Commit b12bad4b111 for nodejs

commit b12bad4b1119608ba98dcfdcddb4fabaa3c93daf
Author: Filip Skokan <panva.ip@gmail.com>
Date:   Sat Oct 24 01:47:23 2026 +0200

    build,deps,tools: prepare to update to OpenSSL 4.1

    Update the updater script and files under `deps/openssl/config` in
    preparation for updating `deps/openssl` to OpenSSL 4.1.

    Signed-off-by: Filip Skokan <panva.ip@gmail.com>
    Assisted-by: Codex
    PR-URL: https://github.com/nodejs/node/pull/66758
    Reviewed-By: Richard Lau <richard.lau@ibm.com>

diff --git a/.github/workflows/update-openssl.yml b/.github/workflows/update-openssl.yml
index 47c74e178ba..04c2b9f8a5a 100644
--- a/.github/workflows/update-openssl.yml
+++ b/.github/workflows/update-openssl.yml
@@ -5,6 +5,11 @@ on:
     - cron: 5 0 * * 0

   workflow_dispatch:
+    inputs:
+      include_prereleases:
+        description: Include prereleases
+        type: boolean
+        default: false

 permissions:
   contents: read
@@ -41,6 +46,7 @@ jobs:
         shell: bash
         env:
           GITHUB_TOKEN: ${{ secrets.GH_USER_TOKEN }}
+          INCLUDE_PRERELEASES: ${{ github.event_name == 'workflow_dispatch' && inputs.include_prereleases }}
       - name: Commit OpenSSL sources
         if: env.NEW_VERSION
         run: |
diff --git a/deps/openssl/config/Makefile b/deps/openssl/config/Makefile
index 11f2f7290ba..ea5e5e81a38 100644
--- a/deps/openssl/config/Makefile
+++ b/deps/openssl/config/Makefile
@@ -10,7 +10,7 @@ PERL    = perl

 # Supported architecture list
 ASM_ARCHS = aix64-gcc-as BSD-x86 BSD-x86_64 \
-darwin64-x86_64-cc darwin-i386-cc darwin64-arm64-cc linux-aarch64 \
+darwin64-x86_64-cc darwin64-arm64-cc linux-aarch64 \
 linux-armv4 linux-elf linux-x86_64 \
 linux-ppc64le linux32-s390x linux64-s390x linux64-mips64\
 linux64-riscv64 \
@@ -43,15 +43,15 @@ GENERATE = ./generate_gypi.pl
 OPSSL_SRC = ../openssl

 # Header files generated with Configure
-#INT_CFGS = bn_conf.h dso_conf.h
+#INT_CFGS = dso_conf.h
 INT_CFG_DIR = $(OPSSL_SRC)/include/crypto
-GEN_HEADERS = asn1 asn1t bio comp cmp cms conf configuration core_names crmf \
+GEN_HEADERS = asn1 asn1t bio comp cmp cms conf configuration crmf \
               crypto ct err ess fipskey lhash ocsp opensslv pkcs12 pkcs7 \
               safestack srp ssl ui x509_acert x509 x509v3 x509_vfy

-INTERNAL_GEN_HEADERS = param_names
+INTERNAL_GEN_HEADERS =

-CRYPTO_GEN_HEADERS = bn_conf dso_conf
+CRYPTO_GEN_HEADERS = dso_conf

 PHONY = all clean replace generate_headers
 .PHONY: $(PHONY)
@@ -66,7 +66,7 @@ $(ASM_ARCHS):
 # Confgure asm_avx2 and generate upto avx2 support
 	cd $(OPSSL_SRC); $(NO_WARN_ENV) CC=$(FAKE_GCC) $(PERL) $(CONFIGURE) \
 	$(COPTS) $@;
-	$(PERL) -w -I$(OPSSL_SRC) $(GENERATE) asm_avx2 $@ "${GEN_HEADERS}" "${CRYTO_GEN_HEADERS}" "${INTERNAL_GEN_HEADERS}"
+	$(PERL) -w -I$(OPSSL_SRC) $(GENERATE) asm_avx2 $@ "${GEN_HEADERS}" "${CRYPTO_GEN_HEADERS}" "${INTERNAL_GEN_HEADERS}"
 # Configure no-asm and generate no-asm sources
 	cd $(OPSSL_SRC); $(NO_WARN_ENV) $(PERL) $(CONFIGURE) $(COPTS) \
 	no-asm $@;
@@ -82,5 +82,7 @@ generate_headers:
 	@$(PERL) -w -I$(OPSSL_SRC) ./generate_headers.pl "${GEN_HEADERS}" "${CRYPTO_GEN_HEADERS}" "${INTERNAL_GEN_HEADERS}"

