;
+#else
+	const ASN1_BIT_STRING *signature = NULL ;
+    const X509_ALGOR *algor2=NULL;
+
+	X509_get0_signature(&signature,&algor2,x509);
+#endif
+
+
 	const EVP_MD *type = EVP_sha1();
 
-	EVP_MD_CTX ctx;
+	EVP_MD_CTX *ctx = EVP_MD_CTX_create();
 	unsigned char *p,*buf_in=NULL;
 	unsigned char *buf_hashout=NULL,*buf_sigout=NULL;
 	int inl=0,hashoutl=0;
 	int sigoutl=0;
-	//X509_ALGOR *a;
-
-	EVP_MD_CTX_init(&ctx);
 
 	/* input buffer */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	inl=i2d(data,NULL);
 	buf_in=(unsigned char *)OPENSSL_malloc((unsigned int)inl);
+#else
+	inl=i2d_re_X509_tbs(x509,&buf_in) ;	// this does the i2d over x509->cert_info
+#endif
 
 	hashoutl=EVP_MD_size(type);
 	buf_hashout=(unsigned char *)OPENSSL_malloc((unsigned int)hashoutl);
@@ -973,11 +1032,13 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic)
 	std::cerr << "Buffers Allocated" << std::endl;
 #endif
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	i2d(data,&p);
+#endif
 	/* data in buf_in, ready to be hashed */
-	EVP_DigestInit_ex(&ctx,type, NULL);
-	EVP_DigestUpdate(&ctx,(unsigned char *)buf_in,inl);
-	if (!EVP_DigestFinal(&ctx,(unsigned char *)buf_hashout,
+	EVP_DigestInit_ex(ctx,type, NULL);
+	EVP_DigestUpdate(ctx,(unsigned char *)buf_in,inl);
+	if (!EVP_DigestFinal(ctx,(unsigned char *)buf_hashout,
 				(unsigned int *)&hashoutl))
 	{
 		hashoutl=0;
@@ -1017,6 +1078,7 @@ bool AuthSSLimpl::AuthX509WithGPG(X509 *x509,uint32_t& diagnostic)
 #ifdef AUTHSSL_DEBUG
 	std::cerr << "AuthSSLimpl::AuthX509() X509 authenticated" << std::endl;
 #endif
+    EVP_MD_CTX_destroy(ctx) ;
 
 	OPENSSL_free(buf_in) ;
 	OPENSSL_free(buf_hashout) ;
@@ -1093,21 +1155,34 @@ static int verify_x509_callback(int preverify_ok, X509_STORE_CTX *ctx)
 
 	if(x509 != NULL)
 	{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 		RsPgpId gpgid (std::string(getX509CNString(x509->cert_info->issuer)));
+#else
+		RsPgpId gpgid (std::string(getX509CNString(X509_get_issuer_name(x509))));
+#endif
+
 		if(gpgid.isNull()) 
 		{
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 			std::cerr << "verify_x509_callback(): wrong PGP id \"" << std::string(getX509CNString(x509->cert_info->issuer)) << "\"" << std::endl;
+#else
+			std::cerr << "verify_x509_callback(): wrong PGP id \"" << std::string(getX509CNString(X509_get_issuer_name(x509))) << "\"" << std::endl;
+#endif
 			return false ;
 		}
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 		std::string sslcn = getX509CNString(x509->cert_info->subject);
+#else
+		std::string sslcn = getX509CNString(X509_get_subject_name(x509));
+#endif
 		RsPeerId sslid ;
 
 		getX509id(x509,sslid);
 
 		if(sslid.isNull()) 
 		{
-			std::cerr << "verify_x509_callback(): wrong SSL id \"" << std::string(getX509CNString(x509->cert_info->subject)) << "\"" << std::endl;
+			std::cerr << "verify_x509_callback(): wrong PGP id \"" << sslcn << "\"" << std::endl;
 			return false ;
 		}
 
@@ -1185,7 +1260,11 @@ int AuthSSLimpl::VerifyX509Callback(int preverify_ok, X509_STORE_CTX *ctx)
             std::cerr << "(WW) Certificate was rejected because authentication failed. Diagnostic = " << auth_diagnostic << std::endl;
             return false;
         }
-        RsPgpId pgpid = RsPgpId(std::string(getX509CNString(X509_STORE_CTX_get_current_cert(ctx)->cert_info->issuer)));
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+        RsPgpId pgpid(std::string(getX509CNString(X509_STORE_CTX_get_current_cert(ctx)->cert_info->issuer)));
+#else
+        RsPgpId pgpid(std::string(getX509CNString(X509_get_issuer_name(X509_STORE_CTX_get_current_cert(ctx)))));
+#endif
 
         if (pgpid != AuthGPG::getAuthGPG()->getGPGOwnId() && !AuthGPG::getAuthGPG()->isGPGAccepted(pgpid))
         {
@@ -1258,15 +1337,18 @@ bool    AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen,
                 #endif
                 return false;
             } else {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
                 public_key = mCerts[peerId]->certificate->cert_info->key->pkey;
+#else
+                public_key = X509_get0_pubkey(mCerts[peerId]->certificate) ;
+#endif
             }
         }
 
