libressl.patch

diff --git a/lib/_tls_common.js b/lib/_tls_common.js
index 16c6a647cc..8fa771d3fa 100644
--- a/lib/_tls_common.js
+++ b/lib/_tls_common.js
@@ -71,6 +71,11 @@ const {
   SecureContext: NativeSecureContext,
 } = internalBinding('crypto');
 
+const {
+  isLibreSSL,
+} = process.versions.openssl &&
+    /LibreSSL$/.test(process.versions.openssl);
+
 function SecureContext(secureProtocol, secureOptions, minVersion, maxVersion) {
   if (!(this instanceof SecureContext)) {
     return new SecureContext(secureProtocol, secureOptions, minVersion,
diff --git a/lib/_tls_wrap.js b/lib/_tls_wrap.js
index 5950c52c1d..945b1f4a4e 100644
--- a/lib/_tls_wrap.js
+++ b/lib/_tls_wrap.js
@@ -116,6 +116,9 @@ const kIsVerified = Symbol('verified');
 
 const noop = FunctionPrototype;
 
+const isLibreSSL = process.versions.openssl &&
+                   /LibreSSL$/.test(process.versions.openssl);
+
 let ipServernameWarned = false;
 let tlsTracingWarned = false;
 
@@ -190,7 +193,11 @@ function loadSession(hello) {
 
     owner._handle.loadSession(session);
     // Session is loaded. End the parser to allow handshaking to continue.
-    owner._handle.endParser();
+    if (isLibreSSL) {
+      oncertcb(hello, owner, session && session.servername || hello.servername);
+    } else {
+      owner._handle.endParser();
+    }
   }
 
   if (hello.sessionId.length <= 0 ||
@@ -207,9 +214,12 @@ function loadSession(hello) {
 }
 
 
-function loadSNI(info) {
-  const owner = this[owner_symbol];
-  const servername = info.servername;
+function loadSNI(info, owner, servername) {
+  if (!owner)
+    owner = this[owner_symbol];
+  if (!servername)
+    servername = info.servername;
+
   if (!servername || !owner._SNICallback)
     return requestOCSP(owner, info);
 
@@ -285,11 +295,15 @@ function requestOCSP(socket, info) {
 
 function requestOCSPDone(socket) {
   debug('server certcb done');
-  try {
-    socket._handle.certCbDone();
-  } catch (e) {
-    debug('server certcb done errored', e);
-    socket.destroy(e);
+  if (isLibreSSL) {
+    socket._handle.endParser();
+  } else {
+    try {
+      socket._handle.certCbDone();
+    } catch (e) {
+      debug('server certcb done errored', e);
+      socket.destroy(e);
+    }
   }
 }
 
@@ -1556,13 +1570,15 @@ function onConnectSecure() {
 
   // Check the size of DHE parameter above minimum requirement
   // specified in options.
-  const ekeyinfo = this.getEphemeralKeyInfo();
-  if (ekeyinfo.type === 'DH' && ekeyinfo.size < options.minDHSize) {
-    const err = new ERR_TLS_DH_PARAM_SIZE(ekeyinfo.size);
-    debug('client emit:', err);
-    this.emit('error', err);
-    this.destroy();
-    return;
+  if (!isLibreSSL) {
+    const ekeyinfo = this.getEphemeralKeyInfo();
+    if (ekeyinfo.type === 'DH' && ekeyinfo.size < options.minDHSize) {
+      const err = new ERR_TLS_DH_PARAM_SIZE(ekeyinfo.size);
+      debug('client emit:', err);
+      this.emit('error', err);
+      this.destroy();
+      return;
+    }
   }
 