 clean:
+	rm -rf common
+	find . -maxdepth 1 -name \*.h ! -name opensslconf_asm.h -exec rm "{}" \;
 	find archs \( -name \*.S -o -name \*.s -o -name \*.asm -o \
-	-name \*.gypi -o -name \*.h -o -name \*.pm -o -name \*.rc \) -exec rm "{}" \;
+	-name \*.gypi -o -name \*.h -o -name \*.c -o -name \*.inc -o -name \*.pm -o -name \*.rc \) -exec rm "{}" \;
diff --git a/deps/openssl/config/Makefile_VC-WIN32 b/deps/openssl/config/Makefile_VC-WIN32
index bb843a0c14f..a86fb036fc9 100644
--- a/deps/openssl/config/Makefile_VC-WIN32
+++ b/deps/openssl/config/Makefile_VC-WIN32
@@ -1,8 +1,10 @@
 BLDDIR=.
 PERL=perl
 RM= rm -f
-GENERATED_MANDATORY=crypto/params_idx.c include/crypto/bn_conf.h include/crypto/dso_conf.h include/internal/param_names.h include/openssl/asn1.h include/openssl/asn1t.h include/openssl/bio.h include/openssl/cmp.h include/openssl/comp.h include/openssl/cms.h include/openssl/conf.h include/openssl/configuration.h include/openssl/core_names.h include/openssl/crmf.h include/openssl/crypto.h include/openssl/ct.h include/openssl/err.h include/openssl/ess.h include/openssl/fipskey.h include/openssl/lhash.h include/openssl/ocsp.h include/openssl/opensslv.h include/openssl/pkcs12.h include/openssl/pkcs7.h include/openssl/safestack.h include/openssl/srp.h include/openssl/ssl.h include/openssl/ui.h include/openssl/x509.h include/openssl/x509_acert.h include/openssl/x509_vfy.h include/openssl/x509v3.h providers/common/include/prov/der_digests.h providers/common/include/prov/der_dsa.h providers/common/include/prov/der_ec.h providers/common/include/prov/der_ecx.h providers/common/include/prov/der_ml_dsa.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_slh_dsa.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_sm2.h providers/common/include/prov/der_wrap.h
-GENERATED=apps/CA.pl apps/openssl.rc apps/progs.h apps/tsget.pl crypto/aes/aes-586.asm crypto/aes/aesni-x86.asm crypto/aes/vpaes-x86.asm crypto/bf/bf-586.asm crypto/bn/bn-586.asm crypto/bn/co-586.asm crypto/bn/x86-gf2m.asm crypto/bn/x86-mont.asm crypto/buildinf.h crypto/camellia/cmll-x86.asm crypto/chacha/chacha-x86.asm crypto/des/crypt586.asm crypto/des/des-586.asm crypto/ec/ecp_nistz256-x86.asm crypto/md5/md5-586.asm crypto/modes/ghash-x86.asm crypto/params_idx.c crypto/poly1305/poly1305-x86.asm crypto/rc4/rc4-586.asm crypto/ripemd/rmd-586.asm crypto/sha/sha1-586.asm crypto/sha/sha256-586.asm crypto/sha/sha512-586.asm crypto/whrlpool/wp-mmx.asm crypto/x86cpuid.asm engines/capi.def engines/dasync.def engines/e_padlock-x86.asm engines/ossltest.def engines/padlock.def libcrypto.def libcrypto.rc libssl.def libssl.rc test/buildtest_aes.c test/buildtest_asn1.c test/buildtest_asn1t.c test/buildtest_async.c test/buildtest_bio.c test/buildtest_blowfish.c test/buildtest_bn.c test/buildtest_buffer.c test/buildtest_camellia.c test/buildtest_cast.c test/buildtest_cmac.c test/buildtest_cms.c test/buildtest_comp.c test/buildtest_conf.c test/buildtest_conf_api.c test/buildtest_crypto.c test/buildtest_ct.c test/buildtest_des.c test/buildtest_dh.c test/buildtest_dsa.c test/buildtest_dtls1.c test/buildtest_e_os2.c test/buildtest_ebcdic.c test/buildtest_ec.c test/buildtest_ecdh.c test/buildtest_ecdsa.c test/buildtest_engine.c test/buildtest_evp.c test/buildtest_hmac.c test/buildtest_idea.c test/buildtest_kdf.c test/buildtest_lhash.c test/buildtest_md4.c test/buildtest_md5.c test/buildtest_mdc2.c test/buildtest_modes.c test/buildtest_obj_mac.c test/buildtest_objects.c test/buildtest_ocsp.c test/buildtest_opensslv.c test/buildtest_ossl_typ.c test/buildtest_pem.c test/buildtest_pem2.c test/buildtest_pkcs12.c test/buildtest_pkcs7.c test/buildtest_rand.c test/buildtest_rand_drbg.c test/buildtest_rc2.c test/buildtest_rc4.c test/buildtest_ripemd.c test/buildtest_rsa.c test/buildtest_safestack.c test/buildtest_seed.c test/buildtest_sha.c test/buildtest_srp.c test/buildtest_srtp.c test/buildtest_ssl.c test/buildtest_ssl2.c test/buildtest_stack.c test/buildtest_store.c test/buildtest_symhacks.c test/buildtest_tls1.c test/buildtest_ts.c test/buildtest_txt_db.c test/buildtest_ui.c test/buildtest_whrlpool.c test/buildtest_x509.c test/buildtest_x509_vfy.c test/buildtest_x509v3.c tools/c_rehash.pl providers/common/der/der_digests_gen.c providers/common/der/der_dsa_gen.c providers/common/der/der_ec_gen.c providers/common/der/der_ecx_gen.c providers/common/der/der_ml_dsa_gen.c providers/common/der/der_rsa_gen.c providers/common/der/der_slh_dsa_gen.c providers/common/der/der_sm2_gen.c providers/common/der/der_wrap_gen.c
+GENERATED_MANDATORY=include/crypto/dso_conf.h include/openssl/asn1.h include/openssl/asn1t.h include/openssl/bio.h include/openssl/cmp.h include/openssl/comp.h include/openssl/cms.h include/openssl/conf.h include/openssl/configuration.h include/openssl/core_names.h include/openssl/crmf.h include/openssl/crypto.h include/openssl/ct.h include/openssl/err.h include/openssl/ess.h include/openssl/fipskey.h include/openssl/lhash.h include/openssl/ocsp.h include/openssl/opensslv.h include/openssl/pkcs12.h include/openssl/pkcs7.h include/openssl/safestack.h include/openssl/srp.h include/openssl/ssl.h include/openssl/ui.h include/openssl/x509.h include/openssl/x509_acert.h include/openssl/x509_vfy.h include/openssl/x509v3.h providers/common/include/prov/der_digests.h providers/common/include/prov/der_dsa.h providers/common/include/prov/der_ec.h providers/common/include/prov/der_ecx.h providers/common/include/prov/der_ml_dsa.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_slh_dsa.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_sm2.h providers/common/include/prov/der_wrap.h
+GENERATED=apps/CA.pl apps/openssl.rc apps/progs.h apps/tsget.pl crypto/aes/aes-586.asm crypto/aes/aesni-x86.asm crypto/aes/vpaes-x86.asm crypto/bf/bf-586.asm crypto/bn/bn-586.asm crypto/bn/co-586.asm crypto/bn/x86-gf2m.asm crypto/bn/x86-mont.asm crypto/buildinf.h crypto/camellia/cmll-x86.asm crypto/chacha/chacha-x86.asm crypto/des/crypt586.asm crypto/des/des-586.asm crypto/ec/ecp_nistz256-x86.asm crypto/md5/md5-586.asm crypto/modes/ghash-x86.asm crypto/poly1305/poly1305-x86.asm crypto/rc4/rc4-586.asm crypto/ripemd/rmd-586.asm crypto/sha/sha1-586.asm crypto/sha/sha256-586.asm crypto/sha/sha512-586.asm crypto/whrlpool/wp-mmx.asm crypto/x86cpuid.asm engines/capi.def engines/dasync.def engines/e_padlock-x86.asm engines/ossltest.def engines/padlock.def libcrypto.def libcrypto.rc libssl.def libssl.rc test/buildtest_aes.c test/buildtest_asn1.c test/buildtest_asn1t.c test/buildtest_async.c test/buildtest_bio.c test/buildtest_blowfish.c test/buildtest_bn.c test/buildtest_buffer.c test/buildtest_camellia.c test/buildtest_cast.c test/buildtest_cmac.c test/buildtest_cms.c test/buildtest_comp.c test/buildtest_conf.c test/buildtest_conf_api.c test/buildtest_crypto.c test/buildtest_ct.c test/buildtest_des.c test/buildtest_dh.c test/buildtest_dsa.c test/buildtest_dtls1.c test/buildtest_e_os2.c test/buildtest_ebcdic.c test/buildtest_ec.c test/buildtest_ecdh.c test/buildtest_ecdsa.c test/buildtest_engine.c test/buildtest_evp.c test/buildtest_hmac.c test/buildtest_idea.c test/buildtest_kdf.c test/buildtest_lhash.c test/buildtest_md4.c test/buildtest_md5.c test/buildtest_mdc2.c test/buildtest_modes.c test/buildtest_obj_mac.c test/buildtest_objects.c test/buildtest_ocsp.c test/buildtest_opensslv.c test/buildtest_ossl_typ.c test/buildtest_pem.c test/buildtest_pem2.c test/buildtest_pkcs12.c test/buildtest_pkcs7.c test/buildtest_rand.c test/buildtest_rand_drbg.c test/buildtest_rc2.c test/buildtest_rc4.c test/buildtest_ripemd.c test/buildtest_rsa.c test/buildtest_safestack.c test/buildtest_seed.c test/buildtest_sha.c test/buildtest_srp.c test/buildtest_srtp.c test/buildtest_ssl.c test/buildtest_ssl2.c test/buildtest_stack.c test/buildtest_store.c test/buildtest_symhacks.c test/buildtest_tls1.c test/buildtest_ts.c test/buildtest_txt_db.c test/buildtest_ui.c test/buildtest_whrlpool.c test/buildtest_x509.c test/buildtest_x509_vfy.c test/buildtest_x509v3.c tools/c_rehash.pl providers/common/der/der_digests_gen.c providers/common/der/der_dsa_gen.c providers/common/der/der_ec_gen.c providers/common/der/der_ecx_gen.c providers/common/der/der_ml_dsa_gen.c providers/common/der/der_rsa_gen.c providers/common/der/der_slh_dsa_gen.c providers/common/der/der_sm2_gen.c providers/common/der/der_wrap_gen.c
+
+include node-generated.mk

 # Variables starting with LIB_ are used to build library object files
 # and shared libraries.
@@ -35,16 +37,10 @@ APPS_OPENSSL=apps/openssl
 # see https://github.com/openssl/openssl/blob/master/crypto/sha/asm/sha256-586.pl#L82
 CFLAGS    += -DOPENSSL_IA32_SSE2

-include/crypto/bn_conf.h: include/crypto/bn_conf.h.in configdata.pm
-	$(PERL) -I$(BLDDIR) -Mconfigdata util/dofile.pl \
-	    -omakefile include/crypto/bn_conf.h.in > $@
 include/crypto/dso_conf.h: include/crypto/dso_conf.h.in configdata.pm
 	$(PERL) -I$(BLDDIR) -Mconfigdata util/dofile.pl \
 	    -omakefile include/crypto/dso_conf.h.in > $@

-include/internal/param_names.h: include/internal/param_names.h.in configdata.pm
-	$(PERL) -I$(BLDDIR) -Mconfigdata util/dofile.pl \
-	    -omakefile include/internal/param_names.h.in > $@

 include/openssl/asn1.h: include/openssl/asn1.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
@@ -78,7 +74,7 @@ include/openssl/configuration.h: include/openssl/configuration.h.in configdata.p
 	    "-omakefile" "include/openssl/configuration.h.in" > $@
 include/openssl/core_names.h: include/openssl/core_names.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
-	    "-omakefile" "include/openssl/core_names.h.in" > $@
+	    "-oMakefile" "include/openssl/core_names.h.in" > $@
 include/openssl/crmf.h: include/openssl/crmf.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
 	    "-omakefile" "include/openssl/crmf.h.in" > $@
@@ -1980,8 +1976,6 @@ crypto/ocsp/libcrypto-shlib-v3_ocsp.d: "crypto/ocsp/v3_ocsp.c"
 	$(CC)  $(LIB_CFLAGS) /I "." /I "crypto/include" /I "include" $(LIB_CPPFLAGS) /Zs /showIncludes "crypto/ocsp/v3_ocsp.c" 2>&1 > crypto/ocsp/libcrypto-shlib-v3_ocsp.d
 crypto/ocsp/libcrypto-shlib-v3_ocsp.obj: crypto/ocsp/libcrypto-shlib-v3_ocsp.d
 	$(CC)  $(LIB_CFLAGS) /I "." /I "crypto/include" /I "include" $(LIB_CPPFLAGS) -c $(COUTFLAG)$@ "crypto/ocsp/v3_ocsp.c"
-crypto/params_idx.c: crypto/params_idx.c.in configdata.pm util/perl/OpenSSL/paramnames.pm
-	"$(PERL)" "-I." "-Iutil/perl" "-Mconfigdata" "-MOpenSSL::paramnames" "util/dofile.pl" "-omakefile" crypto/params_idx.c.in > $@
 crypto/pem/libcrypto-shlib-pem_all.d: "crypto/pem/pem_all.c"
 	$(CC)  $(LIB_CFLAGS) /I "." /I "crypto/include" /I "include" $(LIB_CPPFLAGS) /Zs /showIncludes "crypto/pem/pem_all.c" 2>&1 > crypto/pem/libcrypto-shlib-pem_all.d
 crypto/pem/libcrypto-shlib-pem_all.obj: crypto/pem/libcrypto-shlib-pem_all.d
diff --git a/deps/openssl/config/Makefile_VC-WIN64-ARM b/deps/openssl/config/Makefile_VC-WIN64-ARM
index a0a8a6c3a3b..20b39f4e992 100644
--- a/deps/openssl/config/Makefile_VC-WIN64-ARM
+++ b/deps/openssl/config/Makefile_VC-WIN64-ARM
@@ -16,8 +16,10 @@ MINOR=1.1