-        EVP_CIPHER_CTX ctx;
+        EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
         int eklen, net_ekl;
         unsigned char *ek;
         unsigned char iv[EVP_MAX_IV_LENGTH];
-        EVP_CIPHER_CTX_init(&ctx);
         int out_currOffset = 0;
         int out_offset = 0;
 
@@ -1283,7 +1365,7 @@ bool    AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen,
         int max_outlen = inlen + cipher_block_size + EVP_MAX_IV_LENGTH + max_evp_key_size + size_net_ekl;
 
         // intialize context and send store encrypted cipher in ek
-        if(!EVP_SealInit(&ctx, EVP_aes_128_cbc(), &ek, &eklen, iv, &public_key, 1)) {
+        if(!EVP_SealInit(ctx, EVP_aes_128_cbc(), &ek, &eklen, iv, &public_key, 1)) {
             free(ek);
             return false;
         }
@@ -1307,7 +1389,7 @@ bool    AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen,
     	out_offset += EVP_MAX_IV_LENGTH;
 
     	// now encrypt actual data
-        if(!EVP_SealUpdate(&ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen)) {
+        if(!EVP_SealUpdate(ctx, (unsigned char*) out + out_offset, &out_currOffset, (unsigned char*) in, inlen)) {
             free(ek);
             free(out);
             out = NULL;
@@ -1318,7 +1400,7 @@ bool    AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen,
     	out_offset += out_currOffset;
 
     	// add padding
-        if(!EVP_SealFinal(&ctx, (unsigned char*) out + out_offset, &out_currOffset)) {
+        if(!EVP_SealFinal(ctx, (unsigned char*) out + out_offset, &out_currOffset)) {
             free(ek);
 				free(out) ;
             out = NULL;
@@ -1334,7 +1416,7 @@ bool    AuthSSLimpl::encrypt(void *&out, int &outlen, const void *in, int inlen,
     	// free encrypted key data
     	free(ek);
 
-        EVP_CIPHER_CTX_cleanup(&ctx);
+        EVP_CIPHER_CTX_free(ctx);
 
     	outlen = out_offset;
 
@@ -1358,7 +1440,7 @@ bool    AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen)
 //        out = malloc(inlen);
 //        memcpy(out, in, inlen);
 //        outlen = inlen;
-        EVP_CIPHER_CTX ctx;
+        EVP_CIPHER_CTX *ctx = EVP_CIPHER_CTX_new();
         int eklen = 0, net_ekl = 0;
         unsigned char *ek = NULL;
         unsigned char iv[EVP_MAX_IV_LENGTH];
@@ -1370,7 +1452,6 @@ bool    AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen)
             std::cerr << "(EE) Cannot allocate memory for " << ek_mkl << " bytes in " << __PRETTY_FUNCTION__ << std::endl;
             return false ;
         }
-        EVP_CIPHER_CTX_init(&ctx);
 
         int in_offset = 0, out_currOffset = 0;
         int size_net_ekl = sizeof(net_ekl);
@@ -1402,7 +1483,7 @@ bool    AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen)
 
         const EVP_CIPHER* cipher = EVP_aes_128_cbc();
 
-        if(0 == EVP_OpenInit(&ctx, cipher, ek, eklen, iv, mOwnPrivateKey)) {
+        if(0 == EVP_OpenInit(ctx, cipher, ek, eklen, iv, mOwnPrivateKey)) {
             free(ek);
             return false;
         }
@@ -1414,7 +1495,7 @@ bool    AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen)
             free(ek) ;
             return false ;
         }
-        if(!EVP_OpenUpdate(&ctx, (unsigned char*) out, &out_currOffset, (unsigned char*)in + in_offset, inlen - in_offset)) {
+        if(!EVP_OpenUpdate(ctx, (unsigned char*) out, &out_currOffset, (unsigned char*)in + in_offset, inlen - in_offset)) {
             free(ek);
 				free(out) ;
             out = NULL;
@@ -1424,7 +1505,7 @@ bool    AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen)
         in_offset += out_currOffset;
         outlen += out_currOffset;
 
-        if(!EVP_OpenFinal(&ctx, (unsigned char*)out + out_currOffset, &out_currOffset)) {
+        if(!EVP_OpenFinal(ctx, (unsigned char*)out + out_currOffset, &out_currOffset)) {
             free(ek);
 				free(out) ;
             out = NULL;
@@ -1436,7 +1517,7 @@ bool    AuthSSLimpl::decrypt(void *&out, int &outlen, const void *in, int inlen)
         if(ek != NULL)
         	free(ek);
 
-        EVP_CIPHER_CTX_cleanup(&ctx);
+        EVP_CIPHER_CTX_free(ctx);
 
 #ifdef AUTHSSL_DEBUG
 		  std::cerr << "AuthSSLimpl::decrypt() finished with outlen : " << outlen << std::endl;
diff --git a/libretroshare/src/pqi/pqissl.cc b/libretroshare/src/pqi/pqissl.cc
index 795691586..b7709bb82 100644
--- a/libretroshare/src/pqi/pqissl.cc
+++ b/libretroshare/src/pqi/pqissl.cc
@@ -361,7 +361,11 @@ void pqissl::getCryptoParams(RsPeerCryptoParams& params)
 
 bool pqissl::actAsServer()
 {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	return (bool)ssl_connection->server;
+#else
+	return (bool)SSL_is_server(ssl_connection);
+#endif
 }
 
