15 files changed, 336 insertions, 239 deletions

diff --git a/src/lib/libcrypto/pkcs12/Makefile.ssl b/src/lib/libcrypto/pkcs12/Makefile.ssl
index 5716f608b6..67869f204f 100644
--- a/src/lib/libcrypto/pkcs12/Makefile.ssl
+++ b/src/lib/libcrypto/pkcs12/Makefile.ssl
@@ -91,15 +91,17 @@ p12_add.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 p12_add.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_add.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_add.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_add.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_add.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+p12_add.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 p12_add.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-p12_add.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-p12_add.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
-p12_add.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
-p12_add.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
-p12_add.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
-p12_add.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_add.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+p12_add.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+p12_add.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+p12_add.o: ../../include/openssl/pkcs12.h ../../include/openssl/pkcs7.h
+p12_add.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+p12_add.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+p12_add.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+p12_add.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+p12_add.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
 p12_add.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 p12_attr.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p12_attr.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
@@ -108,16 +110,19 @@ p12_attr.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 p12_attr.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_attr.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_attr.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_attr.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_attr.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+p12_attr.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 p12_attr.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-p12_attr.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_attr.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+p12_attr.o: ../../include/openssl/opensslconf.h
 p12_attr.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
 p12_attr.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
 p12_attr.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 p12_attr.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p12_attr.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_attr.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-p12_attr.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+p12_attr.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+p12_attr.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+p12_attr.o: ../cryptlib.h
 p12_bags.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 p12_bags.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 p12_bags.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
@@ -126,16 +131,18 @@ p12_bags.o: ../../include/openssl/des.h ../../include/openssl/dh.h
 p12_bags.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
 p12_bags.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 p12_bags.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
-p12_bags.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
-p12_bags.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
-p12_bags.o: ../../include/openssl/opensslconf.h
+p12_bags.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+p12_bags.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+p12_bags.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+p12_bags.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 p12_bags.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
 p12_bags.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
 p12_bags.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 p12_bags.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p12_bags.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_bags.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-p12_bags.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+p12_bags.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+p12_bags.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+p12_bags.o: ../cryptlib.h
 p12_crpt.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p12_crpt.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 p12_crpt.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -143,16 +150,19 @@ p12_crpt.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 p12_crpt.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_crpt.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_crpt.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_crpt.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_crpt.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+p12_crpt.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 p12_crpt.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-p12_crpt.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_crpt.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+p12_crpt.o: ../../include/openssl/opensslconf.h
 p12_crpt.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
 p12_crpt.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
 p12_crpt.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 p12_crpt.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p12_crpt.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_crpt.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-p12_crpt.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+p12_crpt.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+p12_crpt.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+p12_crpt.o: ../cryptlib.h