 SHLIB_VERSION_NUMBER=1.1

-GENERATED_MANDATORY=crypto/params_idx.c include/crypto/bn_conf.h include/crypto/dso_conf.h include/internal/param_names.h include/openssl/asn1.h include/openssl/asn1t.h include/openssl/bio.h include/openssl/cmp.h include/openssl/comp.h include/openssl/cms.h include/openssl/conf.h include/openssl/configuration.h include/openssl/core_names.h include/openssl/crmf.h include/openssl/crypto.h include/openssl/ct.h include/openssl/err.h include/openssl/ess.h include/openssl/fipskey.h include/openssl/lhash.h include/openssl/ocsp.h include/openssl/opensslv.h include/openssl/pkcs12.h include/openssl/pkcs7.h include/openssl/safestack.h include/openssl/srp.h include/openssl/ssl.h include/openssl/ui.h include/openssl/x509.h include/openssl/x509_acert.h include/openssl/x509_vfy.h include/openssl/x509v3.h providers/common/include/prov/der_digests.h providers/common/include/prov/der_dsa.h providers/common/include/prov/der_ec.h providers/common/include/prov/der_ecx.h providers/common/include/prov/der_ml_dsa.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_slh_dsa.h providers/common/include/prov/der_sm2.h providers/common/include/prov/der_wrap.h
-GENERATED=crypto/buildinf.h apps/progs.h crypto/params_idx.c providers/common/der/der_digests_gen.c providers/common/der/der_dsa_gen.c providers/common/der/der_ec_gen.c providers/common/der/der_ecx_gen.c providers/common/der/der_rsa_gen.c providers/common/der/der_sm2_gen.c providers/common/der/der_wrap_gen.c apps/progs.c providers/common/der/der_digests_gen.c providers/common/der/der_dsa_gen.c providers/common/der/der_ec_gen.c providers/common/der/der_ecx_gen.c providers/common/der/der_ml_dsa_gen.c providers/common/der/der_rsa_gen.c providers/common/der/der_slh_dsa_gen.c providers/common/der/der_sm2_gen.c providers/common/der/der_wrap_gen.c
+GENERATED_MANDATORY=include/crypto/dso_conf.h include/openssl/asn1.h include/openssl/asn1t.h include/openssl/bio.h include/openssl/cmp.h include/openssl/comp.h include/openssl/cms.h include/openssl/conf.h include/openssl/configuration.h include/openssl/core_names.h include/openssl/crmf.h include/openssl/crypto.h include/openssl/ct.h include/openssl/err.h include/openssl/ess.h include/openssl/fipskey.h include/openssl/lhash.h include/openssl/ocsp.h include/openssl/opensslv.h include/openssl/pkcs12.h include/openssl/pkcs7.h include/openssl/safestack.h include/openssl/srp.h include/openssl/ssl.h include/openssl/ui.h include/openssl/x509.h include/openssl/x509_acert.h include/openssl/x509_vfy.h include/openssl/x509v3.h providers/common/include/prov/der_digests.h providers/common/include/prov/der_dsa.h providers/common/include/prov/der_ec.h providers/common/include/prov/der_ecx.h providers/common/include/prov/der_ml_dsa.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_slh_dsa.h providers/common/include/prov/der_sm2.h providers/common/include/prov/der_wrap.h
+GENERATED=crypto/buildinf.h apps/progs.h providers/common/der/der_digests_gen.c providers/common/der/der_dsa_gen.c providers/common/der/der_ec_gen.c providers/common/der/der_ecx_gen.c providers/common/der/der_rsa_gen.c providers/common/der/der_sm2_gen.c providers/common/der/der_wrap_gen.c apps/progs.c providers/common/der/der_digests_gen.c providers/common/der/der_dsa_gen.c providers/common/der/der_ec_gen.c providers/common/der/der_ecx_gen.c providers/common/der/der_ml_dsa_gen.c providers/common/der/der_rsa_gen.c providers/common/der/der_slh_dsa_gen.c providers/common/der/der_sm2_gen.c providers/common/der/der_wrap_gen.c
+
+include node-generated.mk

 INSTALL_LIBS="libcrypto.lib" "libssl.lib"
 INSTALL_SHLIBS="libcrypto-1_1-arm64.dll" "libssl-1_1-arm64.dll"
@@ -138,19 +140,11 @@ apps/progs.h: apps/progs.c
 apps/progs.c:
 	"$(PERL)" "apps/progs.pl" "-C" $(APPS_OPENSSL) > $@

-crypto/params_idx.c: crypto/params_idx.c.in configdata.pm util/perl/OpenSSL/paramnames.pm
-	"$(PERL)" "-I." "-Iutil/perl" "-Mconfigdata" "-MOpenSSL::paramnames" "util/dofile.pl" "-omakefile" crypto/params_idx.c.in > $@

-include/crypto/bn_conf.h:
-	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
-	    "-omakefile" "include/crypto/bn_conf.h.in" > $@
 include/crypto/dso_conf.h:
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
 	    "-omakefile" "include/crypto/dso_conf.h.in" > $@

-include/internal/param_names.h: include/internal/param_names.h.in configdata.pm
-	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
-	    "-omakefile" "include/internal/param_names.h.in" > $@

 include/openssl/asn1.h: include/openssl/asn1.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
@@ -184,7 +178,7 @@ include/openssl/configuration.h: include/openssl/configuration.h.in configdata.p
 	    "-omakefile" "include/openssl/configuration.h.in" > $@
 include/openssl/core_names.h: include/openssl/core_names.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
-	    "-omakefile" "include/openssl/core_names.h.in" > $@
+	    "-oMakefile" "include/openssl/core_names.h.in" > $@
 include/openssl/crmf.h: include/openssl/crmf.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
 	    "-omakefile" "include/openssl/crmf.h.in" > $@
diff --git a/deps/openssl/config/Makefile_VC-WIN64A b/deps/openssl/config/Makefile_VC-WIN64A
index 5bc82631888..a14018ce13f 100644
--- a/deps/openssl/config/Makefile_VC-WIN64A
+++ b/deps/openssl/config/Makefile_VC-WIN64A
@@ -5,22 +5,18 @@ RM= rm -f
 AS=nasm
 ASFLAGS=-g