 /* returns ...
@@ -1226,8 +1230,13 @@ int 	pqissl::Extract_Failed_SSL_Certificate()
 	RsPeerId sslid ;
 	getX509id(peercert, sslid) ;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	RsPgpId gpgid(getX509CNString(peercert->cert_info->issuer));
 	std::string sslcn = getX509CNString(peercert->cert_info->subject);
+#else
+	RsPgpId gpgid(getX509CNString(X509_get_issuer_name(peercert)));
+	std::string sslcn = getX509CNString(X509_get_subject_name(peercert));
+#endif
 
 	AuthSSL::getAuthSSL()->FailedCertificate(peercert, gpgid,sslid,sslcn,remote_addr, false);
 	mLinkMgr->notifyDeniedConnection(gpgid, sslid, sslcn, remote_addr, false);
diff --git a/libretroshare/src/pqi/pqissllistener.cc b/libretroshare/src/pqi/pqissllistener.cc
index 189eb5dce..9c2040247 100644
--- a/libretroshare/src/pqi/pqissllistener.cc
+++ b/libretroshare/src/pqi/pqissllistener.cc
@@ -494,8 +494,13 @@ int	pqissllistenbase::continueSSL(IncomingSSLInfo& incoming_connexion_info, bool
 #endif
     if(x509 != NULL)
     {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
         incoming_connexion_info.gpgid = RsPgpId(std::string(getX509CNString(x509->cert_info->issuer)));
         incoming_connexion_info.sslcn = getX509CNString(x509->cert_info->subject);
+#else
+        incoming_connexion_info.gpgid = RsPgpId(std::string(getX509CNString(X509_get_issuer_name(x509))));
+        incoming_connexion_info.sslcn = getX509CNString(X509_get_subject_name(x509));
+#endif
 
         getX509id(x509,incoming_connexion_info.sslid);
 
@@ -888,7 +893,11 @@ int pqissllistener::completeConnection(int fd, IncomingSSLInfo& info)
 		AuthSSL::getAuthSSL()->CheckCertificate(newPeerId, peercert);
 
 		/* now need to get GPG id too */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 		RsPgpId pgpid(std::string(getX509CNString(peercert->cert_info->issuer)));
+#else
+		RsPgpId pgpid(std::string(getX509CNString(X509_get_issuer_name(peercert))));
+#endif
 		mPeerMgr->addFriend(newPeerId, pgpid);
 	
 		X509_free(peercert);
diff --git a/libretroshare/src/pqi/pqistreamer.cc b/libretroshare/src/pqi/pqistreamer.cc
index 9694f9ce3..839a5364e 100644
--- a/libretroshare/src/pqi/pqistreamer.cc
+++ b/libretroshare/src/pqi/pqistreamer.cc
@@ -26,6 +26,7 @@
 
 #include "pqi/pqistreamer.h"
 
+#include <sys/time.h>             // for gettimeofday
 #include <stdlib.h>               // for free, realloc, exit
 #include <string.h>               // for memcpy, memset, memcmp
 #include <time.h>                 // for NULL, time, time_t
diff --git a/libretroshare/src/pqi/sslfns.cc b/libretroshare/src/pqi/sslfns.cc
index 07ec804a2..7cf742956 100644
--- a/libretroshare/src/pqi/sslfns.cc
+++ b/libretroshare/src/pqi/sslfns.cc
@@ -242,6 +242,7 @@ X509_REQ *GenerateX509Req(
 
 #define SERIAL_RAND_BITS 	64
 
+#ifdef UNUSED_CODE
 X509 *SignX509Certificate(X509_NAME *issuer, EVP_PKEY *privkey, X509_REQ *req, long days)
 {
 	const EVP_MD *digest = EVP_sha1();
@@ -369,6 +370,7 @@ X509 *SignX509Certificate(X509_NAME *issuer, EVP_PKEY *privkey, X509_REQ *req, l
 
 	return x509;
 }
+#endif
 
 /********************************************************************************/
 /********************************************************************************/
@@ -600,7 +602,14 @@ bool getX509id(X509 *x509, RsPeerId& xid)
 	}
 
 	// get the signature from the cert, and copy to the array.
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	ASN1_BIT_STRING *signature = x509->signature;
+#else
+	const ASN1_BIT_STRING *signature = NULL ;
+    const X509_ALGOR *algor ;
+
+    X509_get0_signature(&signature,&algor,x509);
+#endif
 	int signlen = ASN1_STRING_length(signature);
 	if (signlen < CERTSIGNLEN)
 	{
@@ -612,12 +621,14 @@ bool getX509id(X509 *x509, RsPeerId& xid)
 	}
 
 	// else copy in the first CERTSIGNLEN.
-	unsigned char *signdata = ASN1_STRING_data(signature);
+	unsigned char *signdata = ASN1_STRING_data(const_cast<ASN1_BIT_STRING*>(signature));
 
 	/* switched to the other end of the signature. for
 	 * more randomness
 	 */
 
+#warning this is cryptographically horrible. We should do a hash of the public key here!!!
+
 	xid = RsPeerId(&signdata[signlen - CERTSIGNLEN]) ;
 