 p12_crt.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p12_crt.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 p12_crt.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -160,15 +170,17 @@ p12_crt.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 p12_crt.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_crt.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_crt.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_crt.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_crt.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+p12_crt.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 p12_crt.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-p12_crt.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-p12_crt.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
-p12_crt.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
-p12_crt.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
-p12_crt.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
-p12_crt.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_crt.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+p12_crt.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+p12_crt.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+p12_crt.o: ../../include/openssl/pkcs12.h ../../include/openssl/pkcs7.h
+p12_crt.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+p12_crt.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+p12_crt.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+p12_crt.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+p12_crt.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
 p12_crt.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 p12_decr.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p12_decr.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
@@ -177,16 +189,19 @@ p12_decr.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 p12_decr.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_decr.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_decr.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_decr.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_decr.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+p12_decr.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 p12_decr.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-p12_decr.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_decr.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+p12_decr.o: ../../include/openssl/opensslconf.h
 p12_decr.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
 p12_decr.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
 p12_decr.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 p12_decr.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p12_decr.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_decr.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-p12_decr.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+p12_decr.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+p12_decr.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+p12_decr.o: ../cryptlib.h
 p12_init.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p12_init.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 p12_init.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -194,16 +209,19 @@ p12_init.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 p12_init.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_init.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_init.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_init.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_init.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+p12_init.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 p12_init.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-p12_init.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_init.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+p12_init.o: ../../include/openssl/opensslconf.h
 p12_init.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
 p12_init.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
 p12_init.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 p12_init.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p12_init.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_init.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-p12_init.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+p12_init.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+p12_init.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+p12_init.o: ../cryptlib.h
 p12_key.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p12_key.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 p12_key.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -211,15 +229,17 @@ p12_key.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 p12_key.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_key.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_key.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_key.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_key.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+p12_key.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 p12_key.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-p12_key.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-p12_key.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
-p12_key.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
-p12_key.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
-p12_key.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
-p12_key.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_key.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+p12_key.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+p12_key.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+p12_key.o: ../../include/openssl/pkcs12.h ../../include/openssl/pkcs7.h
+p12_key.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+p12_key.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+p12_key.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+p12_key.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+p12_key.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
 p12_key.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 p12_kiss.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p12_kiss.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