-GENERATED_MANDATORY=crypto/params_idx.c include/crypto/bn_conf.h include/crypto/dso_conf.h include/internal/param_names.h include/openssl/asn1.h include/openssl/asn1t.h include/openssl/bio.h include/openssl/cmp.h include/openssl/comp.h include/openssl/cms.h include/openssl/conf.h include/openssl/configuration.h include/openssl/core_names.h include/openssl/crmf.h include/openssl/crypto.h include/openssl/ct.h include/openssl/err.h include/openssl/ess.h include/openssl/fipskey.h include/openssl/lhash.h include/openssl/ocsp.h include/openssl/opensslv.h include/openssl/pkcs12.h include/openssl/pkcs7.h include/openssl/safestack.h include/openssl/srp.h include/openssl/ssl.h include/openssl/ui.h include/openssl/x509.h include/openssl/x509_acert.h include/openssl/x509_vfy.h include/openssl/x509v3.h providers/common/include/prov/der_digests.h providers/common/include/prov/der_dsa.h providers/common/include/prov/der_ec.h providers/common/include/prov/der_ecx.h providers/common/include/prov/der_ml_dsa.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_slh_dsa.h providers/common/include/prov/der_sm2.h providers/common/include/prov/der_wrap.h
-GENERATED=apps/CA.pl apps/openssl.rc apps/progs.h apps/tsget.pl crypto/aes/aes-x86_64.asm crypto/aes/aesni-mb-x86_64.asm crypto/aes/aesni-sha1-x86_64.asm crypto/aes/aesni-sha256-x86_64.asm crypto/aes/aesni-x86_64.asm crypto/aesni-xts-avx512.asm crypto/aes/bsaes-x86_64.asm crypto/aes/vpaes-x86_64.asm crypto/bn/rsaz-avx2.asm crypto/bn/rsaz-2k-avx512.asm crypto/bn/rsaz-2k-avxifma.asm crypto/bn/rsaz-3k-avx512.asm crypto/bn/rsaz-3k-avxifma.asm crypto/bn/rsaz-4k-avx512.asm crypto/bn/rsaz-4k-avxifma.asm crypto/bn/rsaz-x86_64.asm crypto/bn/x86_64-gf2m.asm crypto/bn/x86_64-mont.asm crypto/bn/x86_64-mont5.asm crypto/buildinf.h crypto/camellia/cmll-x86_64.asm crypto/chacha/chacha-x86_64.asm crypto/ec/ecp_nistz256-x86_64.asm crypto/ec/x25519-x86_64.asm crypto/md5/md5-x86_64.asm crypto/modes/aes-gcm-avx512.asm crypto/modes/aesni-gcm-x86_64.asm crypto/modes/ghash-x86_64.asm crypto/params_idx.c crypto/poly1305/poly1305-x86_64.asm crypto/rc4/rc4-md5-x86_64.asm crypto/rc4/rc4-x86_64.asm crypto/sha/keccak1600-x86_64.asm crypto/sha/sha1-mb-x86_64.asm crypto/sha/sha1-x86_64.asm crypto/sha/sha256-mb-x86_64.asm crypto/sha/sha256-x86_64.asm crypto/sha/sha512-x86_64.asm crypto/uplink-x86_64.asm crypto/whrlpool/wp-x86_64.asm crypto/x86_64cpuid.asm engines/e_padlock-x86_64.asm libcrypto.def libcrypto.rc libssl.def libssl.rc test/buildtest_aes.c test/buildtest_asn1.c test/buildtest_asn1t.c test/buildtest_async.c test/buildtest_bio.c test/buildtest_blowfish.c test/buildtest_bn.c test/buildtest_buffer.c test/buildtest_camellia.c test/buildtest_cast.c test/buildtest_cmac.c test/buildtest_cms.c test/buildtest_comp.c test/buildtest_conf.c test/buildtest_conf_api.c test/buildtest_crypto.c test/buildtest_ct.c test/buildtest_des.c test/buildtest_dh.c test/buildtest_dsa.c test/buildtest_dtls1.c test/buildtest_e_os2.c test/buildtest_ebcdic.c test/buildtest_ec.c test/buildtest_ecdh.c test/buildtest_ecdsa.c test/buildtest_engine.c test/buildtest_evp.c test/buildtest_hmac.c test/buildtest_idea.c test/buildtest_kdf.c test/buildtest_lhash.c test/buildtest_md4.c test/buildtest_md5.c test/buildtest_mdc2.c test/buildtest_modes.c test/buildtest_obj_mac.c test/buildtest_objects.c test/buildtest_ocsp.c test/buildtest_opensslv.c test/buildtest_ossl_typ.c test/buildtest_pem.c test/buildtest_pem2.c test/buildtest_pkcs12.c test/buildtest_pkcs7.c test/buildtest_rand.c test/buildtest_rand_drbg.c test/buildtest_rc2.c test/buildtest_rc4.c test/buildtest_ripemd.c test/buildtest_rsa.c test/buildtest_safestack.c test/buildtest_seed.c test/buildtest_sha.c test/buildtest_srp.c test/buildtest_srtp.c test/buildtest_ssl.c test/buildtest_ssl2.c test/buildtest_stack.c test/buildtest_store.c test/buildtest_symhacks.c test/buildtest_tls1.c test/buildtest_ts.c test/buildtest_txt_db.c test/buildtest_ui.c test/buildtest_whrlpool.c test/buildtest_x509.c test/buildtest_x509_vfy.c test/buildtest_x509v3.c tools/c_rehash.pl providers/common/der/der_digests_gen.c providers/common/der/der_dsa_gen.c providers/common/der/der_ec_gen.c providers/common/der/der_ecx_gen.c providers/common/der/der_ml_dsa.c providers/common/der/der_rsa_gen.c providers/common/der/der_slh_dsa.c providers/common/der/der_sm2_gen.c providers/common/der/der_wrap_gen.c
+GENERATED_MANDATORY=include/crypto/dso_conf.h include/openssl/asn1.h include/openssl/asn1t.h include/openssl/bio.h include/openssl/cmp.h include/openssl/comp.h include/openssl/cms.h include/openssl/conf.h include/openssl/configuration.h include/openssl/core_names.h include/openssl/crmf.h include/openssl/crypto.h include/openssl/ct.h include/openssl/err.h include/openssl/ess.h include/openssl/fipskey.h include/openssl/lhash.h include/openssl/ocsp.h include/openssl/opensslv.h include/openssl/pkcs12.h include/openssl/pkcs7.h include/openssl/safestack.h include/openssl/srp.h include/openssl/ssl.h include/openssl/ui.h include/openssl/x509.h include/openssl/x509_acert.h include/openssl/x509_vfy.h include/openssl/x509v3.h providers/common/include/prov/der_digests.h providers/common/include/prov/der_dsa.h providers/common/include/prov/der_ec.h providers/common/include/prov/der_ecx.h providers/common/include/prov/der_ml_dsa.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_slh_dsa.h providers/common/include/prov/der_sm2.h providers/common/include/prov/der_wrap.h
+GENERATED=apps/CA.pl apps/openssl.rc apps/progs.h apps/tsget.pl crypto/aes/aes-x86_64.asm crypto/aes/aesni-mb-x86_64.asm crypto/aes/aesni-sha1-x86_64.asm crypto/aes/aesni-sha256-x86_64.asm crypto/aes/aesni-x86_64.asm crypto/aesni-xts-avx512.asm crypto/aes/bsaes-x86_64.asm crypto/aes/vpaes-x86_64.asm crypto/bn/rsaz-avx2.asm crypto/bn/rsaz-2k-avx512.asm crypto/bn/rsaz-2k-avxifma.asm crypto/bn/rsaz-3k-avx512.asm crypto/bn/rsaz-3k-avxifma.asm crypto/bn/rsaz-4k-avx512.asm crypto/bn/rsaz-4k-avxifma.asm crypto/bn/rsaz-x86_64.asm crypto/bn/x86_64-gf2m.asm crypto/bn/x86_64-mont.asm crypto/bn/x86_64-mont5.asm crypto/buildinf.h crypto/camellia/cmll-x86_64.asm crypto/chacha/chacha-x86_64.asm crypto/ec/ecp_nistz256-x86_64.asm crypto/ec/x25519-x86_64.asm crypto/md5/md5-x86_64.asm crypto/modes/aes-gcm-avx512.asm crypto/modes/aesni-gcm-x86_64.asm crypto/modes/ghash-x86_64.asm crypto/poly1305/poly1305-x86_64.asm crypto/rc4/rc4-md5-x86_64.asm crypto/rc4/rc4-x86_64.asm crypto/sha/keccak1600-x86_64.asm crypto/sha/sha1-mb-x86_64.asm crypto/sha/sha1-x86_64.asm crypto/sha/sha256-mb-x86_64.asm crypto/sha/sha256-x86_64.asm crypto/sha/sha512-x86_64.asm crypto/uplink-x86_64.asm crypto/whrlpool/wp-x86_64.asm crypto/x86_64cpuid.asm engines/e_padlock-x86_64.asm libcrypto.def libcrypto.rc libssl.def libssl.rc test/buildtest_aes.c test/buildtest_asn1.c test/buildtest_asn1t.c test/buildtest_async.c test/buildtest_bio.c test/buildtest_blowfish.c test/buildtest_bn.c test/buildtest_buffer.c test/buildtest_camellia.c test/buildtest_cast.c test/buildtest_cmac.c test/buildtest_cms.c test/buildtest_comp.c test/buildtest_conf.c test/buildtest_conf_api.c test/buildtest_crypto.c test/buildtest_ct.c test/buildtest_des.c test/buildtest_dh.c test/buildtest_dsa.c test/buildtest_dtls1.c test/buildtest_e_os2.c test/buildtest_ebcdic.c test/buildtest_ec.c test/buildtest_ecdh.c test/buildtest_ecdsa.c test/buildtest_engine.c test/buildtest_evp.c test/buildtest_hmac.c test/buildtest_idea.c test/buildtest_kdf.c test/buildtest_lhash.c test/buildtest_md4.c test/buildtest_md5.c test/buildtest_mdc2.c test/buildtest_modes.c test/buildtest_obj_mac.c test/buildtest_objects.c test/buildtest_ocsp.c test/buildtest_opensslv.c test/buildtest_ossl_typ.c test/buildtest_pem.c test/buildtest_pem2.c test/buildtest_pkcs12.c test/buildtest_pkcs7.c test/buildtest_rand.c test/buildtest_rand_drbg.c test/buildtest_rc2.c test/buildtest_rc4.c test/buildtest_ripemd.c test/buildtest_rsa.c test/buildtest_safestack.c test/buildtest_seed.c test/buildtest_sha.c test/buildtest_srp.c test/buildtest_srtp.c test/buildtest_ssl.c test/buildtest_ssl2.c test/buildtest_stack.c test/buildtest_store.c test/buildtest_symhacks.c test/buildtest_tls1.c test/buildtest_ts.c test/buildtest_txt_db.c test/buildtest_ui.c test/buildtest_whrlpool.c test/buildtest_x509.c test/buildtest_x509_vfy.c test/buildtest_x509v3.c tools/c_rehash.pl providers/common/der/der_digests_gen.c providers/common/der/der_dsa_gen.c providers/common/der/der_ec_gen.c providers/common/der/der_ecx_gen.c providers/common/der/der_ml_dsa.c providers/common/der/der_rsa_gen.c providers/common/der/der_slh_dsa.c providers/common/der/der_sm2_gen.c providers/common/der/der_wrap_gen.c
+
+include node-generated.mk

 PERLASM_SCHEME= auto
 APPS_OPENSSL=apps/openssl

-include/crypto/bn_conf.h: include/crypto/bn_conf.h.in configdata.pm
-	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
-	    "-omakefile" "include/crypto/bn_conf.h.in" > $@
 include/crypto/dso_conf.h: include/crypto/dso_conf.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
 	    "-omakefile" "include/crypto/dso_conf.h.in" > $@

-include/internal/param_names.h: include/internal/param_names.h.in configdata.pm
-	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
-	    "-omakefile" "include/internal/param_names.h.in" > $@

 include/openssl/asn1.h: include/openssl/asn1.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
@@ -54,7 +50,7 @@ include/openssl/configuration.h: include/openssl/configuration.h.in configdata.p
 	    "-omakefile" "include/openssl/configuration.h.in" > $@
 include/openssl/core_names.h: include/openssl/core_names.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
-	    "-omakefile" "include/openssl/core_names.h.in" > $@
+	    "-oMakefile" "include/openssl/core_names.h.in" > $@
 include/openssl/crmf.h: include/openssl/crmf.h.in configdata.pm
 	"$(PERL)" "-I$(BLDDIR)" -Mconfigdata "util/dofile.pl" \
 	    "-omakefile" "include/openssl/crmf.h.in" > $@
@@ -1994,8 +1990,6 @@ crypto/ocsp/v3_ocsp.d: "crypto/ocsp/v3_ocsp.c"
 	$(CC)  $(LIB_CFLAGS) /I "." /I "crypto/include" /I "include" $(LIB_CPPFLAGS) /Zs /showIncludes "crypto/ocsp/v3_ocsp.c" 2>&1 > crypto/ocsp/v3_ocsp.d
 crypto/ocsp/v3_ocsp.obj: crypto/ocsp/v3_ocsp.d
 	$(CC)  $(LIB_CFLAGS) /I "." /I "crypto/include" /I "include" $(LIB_CPPFLAGS) -c $(COUTFLAG)$@ "crypto/ocsp/v3_ocsp.c"
-crypto/params_idx.c: crypto/params_idx.c.in configdata.pm util/perl/OpenSSL/paramnames.pm
-	"$(PERL)" "-I." "-Iutil/perl" "-Mconfigdata" "-MOpenSSL::paramnames" "util/dofile.pl" "-omakefile" crypto/params_idx.c.in > $@
 crypto/pem/pem_all.d: "crypto/pem/pem_all.c"
 	$(CC)  $(LIB_CFLAGS) /I "." /I "crypto/include" /I "include" $(LIB_CPPFLAGS) /Zs /showIncludes "crypto/pem/pem_all.c" 2>&1 > crypto/pem/pem_all.d
 crypto/pem/pem_all.obj: crypto/pem/pem_all.d
diff --git a/deps/openssl/config/generate_gypi.pl b/deps/openssl/config/generate_gypi.pl
index 45a9306e17a..cdd97de185e 100755
--- a/deps/openssl/config/generate_gypi.pl
+++ b/deps/openssl/config/generate_gypi.pl
@@ -8,6 +8,7 @@ use lib "$FindBin::Bin/../openssl/util/perl/OpenSSL";
 use File::Basename;
 use File::Spec::Functions qw/:DEFAULT abs2rel rel2abs/;
 use File::Copy;
+use File::Compare;
 use File::Path qw/make_path/;
 #use with_fallback qw(Text::Template);
 use fallback qw(Text::Template);
@@ -40,17 +41,40 @@ our $src_dir = "../openssl";
 our $arch_dir = "../config/archs/$arch";
 our $base_dir = "$arch_dir/$asm";