 	//for(int i = signlen - CERTSIGNLEN; i < signlen; i++)
@@ -689,8 +700,13 @@ int	LoadCheckX509(const char *cert_file, RsPgpId& issuerName, std::string &locat
 	if (valid)
 	{
 		// extract the name.
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 		issuerName = RsPgpId(std::string(getX509CNString(x509->cert_info->issuer)));
 		location = getX509LocString(x509->cert_info->subject);
+#else
+		issuerName = RsPgpId(std::string(getX509CNString(X509_get_issuer_name(x509))));
+		location = getX509LocString(X509_get_subject_name(x509));
+#endif
 	}
 
 #ifdef AUTHSSL_DEBUG
diff --git a/libretroshare/src/tcponudp/bss_tou.c b/libretroshare/src/tcponudp/bss_tou.c
index f96abb19d..72969562f 100644
--- a/libretroshare/src/tcponudp/bss_tou.c
+++ b/libretroshare/src/tcponudp/bss_tou.c
@@ -90,7 +90,28 @@ static int clear_tou_socket_error(int s);
 
 #include "tou.h"
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+//static void BIO_set_shutdown(BIO *a,int s) { a->shutdown=s; }
 
+static int  BIO_get_shutdown(BIO *a) { return a->shutdown; }
+static int  BIO_get_init(BIO *a) { return a->init; }
+static void BIO_set_init(BIO *a,int i) { a->init=i; }
+static void BIO_set_data(BIO *a,void *p) { a->ptr = p; }
+#else
+typedef struct bio_method_st {
+    int type;
+    const char *name;
+    int (*bwrite) (BIO *, const char *, int);
+    int (*bread) (BIO *, char *, int);
+    int (*bputs) (BIO *, const char *);
+    int (*bgets) (BIO *, char *, int);
+    long (*ctrl) (BIO *, int, long, void *);
+    int (*create) (BIO *);
+    int (*destroy) (BIO *);
+    long (*callback_ctrl) (BIO *, int, bio_info_cb *);
+} BIO_METHOD;
+
+#endif
 
 static BIO_METHOD methods_tou_sockp=
 	{
@@ -132,10 +153,10 @@ static int tou_socket_new(BIO *bi)
 #ifdef DEBUG_TOU_BIO
 	fprintf(stderr, "tou_socket_new()\n");
 #endif
-	bi->init=0;
-	bi->num=0;
-	bi->ptr=NULL;
-	bi->flags=0;
+    BIO_set_init(bi,0) ;
+    BIO_set_data(bi,NULL) ;	// sets bi->ptr
+    BIO_set_flags(bi,0) ;
+    BIO_set_fd(bi,0,0) ;
 	return(1);
 	}
 
@@ -145,14 +166,15 @@ static int tou_socket_free(BIO *a)
 	fprintf(stderr, "tou_socket_free()\n");
 #endif
 	if (a == NULL) return(0);
-	if (a->shutdown)
+
+    if(BIO_get_shutdown(a))
 		{
-		if (a->init)
+		if(BIO_get_init(a))
 			{
-			tou_close(a->num);
+			tou_close(BIO_get_fd(a,NULL));
 			}
-		a->init=0;
-		a->flags=0;
+        BIO_set_init(a,0) ;
+        BIO_set_flags(a,0) ;
 		}
 	return(1);
 	}
@@ -166,13 +188,13 @@ static int tou_socket_read(BIO *b, char *out, int outl)
 
 	if (out != NULL)
 		{
-		clear_tou_socket_error(b->num);
+		clear_tou_socket_error(BIO_get_fd(b,NULL));
 		/* call tou library */
-		ret=tou_read(b->num,out,outl);
+		ret=tou_read(BIO_get_fd(b,NULL),out,outl);
 		BIO_clear_retry_flags(b);
 		if (ret <= 0)
 			{
-			if (BIO_tou_socket_should_retry(b->num, ret))
+			if (BIO_tou_socket_should_retry(BIO_get_fd(b,NULL), ret))
 				BIO_set_retry_read(b);
 			}
 		}
@@ -189,13 +211,13 @@ static int tou_socket_write(BIO *b, const char *in, int inl)
 	fprintf(stderr, "tou_socket_write(%p,%p,%d)\n",b,in,inl);
 #endif
 	
-	clear_tou_socket_error(b->num);
+	clear_tou_socket_error(BIO_get_fd(b,NULL));
 	/* call tou library */
-	ret=tou_write(b->num,in,inl);
+	ret=tou_write(BIO_get_fd(b,NULL),in,inl);
 	BIO_clear_retry_flags(b);
 	if (ret <= 0)
 		{
-		if (BIO_tou_socket_should_retry(b->num,ret))
+		if (BIO_tou_socket_should_retry(BIO_get_fd(b,NULL),ret))
 		{
 			BIO_set_retry_write(b);
 #ifdef DEBUG_TOU_BIO
@@ -212,11 +234,12 @@ static int tou_socket_write(BIO *b, const char *in, int inl)
 static long tou_socket_ctrl(BIO *b, int cmd, long num, void *ptr)
 	{
 	long ret=1;
-	int *ip;
 #ifdef DEBUG_TOU_BIO
 	fprintf(stderr, "tou_socket_ctrl(%p,%d,%ld)\n", b, cmd, num);
 #endif
 