   let verifyError = this._handle.verifyError();
diff --git a/src/crypto/crypto_cipher.cc b/src/crypto/crypto_cipher.cc
index 2e6e02d229..a69d827711 100644
--- a/src/crypto/crypto_cipher.cc
+++ b/src/crypto/crypto_cipher.cc
@@ -30,7 +30,7 @@ bool IsSupportedAuthenticatedMode(const EVP_CIPHER* cipher) {
   switch (EVP_CIPHER_mode(cipher)) {
   case EVP_CIPH_CCM_MODE:
   case EVP_CIPH_GCM_MODE:
-#ifndef OPENSSL_NO_OCB
+#if !( defined(OPENSSL_NO_OCB) || defined(LIBRESSL_VERSION_NUMBER) )
   case EVP_CIPH_OCB_MODE:
 #endif
     return true;
@@ -82,7 +82,9 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
     case EVP_CIPH_CTR_MODE: mode_label = "ctr"; break;
     case EVP_CIPH_ECB_MODE: mode_label = "ecb"; break;
     case EVP_CIPH_GCM_MODE: mode_label = "gcm"; break;
+#if !( defined(OPENSSL_NO_OCB) || defined(LIBRESSL_VERSION_NUMBER) )
     case EVP_CIPH_OCB_MODE: mode_label = "ocb"; break;
+#endif
     case EVP_CIPH_OFB_MODE: mode_label = "ofb"; break;
     case EVP_CIPH_WRAP_MODE: mode_label = "wrap"; break;
     case EVP_CIPH_XTS_MODE: mode_label = "xts"; break;
@@ -122,6 +124,7 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
           break;
         case EVP_CIPH_GCM_MODE:
           // Fall through
+#if !( defined(OPENSSL_NO_OCB) || defined(LIBRESSL_VERSION_NUMBER) )
         case EVP_CIPH_OCB_MODE:
           if (!EVP_CIPHER_CTX_ctrl(
                   ctx.get(),
@@ -131,6 +134,7 @@ void GetCipherInfo(const FunctionCallbackInfo<Value>& args) {
             return;
           }
           break;
+#endif
         default:
           if (check_len != iv_length)
             return;
diff --git a/src/crypto/crypto_common.cc b/src/crypto/crypto_common.cc
index 41e607e929..bea3a05d01 100644
--- a/src/crypto/crypto_common.cc
+++ b/src/crypto/crypto_common.cc
@@ -126,12 +126,17 @@ long VerifyPeerCertificate(  // NOLINT(runtime/int)
     X509_free(peer_cert);
     err = SSL_get_verify_result(ssl.get());
   } else {
+#ifndef OPENSSL_NO_PSK
     const SSL_CIPHER* curr_cipher = SSL_get_current_cipher(ssl.get());
+#endif
     const SSL_SESSION* sess = SSL_get_session(ssl.get());
     // Allow no-cert for PSK authentication in TLS1.2 and lower.
     // In TLS1.3 check that session was reused because TLS1.3 PSK
     // looks like session resumption.
-    if (SSL_CIPHER_get_auth_nid(curr_cipher) == NID_auth_psk ||
+    if (
+#ifndef OPENSSL_NO_PSK
+        SSL_CIPHER_get_auth_nid(curr_cipher) == NID_auth_psk ||
+#endif
         (SSL_SESSION_get_protocol_version(sess) == TLS1_3_VERSION &&
          SSL_session_reused(ssl.get()))) {
       return X509_V_OK;
@@ -155,6 +160,9 @@ bool UseSNIContext(
 }
 
 const char* GetClientHelloALPN(const SSLPointer& ssl) {
+#ifdef LIBRESSL_VERSION_NUMBER
+  return nullptr;
+#else
   const unsigned char* buf;
   size_t len;
   size_t rem;
@@ -171,9 +179,13 @@ const char* GetClientHelloALPN(const SSLPointer& ssl) {
   len = (buf[0] << 8) | buf[1];
   if (len + 2 != rem) return nullptr;
   return reinterpret_cast<const char*>(buf + 3);
+#endif
 }
 
 const char* GetClientHelloServerName(const SSLPointer& ssl) {
+#ifdef LIBRESSL_VERSION_NUMBER
+  return nullptr;
+#else
   const unsigned char* buf;
   size_t len;
   size_t rem;
@@ -199,6 +211,7 @@ const char* GetClientHelloServerName(const SSLPointer& ssl) {
   if (len + 2 > rem)
     return nullptr;
   return reinterpret_cast<const char*>(buf + 5);
+#endif
 }
 
 const char* GetServerName(SSL* ssl) {
@@ -311,7 +324,9 @@ MaybeLocal<Value> GetCipherValue(Environment* env, const SSL_CIPHER* cipher) {
 }
 
 constexpr auto GetCipherName = GetCipherValue<SSL_CIPHER_get_name>;
+#ifndef LIBRESSL_VERSION_NUMBER
 constexpr auto GetCipherStandardName = GetCipherValue<SSL_CIPHER_standard_name>;
+#endif
 constexpr auto GetCipherVersion = GetCipherValue<SSL_CIPHER_get_version>;
 