+# These generators use source data rather than the target configuration.
+my %common_headers = map { $_ => 1 } qw(
+  crypto/asn1/charmap.h
+  crypto/bn/bn_prime.h
+  crypto/conf/conf_def.h
+  crypto/objects/obj_dat.h
+  crypto/objects/obj_xref.h
+  include/crypto/ec_params.h
+  include/crypto/rsa_params.h
+  include/openssl/core_names.h
+  include/openssl/obj_mac.h
+);
+my %common_files = map { $_ => 1 } grep {
+  $common_headers{$_}
+    || $unified_info{generate}->{$_}->[0] eq 'util/mkerr.pl'
+    || (m|^providers/.*\.inc$| && grep {
+      m{^util/perl\|OpenSSL/(?:paramnames|fipsparams)\.pm$}
+    } @{$unified_info{depends}->{$_} || []})
+} keys %{$unified_info{generate}};
+
 my $is_win = ($arch =~/^VC-WIN/);
 # VC-WIN32 and VC-WIN64A generate makefile but it can be available
 # with only nmake. Use pre-created Makefile_VC_WIN32
 # Makefile_VC-WIN64A instead.
 my $makefile = $is_win ? "../config/Makefile_$arch": "Makefile";
+generate_windows_makefile($makefile) if $is_win;
 # Generate arch dependent header files with Makefile
 my $buildinf = "crypto/buildinf.h";
 my $progs = "apps/progs.h";
-my $prov_headers = "providers/common/include/prov/der_dsa.h providers/common/include/prov/der_ml_dsa.h providers/common/include/prov/der_slh_dsa.h providers/common/include/prov/der_wrap.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_ecx.h providers/common/include/prov/der_sm2.h providers/common/include/prov/der_ec.h providers/common/include/prov/der_digests.h";
+my @generated_headers = sort grep { /\.h$/ && $_ ne $progs }
+    keys %{$unified_info{generate}};
+my $generated_headers = join(' ', @generated_headers);
 my $fips_ld = ($arch =~ m/linux/ ? "providers/fips.ld" : "");
-my $cmd1 = "cd ../openssl; make -f $makefile clean build_generated $buildinf $progs $prov_headers $fips_ld;";
+my $cmd1 = "cd ../openssl; make -f $makefile clean build_generated $buildinf $progs $generated_headers $fips_ld;";
 system($cmd1) == 0 or die "Error in system($cmd1)";

 # Copy and move all arch dependent header files into config/archs
@@ -67,17 +91,15 @@ if (@$make_path_err) {
 }
 copy("$src_dir/configdata.pm", "$base_dir/") or die "Copy failed: $!";

-my @openssl_dir_headers = shift @ARGV;
+my @openssl_dir_headers = merge_headers(shift @ARGV, 'openssl');
 copy_headers(@openssl_dir_headers, 'openssl');

-my @crypto_dir_headers = shift @ARGV;
+my @crypto_dir_headers = merge_headers(shift @ARGV, 'crypto');
 copy_headers(@crypto_dir_headers, 'crypto');

-my @internal_dir_headers = shift @ARGV;
+my @internal_dir_headers = merge_headers(shift @ARGV, 'internal');
 copy_headers(@internal_dir_headers, 'internal');

-move("$src_dir/include/crypto/bn_conf.h",
-     "$base_dir/include/crypto/bn_conf.h") or die "Move failed: $!";
 move("$src_dir/include/crypto/dso_conf.h",
      "$base_dir/include/crypto/dso_conf.h") or die "Move failed: $!";

@@ -87,28 +109,27 @@ move("$src_dir/$progs",
      "$base_dir/include") or die "Copy failed: $!";
 copy("$src_dir/apps/progs.c",
      "$base_dir/apps") or die "Copy failed: $!";
-
-move("$src_dir/include/internal/param_names.h",
-     "$base_dir/include/internal/param_names.h") or die "Move failed: $!";
-
-copy("$src_dir/providers/common/include/prov/der_dsa.h",
-     "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
-copy("$src_dir/providers/common/include/prov/der_ml_dsa.h",
-     "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
-copy("$src_dir/providers/common/include/prov/der_slh_dsa.h",
-     "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
-copy("$src_dir/providers/common/include/prov/der_wrap.h",
-     "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
-copy("$src_dir/providers/common/include/prov/der_rsa.h",
-     "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
-copy("$src_dir/providers/common/include/prov/der_ecx.h",
-     "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
-copy("$src_dir/providers/common/include/prov/der_sm2.h",
-     "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
-copy("$src_dir/providers/common/include/prov/der_ec.h",
-     "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
-copy("$src_dir/providers/common/include/prov/der_digests.h",
-     "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
+make_path("$base_dir/apps/include");
+copy("$src_dir/apps/include/configuration.h", "$base_dir/apps/include/")
+    or die "Copy apps/include/configuration.h failed: $!";
+
+# OpenSSL 4.x generates provider parameter decoders alongside its sources.
+my @generated_includes = sort grep { /\.inc$/ }
+    keys %{$unified_info{generate}};
+my %generated_include_dirs = ('../../../common' => 1);
+foreach my $include (grep { !m|^include/| || $common_files{$_} }
+                     @generated_headers, @generated_includes) {
+  my $dir = dirname($include);
+  copy_generated($include);
+  my $include_dir = $dir =~ m{^(.*?/include)(?:/|$)} ? $1 : $dir;
+  if ($common_files{$include}) {
+    $generated_include_dirs{"../../../common/$include_dir"} = 1;
+  } else {
+    $generated_include_dirs{"./$include_dir"} = 1
+        unless $include_dir eq 'providers/common/include';
+  }
+}
+my @generated_include_dirs = sort keys %generated_include_dirs;

 my $linker_script_dir = "<(PRODUCT_DIR)/../../deps/openssl/config/archs/$arch/$asm/providers";
 my $fips_linker_script = "";
@@ -142,16 +163,12 @@ foreach my $obj (@{$unified_info{sources}->{'libcrypto'}}) {
     $src =~ s\.[sS]$\.asm\ if ($is_win);
     push(@generated_srcs, $src);
   } else {
-    if ($src =~ m/\.c$/) {
+    if ($src =~ m/\.(?:c|s|S|asm)$/) {
       push(@libcrypto_srcs, $src);
     }
   }
 }

-if ($arch eq 'linux32-s390x' || $arch eq  'linux64-s390x') {
-  push(@libcrypto_srcs, 'crypto/bn/asm/s390x.S');
-}
-
 my @lib_defines = ();
 foreach my $df (@{$unified_info{defines}->{libcrypto}}) {
   #print("libcrypto defines: $df\n");
@@ -168,7 +185,7 @@ foreach my $obj (@{$unified_info{sources}->{'providers/libdefault.a'}}) {
     $src =~ s\.[sS]$\.asm\ if ($is_win);
     push(@generated_srcs, $src);
   } else {
-    if ($src =~ m/\.c$/) {
+    if ($src =~ m/\.(?:c|s|S|asm)$/) {
       push(@libcrypto_srcs, $src);
     }
   }
@@ -183,7 +200,7 @@ foreach my $obj (@{$unified_info{sources}->{'providers/libcommon.a'}}) {
     $src =~ s\.[sS]$\.asm\ if ($is_win);
     push(@generated_srcs, $src);
   } else {
-    if ($src =~ m/\.c$/) {
+    if ($src =~ m/\.(?:c|s|S|asm)$/) {
       push(@libcrypto_srcs, $src);
     }
   }
@@ -198,7 +215,7 @@ foreach my $obj (@{$unified_info{sources}->{'providers/liblegacy.a'}}) {
     $src =~ s\.[sS]$\.asm\ if ($is_win);
     push(@generated_srcs, $src);
   } else {
-    if ($src =~ m/\.c$/) {
+    if ($src =~ m/\.(?:c|s|S|asm)$/) {
       push(@libcrypto_srcs, $src);
     }
   }
@@ -210,7 +227,7 @@ foreach my $obj (@{$unified_info{sources}->{'providers/legacy'}}) {
   } else {
     my $src = ${$unified_info{sources}->{$obj}}[0];
     #print("providers/fips obj: $obj, src: $src\n");
-    if ($src =~ m/\.c$/) {
+    if ($src =~ m/\.(?:c|s|S|asm)$/) {
       push(@libcrypto_srcs, $src);
     }
   }
@@ -226,7 +243,7 @@ foreach my $obj (@{$unified_info{sources}->{'providers/libfips.a'}}) {
     #$src =~ s\.[sS]$\.asm\ if ($is_win);
     #push(@generated_srcs, $src);
   } else {
-    if ($src =~ m/\.c$/) {
+    if ($src =~ m/\.(?:c|s|S|asm)$/) {
       push(@libfips_srcs, $src);
     }
   }
@@ -241,7 +258,7 @@ foreach my $obj (@{$unified_info{sources}->{'providers/libcommon.a'}}) {
     #$src =~ s\.[sS]$\.asm\ if ($is_win);
     #push(@generated_srcs, $src);
   } else {
-    if ($src =~ m/\.c$/) {
+    if ($src =~ m/\.(?:c|s|S|asm)$/) {
       push(@libfips_srcs, $src);
     }
   }
@@ -253,7 +270,7 @@ foreach my $obj (@{$unified_info{sources}->{'providers/fips'}}) {
   } else {
     my $src = ${$unified_info{sources}->{$obj}}[0];
     #print("providers/fips obj: $obj, src: $src\n");
-    if ($src =~ m/\.c$/) {
+    if ($src =~ m/\.(?:c|s|S|asm)$/) {
       push(@libfips_srcs, $src);
     }
   }
@@ -277,9 +294,9 @@ foreach my $obj (@{$unified_info{sources}->{'apps/openssl'}}) {