+	// We are not allowed to call BIO_set_fd here, because it will trigger a callback, which re-ends here
+
 	switch (cmd)
 		{
 	case BIO_CTRL_RESET:
@@ -230,34 +253,26 @@ static long tou_socket_ctrl(BIO *b, int cmd, long num, void *ptr)
 		break;
 	case BIO_C_SET_FD:
 		tou_socket_free(b);
-		b->num= *((int *)ptr);
-		b->shutdown=(int)num;
-		b->init=1;
+		ret = BIO_s_fd()->ctrl(b,cmd,num,ptr) ;
+
 		break;
 	case BIO_C_GET_FD:
-		if (b->init)
-			{
-			ip=(int *)ptr;
-			if (ip != NULL) *ip=b->num;
-			ret=b->num;
-			}
-		else
-			ret= -1;
+		ret = BIO_s_fd()->ctrl(b,cmd,num,ptr) ;
 		break;
 	case BIO_CTRL_GET_CLOSE:
-		ret=b->shutdown;
+		ret = BIO_s_fd()->ctrl(b,cmd,num,ptr) ;
 		break;
 	case BIO_CTRL_SET_CLOSE:
-		b->shutdown=(int)num;
+		ret = BIO_s_fd()->ctrl(b,cmd,num,ptr) ;
 		break;
 	case BIO_CTRL_PENDING:
-		ret = tou_maxread(b->num);
+		ret = tou_maxread(BIO_get_fd(b,NULL));
 #ifdef DEBUG_TOU_BIO
 		fprintf(stderr, "tou_pending = %ld\n", ret);
 #endif
 		break;
 	case BIO_CTRL_WPENDING:
-		ret = tou_maxwrite(b->num);
+		ret = tou_maxwrite(BIO_get_fd(b,NULL));
 #ifdef DEBUG_TOU_BIO
 		fprintf(stderr, "tou_wpending = %ld\n", ret);
 #endif
diff --git a/libretroshare/src/util/rsaes.cc b/libretroshare/src/util/rsaes.cc
index 1703c4d77..7be5175f9 100644
--- a/libretroshare/src/util/rsaes.cc
+++ b/libretroshare/src/util/rsaes.cc
@@ -52,9 +52,8 @@ bool RsAES::aes_crypt_8_16(const uint8_t *input_data,uint32_t input_data_length,
 		return false ;
 	}
 
-	EVP_CIPHER_CTX e_ctx ;
-	EVP_CIPHER_CTX_init(&e_ctx);
-	EVP_EncryptInit_ex(&e_ctx, EVP_aes_256_cbc(), NULL, key, iv);
+	EVP_CIPHER_CTX *e_ctx = EVP_CIPHER_CTX_new();
+	EVP_EncryptInit_ex(e_ctx, EVP_aes_256_cbc(), NULL, key, iv);
 
 	/* max ciphertext len for a n bytes of plaintext is n + AES_BLOCK_SIZE -1 bytes */
 	int c_len = input_data_length + AES_BLOCK_SIZE ;
@@ -62,31 +61,31 @@ bool RsAES::aes_crypt_8_16(const uint8_t *input_data,uint32_t input_data_length,
 
 	if(output_data_length < (uint32_t)c_len)
     {
-	    EVP_CIPHER_CTX_cleanup(&e_ctx) ;
+	    EVP_CIPHER_CTX_free(e_ctx) ;
 	    return false ;
     }
 
 	/* update ciphertext, c_len is filled with the length of ciphertext generated,
 	 *len is the size of plaintext in bytes */
 
-	if(!EVP_EncryptUpdate(&e_ctx, output_data, &c_len, input_data, input_data_length))
+	if(!EVP_EncryptUpdate(e_ctx, output_data, &c_len, input_data, input_data_length))
 	{
 		std::cerr << "RsAES: decryption failed at end. Check padding." << std::endl;
-        	EVP_CIPHER_CTX_cleanup(&e_ctx) ;
+        	EVP_CIPHER_CTX_free(e_ctx) ;
 		return false ;
 	}
 
 	/* update ciphertext with the final remaining bytes */
-	if(!EVP_EncryptFinal_ex(&e_ctx, output_data+c_len, &f_len))
+	if(!EVP_EncryptFinal_ex(e_ctx, output_data+c_len, &f_len))
 	{
 		std::cerr << "RsAES: decryption failed at end. Check padding." << std::endl;
-        	EVP_CIPHER_CTX_cleanup(&e_ctx) ;
+        	EVP_CIPHER_CTX_free(e_ctx) ;
 		return false ;
 	}
 
 	output_data_length = c_len + f_len;
 
-	EVP_CIPHER_CTX_cleanup(&e_ctx) ;
+	EVP_CIPHER_CTX_free(e_ctx) ;
 	return true;
 }
 
@@ -108,9 +107,8 @@ bool RsAES::aes_decrypt_8_16(const uint8_t *input_data,uint32_t input_data_lengt
 		return false ;
 	}
 
-	EVP_CIPHER_CTX e_ctx ;
-	EVP_CIPHER_CTX_init(&e_ctx);
-	EVP_DecryptInit_ex(&e_ctx, EVP_aes_256_cbc(), NULL, key, iv);
+	EVP_CIPHER_CTX *e_ctx = EVP_CIPHER_CTX_new();
+	EVP_DecryptInit_ex(e_ctx, EVP_aes_256_cbc(), NULL, key, iv);
 