@@ -228,16 +248,19 @@ p12_kiss.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 p12_kiss.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_kiss.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_kiss.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_kiss.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_kiss.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+p12_kiss.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 p12_kiss.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-p12_kiss.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_kiss.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+p12_kiss.o: ../../include/openssl/opensslconf.h
 p12_kiss.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
 p12_kiss.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
 p12_kiss.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 p12_kiss.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p12_kiss.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_kiss.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-p12_kiss.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+p12_kiss.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+p12_kiss.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+p12_kiss.o: ../cryptlib.h
 p12_lib.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 p12_lib.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 p12_lib.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
@@ -246,14 +269,16 @@ p12_lib.o: ../../include/openssl/des.h ../../include/openssl/dh.h
 p12_lib.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
 p12_lib.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 p12_lib.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
-p12_lib.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
-p12_lib.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
-p12_lib.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-p12_lib.o: ../../include/openssl/pkcs12.h ../../include/openssl/pkcs7.h
-p12_lib.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
-p12_lib.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
-p12_lib.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-p12_lib.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+p12_lib.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+p12_lib.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+p12_lib.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+p12_lib.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_lib.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
+p12_lib.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+p12_lib.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+p12_lib.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+p12_lib.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+p12_lib.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 p12_lib.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 p12_lib.o: ../cryptlib.h
 p12_mac.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
@@ -264,14 +289,16 @@ p12_mac.o: ../../include/openssl/des.h ../../include/openssl/dh.h
 p12_mac.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
 p12_mac.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 p12_mac.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
-p12_mac.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
-p12_mac.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
-p12_mac.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
-p12_mac.o: ../../include/openssl/pkcs12.h ../../include/openssl/pkcs7.h
-p12_mac.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
-p12_mac.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
-p12_mac.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
-p12_mac.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+p12_mac.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+p12_mac.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+p12_mac.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+p12_mac.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
+p12_mac.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
+p12_mac.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
+p12_mac.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
+p12_mac.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
+p12_mac.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
+p12_mac.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
 p12_mac.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 p12_mac.o: ../cryptlib.h
 p12_mutl.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
@@ -282,25 +309,28 @@ p12_mutl.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_mutl.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_mutl.o: ../../include/openssl/err.h ../../include/openssl/evp.h
 p12_mutl.o: ../../include/openssl/hmac.h ../../include/openssl/idea.h
-p12_mutl.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
-p12_mutl.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
-p12_mutl.o: ../../include/openssl/opensslconf.h
+p12_mutl.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+p12_mutl.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+p12_mutl.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+p12_mutl.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 p12_mutl.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
 p12_mutl.o: ../../include/openssl/pkcs7.h ../../include/openssl/rand.h
 p12_mutl.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
 p12_mutl.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
 p12_mutl.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
 p12_mutl.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
-p12_mutl.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
-p12_mutl.o: ../cryptlib.h
+p12_mutl.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
+p12_mutl.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 p12_npas.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p12_npas.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
-p12_npas.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
-p12_npas.o: ../../include/openssl/des.h ../../include/openssl/dh.h
-p12_npas.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
-p12_npas.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_npas.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