 StackOfX509 CloneSSLCerts(X509Pointer&& cert,
@@ -1048,6 +1063,9 @@ MaybeLocal<Array> GetClientHelloCiphers(
     Environment* env,
     const SSLPointer& ssl) {
   EscapableHandleScope scope(env->isolate());
+#ifdef LIBRESSL_VERSION_NUMBER
+  return MaybeLocal<Array>();
+#else
   const unsigned char* buf;
   size_t len = SSL_client_hello_get0_ciphers(ssl.get(), &buf);
   size_t count = len / 2;
@@ -1075,6 +1093,7 @@ MaybeLocal<Array> GetClientHelloCiphers(
   }
   Local<Array> ret = Array::New(env->isolate(), ciphers.out(), count);
   return scope.Escape(ret);
+#endif
 }
 
 
@@ -1088,10 +1107,12 @@ MaybeLocal<Object> GetCipherInfo(Environment* env, const SSLPointer& ssl) {
                   info,
                   env->name_string(),
                   GetCurrentCipherValue<GetCipherName>(env, ssl)) ||
+#ifndef LIBRESSL_VERSION_NUMBER
       !Set<Value>(env->context(),
                   info,
                   env->standard_name_string(),
                   GetCurrentCipherValue<GetCipherStandardName>(env, ssl)) ||
+#endif
       !Set<Value>(env->context(),
                   info,
                   env->version_string(),
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index 36b59eb4d5..c850f1bbf4 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -63,7 +63,11 @@ inline X509_STORE* GetOrCreateRootCertStore() {
 // Caller responsible for BIO_free_all-ing the returned object.
 BIOPointer LoadBIO(Environment* env, Local<Value> v) {
   if (v->IsString() || v->IsArrayBufferView()) {
+#ifdef LIBRESSL_VERSION_NUMBER
+    BIOPointer bio(BIO_new(BIO_s_mem()));
+#else
     BIOPointer bio(BIO_new(BIO_s_secmem()));
+#endif
     if (!bio) return nullptr;
     ByteSource bsrc = ByteSource::FromStringOrBuffer(env, v);
     if (bsrc.size() > INT_MAX) return nullptr;
@@ -625,6 +629,7 @@ void SecureContext::SetKey(const FunctionCallbackInfo<Value>& args) {
 }
 
 void SecureContext::SetSigalgs(const FunctionCallbackInfo<Value>& args) {
+#ifndef LIBRESSL_VERSION_NUMBER
   SecureContext* sc;
   ASSIGN_OR_RETURN_UNWRAP(&sc, args.Holder());
   Environment* env = sc->env();
@@ -637,6 +642,7 @@ void SecureContext::SetSigalgs(const FunctionCallbackInfo<Value>& args) {
 
   if (!SSL_CTX_set1_sigalgs_list(sc->ctx_.get(), *sigalgs))
     return ThrowCryptoError(env, ERR_get_error());
+#endif
 }
 
 #ifndef OPENSSL_NO_ENGINE
diff --git a/src/crypto/crypto_dsa.cc b/src/crypto/crypto_dsa.cc
index 3fa4a415dc..78f4d2be52 100644
--- a/src/crypto/crypto_dsa.cc
+++ b/src/crypto/crypto_dsa.cc
@@ -13,7 +13,7 @@
 #include <cstdio>
 