 	/* max ciphertext len for a n bytes of plaintext is n + AES_BLOCK_SIZE -1 bytes */
 	int c_len = input_data_length + AES_BLOCK_SIZE ;
@@ -118,7 +116,7 @@ bool RsAES::aes_decrypt_8_16(const uint8_t *input_data,uint32_t input_data_lengt
 
 	if(output_data_length < (uint32_t)c_len)
     {
-        	EVP_CIPHER_CTX_cleanup(&e_ctx) ;
+        	EVP_CIPHER_CTX_free(e_ctx) ;
 		return false ;
     }
 
@@ -127,24 +125,24 @@ bool RsAES::aes_decrypt_8_16(const uint8_t *input_data,uint32_t input_data_lengt
 	/* update ciphertext, c_len is filled with the length of ciphertext generated,
 	 *len is the size of plaintext in bytes */
 
-	if(! EVP_DecryptUpdate(&e_ctx, output_data, &c_len, input_data, input_data_length))
+	if(! EVP_DecryptUpdate(e_ctx, output_data, &c_len, input_data, input_data_length))
 	{
 		std::cerr << "RsAES: decryption failed." << std::endl;
-        	EVP_CIPHER_CTX_cleanup(&e_ctx) ;
+        	EVP_CIPHER_CTX_free(e_ctx) ;
 		return false ;
 	}
 
 	/* update ciphertext with the final remaining bytes */
-	if(!EVP_DecryptFinal_ex(&e_ctx, output_data+c_len, &f_len))
+	if(!EVP_DecryptFinal_ex(e_ctx, output_data+c_len, &f_len))
 	{
 		std::cerr << "RsAES: decryption failed at end. Check padding." << std::endl;
-        	EVP_CIPHER_CTX_cleanup(&e_ctx) ;
+        	EVP_CIPHER_CTX_free(e_ctx) ;
 		return false ;
 	}
 
 	output_data_length = c_len + f_len;
 
-	EVP_CIPHER_CTX_cleanup(&e_ctx) ;
+	EVP_CIPHER_CTX_free(e_ctx) ;
 	return true;
 }
 
diff --git a/libretroshare/src/util/rsrecogn.cc b/libretroshare/src/util/rsrecogn.cc
index f7c51b9e9..f42a4dd6f 100644
--- a/libretroshare/src/util/rsrecogn.cc
+++ b/libretroshare/src/util/rsrecogn.cc
@@ -28,6 +28,7 @@
 #include "util/rsrecogn.h"
 #include "util/radix64.h"
 #include "util/rsstring.h"
+#include "util/rsdir.h"
 
 #include "gxs/gxssecurity.h"
 
@@ -507,9 +508,23 @@ bool	RsRecogn::itemToRadix64(RsItem *item, std::string &radstr)
 
 std::string RsRecogn::getRsaKeyId(RSA *pubkey)
 {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	int len = BN_num_bytes(pubkey -> n);
 	unsigned char tmp[len];
 	BN_bn2bin(pubkey -> n, tmp);
+#else
+    const BIGNUM *nn=NULL ;
+    RSA_get0_key(pubkey,&nn,NULL,NULL) ;
+
+	int len = BN_num_bytes(nn);
+	unsigned char tmp[len];
+	BN_bn2bin(nn, tmp);
+#endif
+
+    return RsDirUtil::sha1sum(tmp,len).toStdString();
+
+#ifdef OLD_VERSION_REMOVED
+    // (cyril) I removed this because this is cryptographically insane, as it allows to easily forge a RSA key with the same ID.
 
 	// copy first CERTSIGNLEN bytes...
 	if (len > CERTSIGNLEN)
@@ -524,6 +539,7 @@ std::string RsRecogn::getRsaKeyId(RSA *pubkey)
 	}
 
 	return id;
+#endif
 }
 
 
diff --git a/openpgpsdk/src/openpgpsdk/openssl_crypto.c b/openpgpsdk/src/openpgpsdk/openssl_crypto.c
index a9457208c..3a431d1ac 100644
--- a/openpgpsdk/src/openpgpsdk/openssl_crypto.c
+++ b/openpgpsdk/src/openpgpsdk/openssl_crypto.c
@@ -45,12 +45,21 @@ void test_secret_key(const ops_secret_key_t *skey)
     {
     RSA* test=RSA_new();
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     test->n=BN_dup(skey->public_key.key.rsa.n);
     test->e=BN_dup(skey->public_key.key.rsa.e);
-
     test->d=BN_dup(skey->key.rsa.d);
+
     test->p=BN_dup(skey->key.rsa.p);
     test->q=BN_dup(skey->key.rsa.q);
+#else
+    RSA_set0_key(test,
+		    BN_dup(skey->public_key.key.rsa.n),
+    		BN_dup(skey->public_key.key.rsa.e),
+		    BN_dup(skey->key.rsa.d));
+
+    RSA_set0_factors(test, BN_dup(skey->key.rsa.p), BN_dup(skey->key.rsa.q));
+#endif
 
     assert(RSA_check_key(test)==1);
     RSA_free(test);
@@ -392,8 +401,13 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length,
     int ret;
 