-p12_npas.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+p12_npas.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+p12_npas.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+p12_npas.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+p12_npas.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+p12_npas.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+p12_npas.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+p12_npas.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+p12_npas.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
 p12_npas.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 p12_npas.o: ../../include/openssl/opensslv.h ../../include/openssl/pem.h
 p12_npas.o: ../../include/openssl/pem2.h ../../include/openssl/pkcs12.h
@@ -308,8 +338,8 @@ p12_npas.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
 p12_npas.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 p12_npas.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p12_npas.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_npas.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-p12_npas.o: ../../include/openssl/x509_vfy.h
+p12_npas.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+p12_npas.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
 p12_sbag.o: ../../include/openssl/asn1.h ../../include/openssl/asn1_mac.h
 p12_sbag.o: ../../include/openssl/bio.h ../../include/openssl/blowfish.h
 p12_sbag.o: ../../include/openssl/bn.h ../../include/openssl/buffer.h
@@ -318,16 +348,18 @@ p12_sbag.o: ../../include/openssl/des.h ../../include/openssl/dh.h
 p12_sbag.o: ../../include/openssl/dsa.h ../../include/openssl/e_os.h
 p12_sbag.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
 p12_sbag.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
-p12_sbag.o: ../../include/openssl/md2.h ../../include/openssl/md5.h
-p12_sbag.o: ../../include/openssl/mdc2.h ../../include/openssl/objects.h
-p12_sbag.o: ../../include/openssl/opensslconf.h
+p12_sbag.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+p12_sbag.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+p12_sbag.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
+p12_sbag.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 p12_sbag.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
 p12_sbag.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
 p12_sbag.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 p12_sbag.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 p12_sbag.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_sbag.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-p12_sbag.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
+p12_sbag.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+p12_sbag.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
+p12_sbag.o: ../cryptlib.h
 p12_utl.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 p12_utl.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
 p12_utl.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
@@ -335,29 +367,33 @@ p12_utl.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
 p12_utl.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
 p12_utl.o: ../../include/openssl/e_os.h ../../include/openssl/e_os2.h
 p12_utl.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-p12_utl.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
+p12_utl.o: ../../include/openssl/idea.h ../../include/openssl/lhash.h
+p12_utl.o: ../../include/openssl/md2.h ../../include/openssl/md4.h
 p12_utl.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
-p12_utl.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
-p12_utl.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
-p12_utl.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
-p12_utl.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
-p12_utl.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
-p12_utl.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-p12_utl.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
+p12_utl.o: ../../include/openssl/obj_mac.h ../../include/openssl/objects.h
+p12_utl.o: ../../include/openssl/opensslconf.h ../../include/openssl/opensslv.h
+p12_utl.o: ../../include/openssl/pkcs12.h ../../include/openssl/pkcs7.h
+p12_utl.o: ../../include/openssl/rc2.h ../../include/openssl/rc4.h
+p12_utl.o: ../../include/openssl/rc5.h ../../include/openssl/ripemd.h
+p12_utl.o: ../../include/openssl/rsa.h ../../include/openssl/safestack.h
+p12_utl.o: ../../include/openssl/sha.h ../../include/openssl/stack.h
+p12_utl.o: ../../include/openssl/symhacks.h ../../include/openssl/x509.h
 p12_utl.o: ../../include/openssl/x509_vfy.h ../cryptlib.h
 pk12err.o: ../../include/openssl/asn1.h ../../include/openssl/bio.h
 pk12err.o: ../../include/openssl/blowfish.h ../../include/openssl/bn.h
-pk12err.o: ../../include/openssl/cast.h ../../include/openssl/crypto.h
-pk12err.o: ../../include/openssl/des.h ../../include/openssl/dh.h
-pk12err.o: ../../include/openssl/dsa.h ../../include/openssl/e_os2.h
-pk12err.o: ../../include/openssl/err.h ../../include/openssl/evp.h
-pk12err.o: ../../include/openssl/idea.h ../../include/openssl/md2.h
-pk12err.o: ../../include/openssl/md5.h ../../include/openssl/mdc2.h
+pk12err.o: ../../include/openssl/buffer.h ../../include/openssl/cast.h
+pk12err.o: ../../include/openssl/crypto.h ../../include/openssl/des.h
+pk12err.o: ../../include/openssl/dh.h ../../include/openssl/dsa.h
+pk12err.o: ../../include/openssl/e_os2.h ../../include/openssl/err.h
+pk12err.o: ../../include/openssl/evp.h ../../include/openssl/idea.h
+pk12err.o: ../../include/openssl/lhash.h ../../include/openssl/md2.h
+pk12err.o: ../../include/openssl/md4.h ../../include/openssl/md5.h
+pk12err.o: ../../include/openssl/mdc2.h ../../include/openssl/obj_mac.h
 pk12err.o: ../../include/openssl/objects.h ../../include/openssl/opensslconf.h
 pk12err.o: ../../include/openssl/opensslv.h ../../include/openssl/pkcs12.h
 pk12err.o: ../../include/openssl/pkcs7.h ../../include/openssl/rc2.h
 pk12err.o: ../../include/openssl/rc4.h ../../include/openssl/rc5.h
 pk12err.o: ../../include/openssl/ripemd.h ../../include/openssl/rsa.h
 pk12err.o: ../../include/openssl/safestack.h ../../include/openssl/sha.h
-pk12err.o: ../../include/openssl/stack.h ../../include/openssl/x509.h
-pk12err.o: ../../include/openssl/x509_vfy.h
+pk12err.o: ../../include/openssl/stack.h ../../include/openssl/symhacks.h