 // EVP_PKEY_CTX_set_dsa_paramgen_q_bits was added in OpenSSL 1.1.1e.
-#if OPENSSL_VERSION_NUMBER < 0x1010105fL
+#if OPENSSL_VERSION_NUMBER < 0x1010105fL || defined(LIBRESSL_VERSION_NUMBER)
 #define EVP_PKEY_CTX_set_dsa_paramgen_q_bits(ctx, qbits)                       \
   EVP_PKEY_CTX_ctrl((ctx),                                                     \
                     EVP_PKEY_DSA,                                              \
diff --git a/src/crypto/crypto_ec.cc b/src/crypto/crypto_ec.cc
index 415464be04..2d4fa57655 100644
--- a/src/crypto/crypto_ec.cc
+++ b/src/crypto/crypto_ec.cc
@@ -516,7 +516,11 @@ bool ECDHBitsTraits::DeriveBits(Environment* env,
       break;
     }
     default: {
+#ifdef LIBRESSL_VERSION_NUMBER
+      EC_KEY* private_key;
+#else
       const EC_KEY* private_key;
+#endif
       {
         Mutex::ScopedLock priv_lock(*m_privkey.mutex());
         private_key = EVP_PKEY_get0_EC_KEY(m_privkey.get());
@@ -636,6 +640,9 @@ WebCryptoKeyExportStatus EC_Raw_Export(
   size_t len = 0;
 
   if (ec_key == nullptr) {
+#ifdef LIBRESSL_VERSION_NUMBER
+    return WebCryptoKeyExportStatus::FAILED;
+#else
     typedef int (*export_fn)(const EVP_PKEY*, unsigned char*, size_t* len);
     export_fn fn = nullptr;
     switch (key_data->GetKeyType()) {
@@ -656,6 +663,7 @@ WebCryptoKeyExportStatus EC_Raw_Export(
     if (fn(m_pkey.get(), data.data<unsigned char>(), &len) == 0)
       return WebCryptoKeyExportStatus::INVALID_KEY_TYPE;
     *out = std::move(data).release(len);
+#endif
   } else {
     if (key_data->GetKeyType() != kKeyTypePublic)
       return WebCryptoKeyExportStatus::INVALID_KEY_TYPE;
@@ -872,7 +880,9 @@ Maybe<bool> ExportJWKEdKey(
           OneByteString(env->isolate(), curve)).IsNothing()) {
     return Nothing<bool>();
   }
-
+#ifdef LIBRESSL_VERSION_NUMBER
+  return Nothing<bool>();
+#else
   size_t len = 0;
   Local<Value> encoded;
   Local<Value> error;
@@ -905,7 +915,7 @@ Maybe<bool> ExportJWKEdKey(
       env->isolate()->ThrowException(error);
     return Nothing<bool>();
   }
-
+#endif
   if (target->Set(
           env->context(),
           env->jwk_kty_string(),
diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
index 5627bac590..414db4a960 100644
--- a/src/crypto/crypto_hash.cc
+++ b/src/crypto/crypto_hash.cc
@@ -119,12 +119,14 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
 
   md_len_ = EVP_MD_size(md);
   if (xof_md_len.IsJust() && xof_md_len.FromJust() != md_len_) {
+#ifndef LIBRESSL_VERSION_NUMBER
     // This is a little hack to cause createHash to fail when an incorrect
     // hashSize option was passed for a non-XOF hash function.
     if ((EVP_MD_flags(md) & EVP_MD_FLAG_XOF) == 0) {
       EVPerr(EVP_F_EVP_DIGESTFINALXOF, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
       return false;
     }
+#endif
     md_len_ = xof_md_len.FromJust();
   }
 
@@ -183,8 +185,12 @@ void Hash::HashDigest(const FunctionCallbackInfo<Value>& args) {
       // The output length should always equal hash->md_len_
       CHECK_EQ(len, hash->md_len_);
     } else {
+#ifdef LIBRESSL_VERSION_NUMBER
+      ret = 0;
+#else
       ret = EVP_DigestFinalXOF(
           hash->mdctx_.get(), digest.data<unsigned char>(), len);
+#endif
     }
 
     if (ret != 1)
@@ -264,12 +270,14 @@ Maybe<bool> HashTraits::AdditionalConfig(
     params->length =
         static_cast<uint32_t>(args[offset + 2]
             .As<Uint32>()->Value()) / CHAR_BIT;
+#ifndef LIBRESSL_VERSION_NUMBER
     if (params->length != expected) {
       if ((EVP_MD_flags(params->digest) & EVP_MD_FLAG_XOF) == 0) {
         THROW_ERR_CRYPTO_INVALID_DIGEST(env, "Digest method not supported");
         return Nothing<bool>();
       }
     }
+#endif
   }
 