 # Generate all asm files and copy into config/archs
 foreach my $src (@generated_srcs) {
-  my $cmd = "cd ../openssl; CC=gcc ASM=nasm make -f $makefile $src;" .
-    "cp --parents $src ../config/archs/$arch/$asm; cd ../config";
-  system("$cmd") == 0 or die "Error in system($cmd)";
+  my $cmd = "cd ../openssl && CC=gcc ASM=nasm make -f $makefile $src";
+  system($cmd) == 0 or die "Error in system($cmd)";
+  copy_generated($src);
 }

 $target{'lib_cppflags'} =~ s/-D//g;
@@ -323,6 +340,8 @@ my $gypi = $template->fill_in(
         libcrypto_srcs => \@libcrypto_srcs,
         lib_defines => \@lib_defines,
         generated_srcs => \@generated_srcs,
+        common_files => \%common_files,
+        generated_include_dirs => \@generated_include_dirs,
         config => \%config,
         target => \%target,
         cflags => \@cflags,
@@ -349,6 +368,8 @@ my $fipsgypi = $fipstemplate->fill_in(
         libfips_srcs => \@libfips_srcs,
         libfips_defines => \@libfips_defines,
         generated_srcs => \@generated_srcs,
+        common_files => \%common_files,
+        generated_include_dirs => \@generated_include_dirs,
         config => \%config,
         target => \%target,
         cflags => \@cflags,
@@ -389,10 +410,15 @@ print CLGYPI "$clgypi";
 close(CLGYPI);

 # Clean Up
-my $cmd2 ="cd $src_dir; make -f $makefile clean; make -f $makefile distclean;" .
+my $cmd2 ="cd $src_dir && make -f $makefile clean && make -f $makefile distclean && " .
     "git clean -f $src_dir";
 system($cmd2) == 0 or die "Error in system($cmd2)";

+# Recreate wrappers after cleanup, including headers added by newer releases.
+my @common_headers = sort grep { m|^include/.*\.h$| } keys %common_files;
+my $headers_cmd = "$^X -I$src_dir ./generate_headers.pl \"@openssl_dir_headers\" \"@crypto_dir_headers\" \"@internal_dir_headers\" \"@common_headers\"";
+system($headers_cmd) == 0 or die "Error in system($headers_cmd)";
+

 sub copy_headers {
   my @headers = split / /, $_[0];
@@ -400,7 +426,84 @@ sub copy_headers {
   foreach my $header_name (@headers) {
     # Copy the header from OpenSSL source directory to the arch specific dir.
     #print("copy header $src_dir/include/$inc_dir/${header_name}.h to $base_dir/include/$inc_dir \n");
-    copy("$src_dir/include/$inc_dir/${header_name}.h",
-         "$base_dir/include/$inc_dir/") or die "Copy failed: $!";
+    copy_generated("include/$inc_dir/${header_name}.h");
    }
 }
+
+sub merge_headers {
+  my ($headers, $inc_dir) = @_;
+  my %headers = map { $_ => 1 } split / /, $headers;
+  foreach my $path (keys %{$unified_info{generate}}) {
+    next if $common_files{$path};
+    $headers{$1} = 1 if $path =~ m|^include/$inc_dir/([^/]+)\.h$|;
+  }
+  return join(' ', sort keys %headers);
+}
+
+sub copy_generated {
+  my ($file) = @_;
+  my $dest = $common_files{$file} ? "./common/$file" : "$base_dir/$file";
+  if ($common_files{$file} && -f $dest) {
+    compare("$src_dir/$file", $dest) == 0
+        or die "Common file $file differs for $arch/$asm";
+    return;
+  }
+  make_path(dirname($dest));
+  copy("$src_dir/$file", $dest) or die "Copy $file failed: $!";
+}
+
+sub generate_windows_makefile {
+  my ($makefile) = @_;
+  open my $input, '<', "$src_dir/$makefile" or die "Open $makefile failed: $!";
+  my %rules;
+  while (<$input>) {
+    $rules{$1} = 1 if /^([^\s:]+):/;
+  }
+  close $input;
+
+  open my $output, '>', "$src_dir/node-generated.mk" or die "Open node-generated.mk failed: $!";
+  print $output "SRCDIR=.\nBLDDIR=.\n";
+  my %sources = map { $_ => 1 }
+      map { @{$unified_info{sources}->{$_}} } keys %{$unified_info{sources}};
+  foreach my $file (sort keys %{$unified_info{generate}}) {
+    my $is_asm = $file =~ /\.[sS]$/;
+    next unless $file =~ /\.(?:h|c|inc|s|S)$/;
+    next if $is_asm && !$sources{$file};
+    my $output_file = $file;
+    $output_file =~ s/\.[sS]$/.asm/ if $is_asm;
+    next if $rules{$output_file};
+    my @generator = @{$unified_info{generate}->{$file}};
+    my $generator = shift @generator;
+    next unless $generator =~ /\.(?:in|pl)$/;
+
+    my @modules = ('-Mconfigdata');
+    my %includes = ('.' => 1);
+    my @depends = ('configdata.pm');
+    foreach my $dep (@{$unified_info{depends}->{$file} || []}) {
+      if ($dep =~ /^(.*?)\|(.*)\.pm$/) {
+        my ($dir, $module) = ($1, $2);
+        $includes{$dir} = 1;
+        push @depends, "$dir/$module.pm";
+        $module =~ s|/|::|g;
+        push @modules, "-M$module";
+      } else {
+        push @depends, $dep;
+        if ($dep =~ /\.pm$/) {
+          $includes{dirname($dep)} = 1;
+          push @modules, '-M' . basename($dep, '.pm');
+        }
+      }
+    }
+    my $perlflags = join(' ', (map { "-I$_" } sort keys %includes), @modules);
+    my $command = $is_asm
+        ? "\$(PERL) $generator @generator \"\$(PERLASM_SCHEME)\" \$(LIB_CFLAGS) \$(LIB_CPPFLAGS) \$(PROCESSOR) \$\@"
+        : $generator =~ /\.in$/
+        ? "\$(PERL) $perlflags util/dofile.pl -omakefile $generator @generator"
+        : "\$(PERL) $generator @generator";
+    $command .= ' > $@' unless $is_asm;
+    print $output "GENERATED_MANDATORY += $output_file\n" unless $is_asm;
+    print $output "GENERATED += $output_file\n";
+    print $output "$output_file: $generator @depends\n\t$command\n";
+  }
+  close $output;
+}
diff --git a/deps/openssl/config/generate_headers.pl b/deps/openssl/config/generate_headers.pl
index 55d63fb28e6..2b1263efea7 100755
--- a/deps/openssl/config/generate_headers.pl
+++ b/deps/openssl/config/generate_headers.pl
@@ -10,6 +10,7 @@ our $src_dir = "../openssl";
 my @openssl_headers = shift @ARGV;
 my @crypto_headers = shift @ARGV;
 my @internal_headers = shift @ARGV;
+my @common_headers = split / /, (shift @ARGV || '');

 my $include_tmpl = Text::Template->new(TYPE => 'FILE',
                                        SOURCE => 'include.h.tmpl',
@@ -28,15 +29,27 @@ gen_headers(@openssl_headers, 'openssl');
 gen_headers(@crypto_headers, 'crypto');
 gen_headers(@internal_headers, 'internal');

+foreach my $header (@common_headers) {
+  my ($inc_dir, $name) = $header =~ m|^include/([^/]+)/(.+)\.h$|;
+  my $wrapper_name = "${inc_dir}_${name}";
+  open my $include, '>', "$src_dir/$header" or die "Open $header failed: $!";
+  print $include $include_tmpl->fill_in(HASH => { name => $wrapper_name });
+  close $include;
+  open my $wrapper, '>', "./${wrapper_name}.h" or die "Open $wrapper_name failed: $!";
+  print $wrapper "#include \"common/$header\"\n";
+  close $wrapper;
+}
+
 sub gen_headers {
   my @headers = split / /, $_[0];
   my $inc_dir = $_[1];
   foreach my $header_name (@headers) {
+    my $wrapper_name = "${inc_dir}_${header_name}";
     print("Generating headers for: $header_name\n");

     # Populate and write header file that will be placed OpenSSL's include
     # directory.
-    my $include = $include_tmpl->fill_in(HASH => { name => $header_name });
+    my $include = $include_tmpl->fill_in(HASH => { name => $wrapper_name });
     open(INCLUDE, "> $src_dir/include/${inc_dir}/${header_name}.h");
     print INCLUDE "$include";
     close(INCLUDE);
@@ -45,15 +58,15 @@ sub gen_headers {
     # directory as this file) which will determine which include to use
     # depending on if asm is available or not.
     my $include_conf = $include_conf_tmpl->fill_in(
-       HASH => { name => $header_name });
-    open(INCLUDE_CONF, "> ./${header_name}.h");
+       HASH => { name => $wrapper_name });
+    open(INCLUDE_CONF, "> ./${wrapper_name}.h");
     print INCLUDE_CONF "$include_conf";
     close(INCLUDE_CONF);