     osig=DSA_SIG_new();
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     osig->r=sig->r;
     osig->s=sig->s;
+#else
+    DSA_SIG_set0(osig,BN_dup(sig->r),BN_dup(sig->s)) ;
+#endif
 
 	 if(BN_num_bits(dsa->q) != 160)
 	 {
@@ -402,16 +416,27 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length,
 			 fprintf(stderr,"(WW) ops_dsa_verify: openssl does only supports 'q' of 160 bits. Current is %d bits.\n",BN_num_bits(dsa->q)) ;
 			 already_said=ops_true ;
 		 }
-		 osig->r=osig->s=NULL;
+
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+		 osig->r=NULL;			// in this case, the values are not copied.
+		 osig->s=NULL;
+#endif
+
 		 DSA_SIG_free(osig);
 		 return ops_false ;
 	 }
 
     odsa=DSA_new();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     odsa->p=dsa->p;
     odsa->q=dsa->q;
     odsa->g=dsa->g;
+
     odsa->pub_key=dsa->y;
+#else
+    DSA_set0_pqg(odsa,BN_dup(dsa->p),BN_dup(dsa->q),BN_dup(dsa->g));
+    DSA_set0_key(odsa,BN_dup(dsa->y),NULL) ;
+#endif
 
     if (debug)
         {
@@ -425,7 +450,8 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length,
         }
     //printf("hash_length=%ld\n", hash_length);
     //printf("Q=%d\n", BN_num_bytes(odsa->q));
-    unsigned int qlen=BN_num_bytes(odsa->q);
+    unsigned int qlen=BN_num_bytes(dsa->q);
+
     if (qlen < hash_length)
         hash_length=qlen;
     //    ret=DSA_do_verify(hash,hash_length,osig,odsa);
@@ -445,10 +471,17 @@ ops_boolean_t ops_dsa_verify(const unsigned char *hash,size_t hash_length,
 		return ops_false ;
 	 }
 
-    odsa->p=odsa->q=odsa->g=odsa->pub_key=NULL;
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
+    osig->r=NULL;
+    osig->s=NULL;
+
+    odsa->p=NULL;
+    odsa->q=NULL;
+    odsa->g=NULL;
+    odsa->pub_key=NULL;
+#endif
+
     DSA_free(odsa);
- 
-    osig->r=osig->s=NULL;
     DSA_SIG_free(osig);
 
     return ret != 0;
@@ -470,12 +503,18 @@ int ops_rsa_public_decrypt(unsigned char *out,const unsigned char *in,
     int n;
 
     orsa=RSA_new();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     orsa->n=rsa->n;
     orsa->e=rsa->e;
+#else
+    RSA_set0_key(orsa,BN_dup(rsa->n),BN_dup(rsa->e),NULL) ;
+#endif
 
     n=RSA_public_decrypt(length,in,out,orsa,RSA_NO_PADDING);
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     orsa->n=orsa->e=NULL;
+#endif
     RSA_free(orsa);
 
     return n;
@@ -499,6 +538,7 @@ int ops_rsa_private_encrypt(unsigned char *out,const unsigned char *in,
     int n;
 
     orsa=RSA_new();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     orsa->n=rsa->n;	// XXX: do we need n?
     orsa->d=srsa->d;
     orsa->p=srsa->q;
@@ -506,17 +546,28 @@ int ops_rsa_private_encrypt(unsigned char *out,const unsigned char *in,
 
     /* debug */
     orsa->e=rsa->e;
+
     // If this isn't set, it's very likely that the programmer hasn't
     // decrypted the secret key. RSA_check_key segfaults in that case.
     // Use ops_decrypt_secret_key_from_data() to do that.
     assert(orsa->d);
+#else
+    RSA_set0_key(orsa,BN_dup(rsa->n),BN_dup(rsa->e),BN_dup(srsa->d)) ;
+    RSA_set0_factors(orsa,BN_dup(srsa->p),BN_dup(srsa->q));
+#endif
+
     assert(RSA_check_key(orsa) == 1);
-    orsa->e=NULL;
     /* end debug */
 
+    // WARNING: this function should *never* be called for direct encryption, because of the padding.
+    // It's actually only called in the signature function now, where an adapted padding is placed.
+
     n=RSA_private_encrypt(length,in,out,orsa,RSA_NO_PADDING);
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     orsa->n=orsa->d=orsa->p=orsa->q=NULL;
+    orsa->e=NULL;
+#endif
     RSA_free(orsa);
 
     return n;
@@ -541,15 +592,19 @@ int ops_rsa_private_decrypt(unsigned char *out,const unsigned char *in,
     char errbuf[1024];
 
     orsa=RSA_new();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     orsa->n=rsa->n;	// XXX: do we need n?
     orsa->d=srsa->d;
     orsa->p=srsa->q;
     orsa->q=srsa->p;
+    orsa->e=rsa->e;
+#else
+    RSA_set0_key(orsa,BN_dup(rsa->n),BN_dup(rsa->e),BN_dup(srsa->d)) ;
+    RSA_set0_factors(orsa,BN_dup(srsa->p),BN_dup(srsa->q));
+#endif
 