   return Just(true);
@@ -297,7 +305,11 @@ bool HashTraits::DeriveBits(
     int ret =
         (length == expected)
             ? EVP_DigestFinal_ex(ctx.get(), buf.data<unsigned char>(), &length)
+#ifdef LIBRESSL_VERSION_NUMBER
+            : 0;
+#else
             : EVP_DigestFinalXOF(ctx.get(), buf.data<unsigned char>(), length);
+#endif
 
     if (UNLIKELY(ret != 1))
       return false;
diff --git a/src/crypto/crypto_hkdf.cc b/src/crypto/crypto_hkdf.cc
index 7663dd6937..d6a78accf4 100644
--- a/src/crypto/crypto_hkdf.cc
+++ b/src/crypto/crypto_hkdf.cc
@@ -104,6 +104,9 @@ bool HKDFTraits::DeriveBits(
     Environment* env,
     const HKDFConfig& params,
     ByteSource* out) {
+#ifdef LIBRESSL_VERSION_NUMBER
+  return false;
+#else
   EVPKeyCtxPointer ctx =
       EVPKeyCtxPointer(EVP_PKEY_CTX_new_id(EVP_PKEY_HKDF, nullptr));
   if (!ctx || !EVP_PKEY_derive_init(ctx.get()) ||
@@ -152,6 +155,7 @@ bool HKDFTraits::DeriveBits(
 
   *out = std::move(buf).release();
   return true;
+#endif
 }
 
 void HKDFConfig::MemoryInfo(MemoryTracker* tracker) const {
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index 1b8e9b25a6..dd3fed311d 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -595,15 +595,23 @@ void ManagedEVPPKey::MemoryInfo(MemoryTracker* tracker) const {
 }
 
 size_t ManagedEVPPKey::size_of_private_key() const {
+#ifdef LIBRESSL_VERSION_NUMBER
+  return 0;
+#else
   size_t len = 0;
   return (pkey_ && EVP_PKEY_get_raw_private_key(
       pkey_.get(), nullptr, &len) == 1) ? len : 0;
+#endif
 }
 
 size_t ManagedEVPPKey::size_of_public_key() const {
+#ifdef LIBRESSL_VERSION_NUMBER
+  return 0;
+#else
   size_t len = 0;
   return (pkey_ && EVP_PKEY_get_raw_public_key(
       pkey_.get(), nullptr, &len) == 1) ? len : 0;
+#endif
 }
 
 // This maps true to Just<bool>(true) and false to Nothing<bool>().
@@ -1087,6 +1095,9 @@ void KeyObjectHandle::InitECRaw(const FunctionCallbackInfo<Value>& args) {
 }
 
 void KeyObjectHandle::InitEDRaw(const FunctionCallbackInfo<Value>& args) {
+#ifdef LIBRESSL_VERSION_NUMBER
+  args.GetReturnValue().Set(false);
+#else
   Environment* env = Environment::GetCurrent(args);
   KeyObjectHandle* key;
   ASSIGN_OR_RETURN_UNWRAP(&key, args.Holder());
@@ -1126,6 +1137,7 @@ void KeyObjectHandle::InitEDRaw(const FunctionCallbackInfo<Value>& args) {
   }
 
   args.GetReturnValue().Set(true);
+#endif
 }
 
 void KeyObjectHandle::Equals(const FunctionCallbackInfo<Value>& args) {
diff --git a/src/crypto/crypto_random.cc b/src/crypto/crypto_random.cc
index 9850104cd6..b37bd47e92 100644
--- a/src/crypto/crypto_random.cc
+++ b/src/crypto/crypto_random.cc
@@ -140,7 +140,11 @@ Maybe<bool> RandomPrimeTraits::AdditionalConfig(
 