     # Poplulate and write the asm header.
     my $include_asm = $include_asm_tmpl->fill_in(
       HASH => { asmdir => 'asm', incdir => $inc_dir, name => $header_name });
-    open(INCLUDE_ASM, "> ./${header_name}_asm.h");
+    open(INCLUDE_ASM, "> ./${wrapper_name}_asm.h");
     print INCLUDE_ASM "$include_asm";
     close(INCLUDE_ASM);

@@ -62,7 +75,7 @@ sub gen_headers {
       HASH => { asmdir => 'no-asm',
                 incdir => $inc_dir,
 		name => $header_name });
-    open(INCLUDE_NO_ASM, "> ./${header_name}_no-asm.h");
+    open(INCLUDE_NO_ASM, "> ./${wrapper_name}_no-asm.h");
     print INCLUDE_NO_ASM "$include_no_asm";
     close(INCLUDE_NO_ASM);
   }
diff --git a/deps/openssl/config/include_asm.h.tmpl b/deps/openssl/config/include_asm.h.tmpl
index df4dbe07a6a..2da0d0154bf 100644
--- a/deps/openssl/config/include_asm.h.tmpl
+++ b/deps/openssl/config/include_asm.h.tmpl
@@ -15,8 +15,6 @@
 # include "./archs/linux-aarch64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
 #elif defined(OPENSSL_LINUX) && defined(__riscv) && (__riscv_xlen == 64)
 # include "./archs/linux64-riscv64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
-#elif defined(__APPLE__) && defined(__MACH__) && defined(__i386__)
-# include "./archs/darwin-i386-cc/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
 #elif defined(__APPLE__) && defined(__MACH__) && defined(__x86_64__)
 # include "./archs/darwin64-x86_64-cc/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
 #elif defined(__APPLE__) && defined(__MACH__) && defined(__arm64__)
diff --git a/deps/openssl/config/include_no-asm.h.tmpl b/deps/openssl/config/include_no-asm.h.tmpl
index 1265943fecc..6f76bd1dda6 100644
--- a/deps/openssl/config/include_no-asm.h.tmpl
+++ b/deps/openssl/config/include_no-asm.h.tmpl
@@ -17,8 +17,6 @@
 # include "./archs/linux64-riscv64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
 #elif defined(OPENSSL_LINUX) && defined(__loongarch64)
 # include "./archs/linux64-loongarch64/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
-#elif defined(__APPLE__) && defined(__MACH__) && defined(__i386__)
-# include "./archs/darwin-i386-cc/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
 #elif defined(__APPLE__) && defined(__MACH__) && defined(__x86_64__)
 # include "./archs/darwin64-x86_64-cc/%%-$asmdir-%%/include/%%-$incdir-%%/%%-$name-%%.h"
 #elif defined(__APPLE__) && defined(__MACH__) && defined(__arm64__)
diff --git a/deps/openssl/config/openssl-cl.gypi.tmpl b/deps/openssl/config/openssl-cl.gypi.tmpl
index d82d4ebf780..bda87de8864 100644
--- a/deps/openssl/config/openssl-cl.gypi.tmpl
+++ b/deps/openssl/config/openssl-cl.gypi.tmpl
@@ -40,6 +40,7 @@ foreach $src (@libapps_srcs) {
   'defines': ['<@(openssl_defines_%%-$arch-%%)'],
   'include_dirs': [
     './include',
+    './apps/include',
   ],
 %%- if (!$is_win) {
   $OUT = "  'cflags' : ['<@(openssl_cflags_$arch)'],
diff --git a/deps/openssl/config/openssl-fips.gypi.tmpl b/deps/openssl/config/openssl-fips.gypi.tmpl
index b3c6530d0a6..f1ba14b923d 100644
--- a/deps/openssl/config/openssl-fips.gypi.tmpl
+++ b/deps/openssl/config/openssl-fips.gypi.tmpl
@@ -7,7 +7,8 @@
     ],
     'openssl_sources_%%-$arch-%%': [
 %%- foreach $src (@generated_srcs) {
-  $OUT .= "      './config/archs/$arch/$asm/$src',\n";
+  my $dir = $common_files{$src} ? 'common' : "archs/$arch/$asm";
+  $OUT .= "      './config/$dir/$src',\n";
 } -%%
     ],
     'openssl_defines_%%-$arch-%%': [
@@ -41,6 +42,9 @@
     './crypto',
     './crypto/include/internal',
     './providers/common/include',
+%%- foreach $dir (@generated_include_dirs) {
+  $OUT .= "    '$dir',\n";
+} -%%
   ],
   'defines': ['<@(openssl_defines_%%-$arch-%%)'],
 %%- if (!$is_win) {
diff --git a/deps/openssl/config/openssl.gypi.tmpl b/deps/openssl/config/openssl.gypi.tmpl
index cde6cf4a39e..377ed543ca9 100644
--- a/deps/openssl/config/openssl.gypi.tmpl
+++ b/deps/openssl/config/openssl.gypi.tmpl
@@ -9,7 +9,8 @@ foreach $src (@libcrypto_srcs) {
 } -%%    ],
     'openssl_sources_%%-$arch-%%': [
 %%- foreach $src (@generated_srcs) {
-  $OUT .= "      './config/archs/$arch/$asm/$src',\n";
+  my $dir = $common_files{$src} ? 'common' : "archs/$arch/$asm";
+  $OUT .= "      './config/$dir/$src',\n";
 } -%%    ],
     'openssl_defines_%%-$arch-%%': [
 %%- foreach $define (@{$config{defines}}) {
@@ -57,6 +58,9 @@ foreach $src (@libcrypto_srcs) {
     './crypto',
     './crypto/include/internal',
     './providers/common/include',
+%%- foreach $dir (@generated_include_dirs) {
+  $OUT .= "    '$dir',\n";
+} -%%
   ],
   'defines': ['<@(openssl_defines_%%-$arch-%%)'],
 %%- if (!$is_win) {
diff --git a/deps/openssl/openssl-cl_asm.gypi b/deps/openssl/openssl-cl_asm.gypi
index c08000ba6c4..c3ac3230f6a 100644
--- a/deps/openssl/openssl-cl_asm.gypi
+++ b/deps/openssl/openssl-cl_asm.gypi
@@ -14,8 +14,6 @@
       'includes': ['config/archs/BSD-x86/asm/openssl-cl.gypi'],
     }, 'target_arch=="ia32" and OS=="linux"', {
       'includes': ['config/archs/linux-elf/asm/openssl-cl.gypi'],
-    }, 'target_arch=="ia32" and OS=="mac"', {
-      'includes': ['config/archs/darwin-i386-cc/asm/openssl-cl.gypi'],
     }, 'target_arch=="ia32" and OS=="solaris"', {
       'includes': ['config/archs/solaris-x86-gcc/asm/openssl-cl.gypi'],
     }, 'target_arch=="ia32" and OS=="win"', {
diff --git a/deps/openssl/openssl-cl_asm_avx2.gypi b/deps/openssl/openssl-cl_asm_avx2.gypi
index 229e856e14d..dab98974459 100644
--- a/deps/openssl/openssl-cl_asm_avx2.gypi
+++ b/deps/openssl/openssl-cl_asm_avx2.gypi
@@ -14,8 +14,6 @@
       'includes': ['config/archs/BSD-x86/asm_avx2/openssl-cl.gypi'],
     }, 'target_arch=="ia32" and OS=="linux"', {
       'includes': ['config/archs/linux-elf/asm_avx2/openssl-cl.gypi'],
-    }, 'target_arch=="ia32" and OS=="mac"', {
-      'includes': ['config/archs/darwin-i386-cc/asm_avx2/openssl-cl.gypi'],
     }, 'target_arch=="ia32" and OS=="solaris"', {
       'includes': ['config/archs/solaris-x86-gcc/asm_avx2/openssl-cl.gypi'],
     }, 'target_arch=="ia32" and OS=="win"', {
diff --git a/deps/openssl/openssl-cl_no_asm.gypi b/deps/openssl/openssl-cl_no_asm.gypi
index c838da5cf9e..fe9530a8295 100644
--- a/deps/openssl/openssl-cl_no_asm.gypi
+++ b/deps/openssl/openssl-cl_no_asm.gypi
@@ -16,8 +16,6 @@
       'includes': ['config/archs/BSD-x86/no-asm/openssl-cl.gypi'],
     }, 'target_arch=="ia32" and OS=="linux"', {
       'includes': ['config/archs/linux-elf/no-asm/openssl-cl.gypi'],
-    }, 'target_arch=="ia32" and OS=="mac"', {
-      'includes': ['config/archs/darwin-i386-cc/no-asm/openssl-cl.gypi'],
     }, 'target_arch=="ia32" and OS=="solaris"', {
       'includes': ['config/archs/solaris-x86-gcc/no-asm/openssl-cl.gypi'],
     }, 'target_arch=="ia32" and OS=="win"', {
diff --git a/deps/openssl/openssl-fips_asm.gypi b/deps/openssl/openssl-fips_asm.gypi
index ed8a39771f6..3d5c2d78a6f 100644
--- a/deps/openssl/openssl-fips_asm.gypi
+++ b/deps/openssl/openssl-fips_asm.gypi
@@ -16,8 +16,6 @@
       'includes': ['config/archs/BSD-x86/asm/openssl-fips.gypi'],
     }, 'target_arch=="ia32" and OS=="linux"', {
       'includes': ['config/archs/linux-elf/asm/openssl-fips.gypi'],
-    }, 'target_arch=="ia32" and OS=="mac"', {
-      'includes': ['config/archs/darwin-i386-cc/asm/openssl-fips.gypi'],
     }, 'target_arch=="ia32" and OS=="solaris"', {
       'includes': ['config/archs/solaris-x86-gcc/asm/openssl-fips.gypi'],
     }, 'target_arch=="ia32" and OS=="win"', {
diff --git a/deps/openssl/openssl-fips_asm_avx2.gypi b/deps/openssl/openssl-fips_asm_avx2.gypi
index 2dd35807a5b..89f3b17e732 100644
--- a/deps/openssl/openssl-fips_asm_avx2.gypi
+++ b/deps/openssl/openssl-fips_asm_avx2.gypi
@@ -14,8 +14,6 @@
       'includes': ['config/archs/BSD-x86/asm_avx2/openssl-fips.gypi'],
     }, 'target_arch=="ia32" and OS=="linux"', {
       'includes': ['config/archs/linux-elf/asm_avx2/openssl-fips.gypi'],
-    }, 'target_arch=="ia32" and OS=="mac"', {
-      'includes': ['config/archs/darwin-i386-cc/asm_avx2/openssl-fips.gypi'],
     }, 'target_arch=="ia32" and OS=="solaris"', {
       'includes': ['config/archs/solaris-x86-gcc/asm_avx2/openssl-fips.gypi'],
     }, 'target_arch=="ia32" and OS=="win"', {
diff --git a/deps/openssl/openssl-fips_no_asm.gypi b/deps/openssl/openssl-fips_no_asm.gypi
index ab8074cf439..247689549db 100644
--- a/deps/openssl/openssl-fips_no_asm.gypi
+++ b/deps/openssl/openssl-fips_no_asm.gypi
@@ -15,8 +15,6 @@
       'includes': ['config/archs/BSD-x86/no-asm/openssl-fips.gypi'],
     }, 'target_arch=="ia32" and OS=="linux"', {
       'includes': ['config/archs/linux-elf/no-asm/openssl-fips.gypi'],
-    }, 'target_arch=="ia32" and OS=="mac"', {
-      'includes': ['config/archs/darwin-i386-cc/no-asm/openssl-fips.gypi'],
     }, 'target_arch=="ia32" and OS=="solaris"', {
       'includes': ['config/archs/solaris-x86-gcc/no-asm/openssl-fips.gypi'],
     }, 'target_arch=="ia32" and OS=="win"', {
diff --git a/deps/openssl/openssl_asm.gypi b/deps/openssl/openssl_asm.gypi
index 6ad60656807..e7b7000cc9d 100644
--- a/deps/openssl/openssl_asm.gypi
+++ b/deps/openssl/openssl_asm.gypi
@@ -16,8 +16,6 @@
       'includes': ['config/archs/BSD-x86/asm/openssl.gypi'],
     }, 'target_arch=="ia32" and OS=="linux"', {
       'includes': ['config/archs/linux-elf/asm/openssl.gypi'],
-    }, 'target_arch=="ia32" and OS=="mac"', {
-      'includes': ['config/archs/darwin-i386-cc/asm/openssl.gypi'],
     }, 'target_arch=="ia32" and OS=="solaris"', {
       'includes': ['config/archs/solaris-x86-gcc/asm/openssl.gypi'],
     }, 'target_arch=="ia32" and OS=="win"', {
diff --git a/deps/openssl/openssl_asm_avx2.gypi b/deps/openssl/openssl_asm_avx2.gypi
index 52c89bb1134..29927b104d2 100644
--- a/deps/openssl/openssl_asm_avx2.gypi
+++ b/deps/openssl/openssl_asm_avx2.gypi
@@ -14,8 +14,6 @@
       'includes': ['config/archs/BSD-x86/asm_avx2/openssl.gypi'],
     }, 'target_arch=="ia32" and OS=="linux"', {
       'includes': ['config/archs/linux-elf/asm_avx2/openssl.gypi'],
-    }, 'target_arch=="ia32" and OS=="mac"', {
-      'includes': ['config/archs/darwin-i386-cc/asm_avx2/openssl.gypi'],
     }, 'target_arch=="ia32" and OS=="solaris"', {
       'includes': ['config/archs/solaris-x86-gcc/asm_avx2/openssl.gypi'],
     }, 'target_arch=="ia32" and OS=="win"', {
diff --git a/deps/openssl/openssl_no_asm.gypi b/deps/openssl/openssl_no_asm.gypi
index 8169f605d7d..78a29e28e97 100644
--- a/deps/openssl/openssl_no_asm.gypi
+++ b/deps/openssl/openssl_no_asm.gypi
@@ -15,8 +15,6 @@
       'includes': ['config/archs/BSD-x86/no-asm/openssl.gypi'],
     }, 'target_arch=="ia32" and OS=="linux"', {
       'includes': ['config/archs/linux-elf/no-asm/openssl.gypi'],
-    }, 'target_arch=="ia32" and OS=="mac"', {
-      'includes': ['config/archs/darwin-i386-cc/no-asm/openssl.gypi'],
     }, 'target_arch=="ia32" and OS=="solaris"', {
       'includes': ['config/archs/solaris-x86-gcc/no-asm/openssl.gypi'],
     }, 'target_arch=="ia32" and OS=="win"', {
diff --git a/doc/contributing/maintaining/maintaining-openssl.md b/doc/contributing/maintaining/maintaining-openssl.md
index 92525c4c65b..f109d10e68b 100644
--- a/doc/contributing/maintaining/maintaining-openssl.md
+++ b/doc/contributing/maintaining/maintaining-openssl.md
@@ -74,7 +74,8 @@ cherry-picked to older release lines that still provide binaries on 32-bit Windo
 ```

 Use `make` to regenerate all platform dependent files in
-`deps/openssl/config/archs/`:
+`deps/openssl/config/archs/` and shared generated files in
+`deps/openssl/config/common/`:

 ```bash
 # On non-Linux machines
@@ -98,9 +99,9 @@ git diff -- deps/openssl
 _Note_: On Windows, OpenSSL Configure generates a `makefile` that can be
 used for the `nmake` command. The `make` command in step 2 (above) uses
 `Makefile_VC-WIN64A`, `Makefile_VC-WIN32`, and `Makefile_VC-WIN64-ARM`,
-which are manually created. When source files or build options are updated in
-Windows, these Makefiles need to be changed by hand. If you are not sure,
-please ask @shigeki for details.
+which are manually created. The generator adds rules for headers, C files,
+assembly, and includes from OpenSSL's build metadata. Review these Makefiles
+when source files or build options change.

 ## 4. Commit and test

@@ -108,7 +109,7 @@ Update all architecture dependent files. Do not forget to git add or remove
 files if they are changed before committing:

 ```bash
-git add -A deps/openssl/config/archs
+git add -A deps/openssl/config
 git add -A deps/openssl/openssl
 git commit
 ```
@@ -122,7 +123,7 @@ deps: update archs files for openssl-<version>
 After an OpenSSL source update, all the config files need to be
 regenerated and committed by:
     $ make -C deps/openssl/config
-    $ git add -A deps/openssl/config/archs
+    $ git add -A deps/openssl/config
     $ git add -A deps/openssl/openssl
     $ git commit
 ```
diff --git a/tools/dep_updaters/update-openssl.sh b/tools/dep_updaters/update-openssl.sh
index 29d72e8700e..d076365490f 100755
--- a/tools/dep_updaters/update-openssl.sh
+++ b/tools/dep_updaters/update-openssl.sh
@@ -11,9 +11,20 @@ cleanup() {

 download() {
   LATEST_TAG_NAME="$("$NODE" --input-type=module <<'EOF'
-const res = await fetch('https://api.github.com/repos/openssl/openssl/git/matching-refs/tags/openssl-3.5');
+const res = await fetch('https://api.github.com/repos/openssl/openssl/git/matching-refs/tags/openssl-4.1.');
 if (!res.ok) throw new Error(`FetchError: ${res.status} ${res.statusText}`, { cause: res });
-const releases = await res.json()
+const includePrereleases = process.env.INCLUDE_PRERELEASES === 'true';
+const releases = (await res.json())
+  .filter(({ ref }) => includePrereleases || /^refs\/tags\/openssl-\d+\.\d+\.\d+$/.test(ref))
+  .sort(({ ref: a }, { ref: b }) => {
+    const [, aVersion, aPrerelease] = a.split('-');
+    const [, bVersion, bPrerelease] = b.split('-');
+    const versionOrder = aVersion.localeCompare(bVersion, 'en', { numeric: true });
+    if (versionOrder) return versionOrder;
+    if (!aPrerelease) return bPrerelease ? 1 : 0;
+    if (!bPrerelease) return -1;
+    return aPrerelease.localeCompare(bPrerelease, 'en', { numeric: true });
+  });
 const latest = releases.at(-1);
 if(!latest) throw new Error(`Could not find latest release`);
 console.log(latest.ref.replace('refs/tags/',''));
@@ -80,7 +91,7 @@ regenerate() {
   echo ""
   echo "Please commit the regenerated files:"
   echo ""
-  echo "$ git add -A deps/openssl/config/archs deps/openssl/openssl"
+  echo "$ git add -A deps/openssl/config deps/openssl/openssl"
   echo "$ git commit -m \"deps: update archs files for openssl\""
   echo ""
 }
diff --git a/tools/install.py b/tools/install.py
index 573d7423c9d..588f7c04eb0 100755
--- a/tools/install.py
+++ b/tools/install.py
@@ -361,6 +361,12 @@ def headers(options, action):
     subdir_files(options, 'deps/openssl/openssl/include/openssl', 'include/node/openssl/', action)
     subdir_files(options, 'deps/openssl/config/archs', 'include/node/openssl/archs', action)
     subdir_files(options, 'deps/openssl/config', 'include/node/openssl', action)
+    # Public selectors replace source-tree wrappers in the installed headers.
+    for name in os.listdir(os.path.join(options.root_dir, 'deps/openssl/config')):
+      if name.startswith('openssl_') and name.endswith('.h') and \
+         not name.endswith(('_asm.h', '_no-asm.h')):
+        action(options, [os.path.join('deps/openssl/config', name)],
+               'include/node/openssl/' + name[len('openssl_'):])

   if 'false' == options.variables.get('node_shared_zlib'):
     action(options, [