     /* debug */
-    orsa->e=rsa->e;
     assert(RSA_check_key(orsa) == 1);
-    orsa->e=NULL;
     /* end debug */
 
     n=RSA_private_decrypt(length,in,out,orsa,RSA_NO_PADDING);
@@ -563,7 +618,10 @@ int ops_rsa_private_decrypt(unsigned char *out,const unsigned char *in,
         ERR_error_string(err,&errbuf[0]);
         fprintf(stderr,"openssl error : %s\n",errbuf);
         }
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     orsa->n=orsa->d=orsa->p=orsa->q=NULL;
+    orsa->e=NULL;
+#endif
     RSA_free(orsa);
 
     return n;
@@ -586,8 +644,12 @@ int ops_rsa_public_encrypt(unsigned char *out,const unsigned char *in,
     //    printf("ops_rsa_public_encrypt: length=%ld\n", length);
 
     orsa=RSA_new();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     orsa->n=rsa->n;
     orsa->e=rsa->e;
+#else
+    RSA_set0_key(orsa,BN_dup(rsa->n),BN_dup(rsa->e),NULL);
+#endif
 
     //    printf("len: %ld\n", length);
     //    ops_print_bn("n: ", orsa->n);
@@ -602,7 +664,9 @@ int ops_rsa_public_encrypt(unsigned char *out,const unsigned char *in,
 	    BIO_free(fd_out) ;
     }
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     orsa->n=orsa->e=NULL;
+#endif
     RSA_free(orsa);
 
     return n;
@@ -680,8 +744,19 @@ ops_boolean_t ops_rsa_generate_keypair(const int numbits, const unsigned long e,
     skey->public_key.days_valid=0;
     skey->public_key.algorithm= OPS_PKA_RSA;
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     skey->public_key.key.rsa.n=BN_dup(rsa->n);
     skey->public_key.key.rsa.e=BN_dup(rsa->e);
+    skey->key.rsa.d=BN_dup(rsa->d);
+#else
+    const BIGNUM *nn=NULL,*ee=NULL,*dd=NULL ;
+
+    RSA_get0_key(rsa,&nn,&ee,&dd) ;
+
+    skey->public_key.key.rsa.n=BN_dup(nn) ;
+    skey->public_key.key.rsa.e=BN_dup(ee) ;
+    skey->key.rsa.d=BN_dup(dd) ;
+#endif
 
     skey->s2k_usage=OPS_S2KU_ENCRYPTED_AND_HASHED;
     skey->s2k_specifier=OPS_S2KS_SALTED;
@@ -691,10 +766,20 @@ ops_boolean_t ops_rsa_generate_keypair(const int numbits, const unsigned long e,
     skey->octet_count=0;
     skey->checksum=0;
 
-    skey->key.rsa.d=BN_dup(rsa->d);
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     skey->key.rsa.p=BN_dup(rsa->p);
     skey->key.rsa.q=BN_dup(rsa->q);
     skey->key.rsa.u=BN_mod_inverse(NULL,rsa->p, rsa->q, ctx);
+#else
+    const BIGNUM *pp=NULL,*qq=NULL ;
+
+    RSA_get0_factors(rsa,&pp,&qq) ;
+
+    skey->key.rsa.p=BN_dup(pp);
+    skey->key.rsa.q=BN_dup(qq);
+
+    skey->key.rsa.u=BN_mod_inverse(NULL,pp,qq, ctx);
+#endif
     assert(skey->key.rsa.u);
     BN_CTX_free(ctx);
 
@@ -803,15 +888,22 @@ DSA_SIG* ops_dsa_sign(unsigned char* hashbuf, unsigned hashsize, const ops_dsa_s
     DSA_SIG *dsasig;
 
     odsa=DSA_new();
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     odsa->p=dsa->p;
     odsa->q=dsa->q;
     odsa->g=dsa->g;
     odsa->pub_key=dsa->y;
     odsa->priv_key=sdsa->x;
+#else
+    DSA_set0_pqg(odsa,BN_dup(dsa->p),BN_dup(dsa->q),BN_dup(dsa->g));
+    DSA_set0_key(odsa,BN_dup(dsa->y),BN_dup(sdsa->x));
+#endif
 
     dsasig=DSA_do_sign(hashbuf,hashsize,odsa);
 
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
     odsa->p=odsa->q=odsa->g=odsa->pub_key=odsa->priv_key=NULL;
+#endif
     DSA_free(odsa);
 
     return dsasig;
diff --git a/openpgpsdk/src/openpgpsdk/signature.c b/openpgpsdk/src/openpgpsdk/signature.c
index 87b4def70..e6820e325 100644
--- a/openpgpsdk/src/openpgpsdk/signature.c
+++ b/openpgpsdk/src/openpgpsdk/signature.c
@@ -298,8 +298,18 @@ static ops_boolean_t dsa_sign(ops_hash_t *hash, const ops_dsa_public_key_t *dsa,
 	dsasig=ops_dsa_sign(hashbuf, hashsize, sdsa, dsa);
 
 	// convert and write the sig out to memory
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
 	ops_write_mpi(dsasig->r, cinfo);
 	ops_write_mpi(dsasig->s, cinfo);
+#else
+    const BIGNUM *rr=NULL,*ss=NULL ;
+
+    DSA_SIG_get0(dsasig,&rr,&ss) ;
+
+	ops_write_mpi(rr, cinfo);
+	ops_write_mpi(ss, cinfo);
+#endif
+
 	DSA_SIG_free(dsasig);
 
 	return ops_true ;