   params->bits = bits;
   params->safe = safe;
+#ifdef LIBRESSL_VERSION_NUMBER
+  params->prime.reset(BN_new());
+#else
   params->prime.reset(BN_secure_new());
+#endif
   if (!params->prime) {
     THROW_ERR_CRYPTO_OPERATION_FAILED(env, "could not generate prime");
     return Nothing<bool>();
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
index 47a42246ed..92fae3a1db 100644
--- a/src/crypto/crypto_rsa.cc
+++ b/src/crypto/crypto_rsa.cc
@@ -610,10 +610,14 @@ Maybe<bool> GetRsaKeyDetail(
       }
 
       if (params->saltLength != nullptr) {
+#ifdef LIBRESSL_VERSION_NUMBER
+        return Nothing<bool>();
+#else
         if (ASN1_INTEGER_get_int64(&salt_length, params->saltLength) != 1) {
           ThrowCryptoError(env, ERR_get_error(), "ASN1_INTEGER_get_in64 error");
           return Nothing<bool>();
         }
+#endif
       }
 
       if (target
diff --git a/src/crypto/crypto_scrypt.cc b/src/crypto/crypto_scrypt.cc
index 4dae07f136..00731dae9e 100644
--- a/src/crypto/crypto_scrypt.cc
+++ b/src/crypto/crypto_scrypt.cc
@@ -18,7 +18,7 @@ using v8::Uint32;
 using v8::Value;
 
 namespace crypto {
-#ifndef OPENSSL_NO_SCRYPT
+#if !( defined(OPENSSL_NO_SCRYPT) || defined(LIBRESSL_VERSION_NUMBER) )
 
 ScryptConfig::ScryptConfig(ScryptConfig&& other) noexcept
   : mode(other.mode),
@@ -138,7 +138,7 @@ bool ScryptTraits::DeriveBits(
   return true;
 }
 
-#endif  // !OPENSSL_NO_SCRYPT
+#endif  // !(OPENSSL_NO_SCRYPT || LIBRESSL_VERSION_NUMBER)
 
 }  // namespace crypto
 }  // namespace node
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index cc2f6d60e7..ad5f98daae 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -417,7 +417,9 @@ void TLSWrap::InitSSL() {
 
   ConfigureSecureContext(sc_.get());
 
+#ifndef LIBRESSL_VERSION_NUMBER
   SSL_set_cert_cb(ssl_.get(), SSLCertCallback, this);
+#endif
 
   if (is_server()) {
     SSL_set_accept_state(ssl_.get());
@@ -1292,6 +1294,9 @@ int TLSWrap::SelectSNIContextCallback(SSL* s, int* ad, void* arg) {
 }
 
 int TLSWrap::SetCACerts(SecureContext* sc) {
+#ifdef LIBRESSL_VERSION_NUMBER
+  return 0;
+#else
   int err = SSL_set1_verify_cert_store(ssl_.get(),
                                        SSL_CTX_get_cert_store(sc->ctx().get()));
   if (err != 1)
@@ -1303,6 +1308,7 @@ int TLSWrap::SetCACerts(SecureContext* sc) {
   // NOTE: `SSL_set_client_CA_list` takes the ownership of `list`
   SSL_set_client_CA_list(ssl_.get(), list);
   return 1;
+#endif
 }
 
 #ifndef OPENSSL_NO_PSK
@@ -1744,7 +1750,11 @@ void TLSWrap::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
 
+#ifdef LIBRESSL_VERSION_NUMBER
+  MaybeStackBuffer<Local<Value>, 16> ret_arr(0);
+#else
   SSL* ssl = w->ssl_.get();
+
   int nsig = SSL_get_shared_sigalgs(ssl, 0, nullptr, nullptr, nullptr, nullptr,
                                     nullptr);
   MaybeStackBuffer<Local<Value>, 16> ret_arr(nsig);
@@ -1785,7 +1795,6 @@ void TLSWrap::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
       case NID_id_GostR3410_2001:
         sig_with_md = "gost2001+";
         break;
-
       case NID_id_GostR3410_2012_256:
         sig_with_md = "gost2012_256+";
         break;
@@ -1813,7 +1822,7 @@ void TLSWrap::GetSharedSigalgs(const FunctionCallbackInfo<Value>& args) {
     }
     ret_arr[i] = OneByteString(env->isolate(), sig_with_md.c_str());
   }
-
+#endif
   args.GetReturnValue().Set(
                  Array::New(env->isolate(), ret_arr.out(), ret_arr.length()));
 }
@@ -1876,6 +1885,9 @@ void TLSWrap::Renegotiate(const FunctionCallbackInfo<Value>& args) {
 }
 
 void TLSWrap::GetTLSTicket(const FunctionCallbackInfo<Value>& args) {
+#ifdef LIBRESSL_VERSION_NUMBER
+  return;
+#else
   TLSWrap* w;
   ASSIGN_OR_RETURN_UNWRAP(&w, args.Holder());
   Environment* env = w->env();
@@ -1893,6 +1905,7 @@ void TLSWrap::GetTLSTicket(const FunctionCallbackInfo<Value>& args) {
         Buffer::Copy(env, reinterpret_cast<const char*>(ticket), length)
             .FromMaybe(Local<Object>()));
   }
+#endif
 }
 
 void TLSWrap::NewSessionDone(const FunctionCallbackInfo<Value>& args) {
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index 9b1d7acfc4..997f500466 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -155,7 +155,7 @@ static Mutex fips_mutex;
 void InitCryptoOnce() {
   Mutex::ScopedLock lock(per_process::cli_options_mutex);
   Mutex::ScopedLock fips_lock(fips_mutex);
-#ifndef OPENSSL_IS_BORINGSSL
+#if !( defined(OPENSSL_IS_BORINGSSL) || defined(LIBRESSL_VERSION_NUMBER) )
   OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
 
 #if OPENSSL_VERSION_MAJOR < 3
@@ -199,7 +199,7 @@ void InitCryptoOnce() {
   }
 #endif
 
-#endif  // OPENSSL_IS_BORINGSSL
+#endif  // OPENSSL_IS_BORINGSSL || LIBRESSL_VERSION_NUMBER
 
   // Turn off compression. Saves memory and protects against CRIME attacks.
   // No-op with OPENSSL_NO_COMP builds of OpenSSL.
@@ -498,6 +498,43 @@ Maybe<bool> Decorate(Environment* env, Local<Object> obj,
         c = ToUpper(c);
     }
 
+#ifdef LIBRESSL_VERSION_NUMBER
+#define OSSL_ERROR_CODES_MAP(V)                                               \
+    V(SYS)                                                                    \
+    V(BN)                                                                     \
+    V(RSA)                                                                    \
+    V(DH)                                                                     \
+    V(EVP)                                                                    \
+    V(BUF)                                                                    \
+    V(OBJ)                                                                    \
+    V(PEM)                                                                    \
+    V(DSA)                                                                    \
+    V(X509)                                                                   \
+    V(ASN1)                                                                   \
+    V(CONF)                                                                   \
+    V(CRYPTO)                                                                 \
+    V(EC)                                                                     \
+    V(SSL)                                                                    \
+    V(BIO)                                                                    \
+    V(PKCS7)                                                                  \
+    V(X509V3)                                                                 \
+    V(PKCS12)                                                                 \
+    V(RAND)                                                                   \
+    V(DSO)                                                                    \
+    V(ENGINE)                                                                 \
+    V(OCSP)                                                                   \
+    V(UI)                                                                     \
+    V(COMP)                                                                   \
+    V(ECDSA)                                                                  \
+    V(ECDH)                                                                   \
+    V(FIPS)                                                                   \
+    V(CMS)                                                                    \
+    V(TS)                                                                     \
+    V(HMAC)                                                                   \
+    V(CT)                                                                     \
+    V(USER)                                                                   \
+
+#else
 #define OSSL_ERROR_CODES_MAP(V)                                               \
     V(SYS)                                                                    \
     V(BN)                                                                     \
@@ -537,6 +574,8 @@ Maybe<bool> Decorate(Environment* env, Local<Object> obj,
     V(SM2)                                                                    \
     V(USER)                                                                   \
 
+#endif
+
 #define V(name) case ERR_LIB_##name: lib = #name "_"; break;
     const char* lib = "";
     const char* prefix = "OSSL_";
@@ -708,7 +747,13 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
   CHECK(args[0]->IsUint32());
   Environment* env = Environment::GetCurrent(args);
   uint32_t len = args[0].As<Uint32>()->Value();
+#ifdef LIBRESSL_VERSION_NUMBER
+  void* data = OPENSSL_malloc(len);
+  if (data != nullptr)
+    memset(data, 0, len);
+#else
   void* data = OPENSSL_secure_zalloc(len);
+#endif
   if (data == nullptr) {
     // There's no memory available for the allocation.
     // Return nothing.
@@ -727,10 +772,12 @@ void SecureBuffer(const FunctionCallbackInfo<Value>& args) {
 }
 
 void SecureHeapUsed(const FunctionCallbackInfo<Value>& args) {
+#ifndef LIBRESSL_VERSION_NUMBER
   Environment* env = Environment::GetCurrent(args);
   if (CRYPTO_secure_malloc_initialized())
     args.GetReturnValue().Set(
         BigInt::New(env->isolate(), CRYPTO_secure_used()));
+#endif
 }
 }  // namespace
 
diff --git a/src/crypto/crypto_util.h b/src/crypto/crypto_util.h
index bf19334cf6..8e180938aa 100644
--- a/src/crypto/crypto_util.h
+++ b/src/crypto/crypto_util.h
@@ -37,6 +37,26 @@
 #include <string>
 #include <vector>
 
+#ifdef LIBRESSL_VERSION_NUMBER
+#  define OPENSSL_memdup(str, s) \
+         BUF_memdup(str, s)
+#  define NID_ED25519     NID_Ed25519
+#  define NID_ED448       NID_Ed448
+#  define EVP_PKEY_X25519  NID_X25519
+#  define EVP_PKEY_ED25519 NID_ED25519
+#  define EVP_PKEY_X448    NID_X448
+#  define EVP_PKEY_ED448   NID_ED448
+
+inline void OPENSSL_clear_free(void *str, size_t num) {
+    if (str) {
+        if (num)
+            OPENSSL_cleanse(str, num);
+        OPENSSL_free(str);
+    }
+}
+#  define OPENSSL_secure_clear_free OPENSSL_clear_free
+#endif
+
 namespace node {
 namespace crypto {
 // Currently known sizes of commonly used OpenSSL struct sizes.
diff --git a/src/node.cc b/src/node.cc
index b29dc57d60..8ca45cbe9e 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -947,7 +947,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
   }
 
   if (!(flags & ProcessInitializationFlags::kNoInitOpenSSL)) {
-#if HAVE_OPENSSL && !defined(OPENSSL_IS_BORINGSSL)
+#if HAVE_OPENSSL && !(defined(OPENSSL_IS_BORINGSSL) || defined(LIBRESSL_VERSION_NUMBER))
     auto GetOpenSSLErrorString = []() -> std::string {
       std::string ret;
       ERR_print_errors_cb(
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index a94ef62d2c..68f8d045ee 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -59,7 +59,7 @@ namespace crypto {
   V(Verify)                                                                    \
   V(X509Certificate)
 
-#ifdef OPENSSL_NO_SCRYPT
+#if defined(OPENSSL_NO_SCRYPT) || defined(LIBRESSL_VERSION_NUMBER)
 #define SCRYPT_NAMESPACE_LIST(V)
 #else
 #define SCRYPT_NAMESPACE_LIST(V) V(ScryptJob)
diff --git a/src/node_metadata.cc b/src/node_metadata.cc
index 22546e9de2..e9337828e7 100644
--- a/src/node_metadata.cc
+++ b/src/node_metadata.cc
@@ -50,7 +50,11 @@ static inline std::string GetOpenSSLVersion() {
   // sample openssl version string format
   // for reference: "OpenSSL 1.1.0i 14 Aug 2018"
   constexpr size_t start = search(OPENSSL_VERSION_TEXT, ' ') + 1;
+#ifdef LIBRESSL_VERSION_NUMBER
+  constexpr size_t len = search(&OPENSSL_VERSION_TEXT[start], '\0');
+#else
   constexpr size_t len = search(&OPENSSL_VERSION_TEXT[start], ' ');
+#endif
   return std::string(OPENSSL_VERSION_TEXT, start, len);
 }
 #endif  // HAVE_OPENSSL