+pk12err.o: ../../include/openssl/x509.h ../../include/openssl/x509_vfy.h
diff --git a/src/lib/libcrypto/pkcs12/p12_add.c b/src/lib/libcrypto/pkcs12/p12_add.c
index d045cbba8d..b563656895 100644
--- a/src/lib/libcrypto/pkcs12/p12_add.c
+++ b/src/lib/libcrypto/pkcs12/p12_add.c
@@ -125,7 +125,7 @@ PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG (int pbe_nid, const char *pass,
 }
 
 /* Turn a stack of SAFEBAGS into a PKCS#7 data Contentinfo */
-PKCS7 *PKCS12_pack_p7data (STACK *sk)
+PKCS7 *PKCS12_pack_p7data (STACK_OF(PKCS12_SAFEBAG) *sk)
 {
         PKCS7 *p7;
         if (!(p7 = PKCS7_new())) {
@@ -138,8 +138,9 @@ PKCS7 *PKCS12_pack_p7data (STACK *sk)
                 return NULL;
         }
         
-        if (!ASN1_seq_pack(sk, i2d_PKCS12_SAFEBAG, &p7->d.data->data,
-                                        &p7->d.data->length)) {
+        if (!ASN1_seq_pack_PKCS12_SAFEBAG(sk, i2d_PKCS12_SAFEBAG,
+                                          &p7->d.data->data,
+                                          &p7->d.data->length)) {
                 PKCS12err(PKCS12_F_PKCS12_PACK_P7DATA, PKCS12_R_CANT_PACK_STRUCTURE);
                 return NULL;
         }
@@ -149,7 +150,8 @@ PKCS7 *PKCS12_pack_p7data (STACK *sk)
 /* Turn a stack of SAFEBAGS into a PKCS#7 encrypted data ContentInfo */
 
 PKCS7 *PKCS12_pack_p7encdata (int pbe_nid, const char *pass, int passlen,
-             unsigned char *salt, int saltlen, int iter, STACK *bags)
+                              unsigned char *salt, int saltlen, int iter,
+                              STACK_OF(PKCS12_SAFEBAG) *bags)
 {
         PKCS7 *p7;
         X509_ALGOR *pbe;
diff --git a/src/lib/libcrypto/pkcs12/p12_attr.c b/src/lib/libcrypto/pkcs12/p12_attr.c
index f559351d18..f1a210b5d2 100644
--- a/src/lib/libcrypto/pkcs12/p12_attr.c
+++ b/src/lib/libcrypto/pkcs12/p12_attr.c
@@ -87,13 +87,13 @@ int PKCS12_add_localkeyid (PKCS12_SAFEBAG *bag, unsigned char *name,
                 return 0;
         }
         attrib->object = OBJ_nid2obj(NID_localKeyID);
-        if (!(attrib->value.set = sk_ASN1_TYPE_new(NULL))) {
+        if (!(attrib->value.set = sk_ASN1_TYPE_new_null())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
         sk_ASN1_TYPE_push (attrib->value.set,keyid);
         attrib->set = 1;
-        if (!bag->attrib && !(bag->attrib = sk_X509_ATTRIBUTE_new (NULL))) {
+        if (!bag->attrib && !(bag->attrib = sk_X509_ATTRIBUTE_new_null ())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_LOCALKEYID, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
@@ -129,14 +129,14 @@ int PKCS8_add_keyusage (PKCS8_PRIV_KEY_INFO *p8, int usage)
                 return 0;
         }
         attrib->object = OBJ_nid2obj(NID_key_usage);
-        if (!(attrib->value.set = sk_ASN1_TYPE_new(NULL))) {
+        if (!(attrib->value.set = sk_ASN1_TYPE_new_null())) {
                 PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
         sk_ASN1_TYPE_push (attrib->value.set,keyid);
         attrib->set = 1;
         if (!p8->attributes
-            && !(p8->attributes = sk_X509_ATTRIBUTE_new (NULL))) {
+            && !(p8->attributes = sk_X509_ATTRIBUTE_new_null ())) {
                 PKCS12err(PKCS12_F_PKCS8_ADD_KEYUSAGE, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
@@ -157,7 +157,7 @@ int PKCS12_add_friendlyname_asc (PKCS12_SAFEBAG *bag, const char *name,
                 return 0;
         }
         ret = PKCS12_add_friendlyname_uni (bag, uniname, unilen);
-        Free(uniname);
+        OPENSSL_free(uniname);
         return ret;
 }
         
@@ -181,7 +181,7 @@ int PKCS12_add_friendlyname_uni (PKCS12_SAFEBAG *bag,
                                                         ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        if (!(bmp->data = Malloc (namelen))) {
+        if (!(bmp->data = OPENSSL_malloc (namelen))) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI,
                                                         ERR_R_MALLOC_FAILURE);
                 return 0;
@@ -195,14 +195,14 @@ int PKCS12_add_friendlyname_uni (PKCS12_SAFEBAG *bag,
                 return 0;
         }
         attrib->object = OBJ_nid2obj(NID_friendlyName);
-        if (!(attrib->value.set = sk_ASN1_TYPE_new(NULL))) {
+        if (!(attrib->value.set = sk_ASN1_TYPE_new_null())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_FRIENDLYNAME,
                                                         ERR_R_MALLOC_FAILURE);
                 return 0;
         }
         sk_ASN1_TYPE_push (attrib->value.set,fname);
         attrib->set = 1;
-        if (!bag->attrib && !(bag->attrib = sk_X509_ATTRIBUTE_new (NULL))) {
+        if (!bag->attrib && !(bag->attrib = sk_X509_ATTRIBUTE_new_null ())) {
                 PKCS12err(PKCS12_F_PKCS12_ADD_FRIENDLYNAME_UNI,
                                                         ERR_R_MALLOC_FAILURE);
                 return 0;
diff --git a/src/lib/libcrypto/pkcs12/p12_bags.c b/src/lib/libcrypto/pkcs12/p12_bags.c
index c358b06735..56547ef933 100644
--- a/src/lib/libcrypto/pkcs12/p12_bags.c
+++ b/src/lib/libcrypto/pkcs12/p12_bags.c
@@ -188,5 +188,5 @@ void PKCS12_BAGS_free (PKCS12_BAGS *a)
         }
 
         ASN1_OBJECT_free (a->type);
-        Free (a);
+        OPENSSL_free (a);
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_crt.c b/src/lib/libcrypto/pkcs12/p12_crt.c
index ee8aed54c7..a8f7b48882 100644
--- a/src/lib/libcrypto/pkcs12/p12_crt.c
+++ b/src/lib/libcrypto/pkcs12/p12_crt.c
@@ -65,7 +65,8 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
              int keytype)
 {
         PKCS12 *p12;
-        STACK *bags, *safes;
+        STACK_OF(PKCS12_SAFEBAG) *bags;
+        STACK_OF(PKCS7) *safes;
         PKCS12_SAFEBAG *bag;
         PKCS8_PRIV_KEY_INFO *p8;
         PKCS7 *authsafe;
@@ -85,7 +86,9 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
                 return NULL;
         }
 
-        if(!(bags = sk_new (NULL))) {
+        if(!X509_check_private_key(cert, pkey)) return NULL;
+
+        if(!(bags = sk_PKCS12_SAFEBAG_new_null ())) {
                 PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -96,7 +99,7 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
         X509_digest(cert, EVP_sha1(), keyid, &keyidlen);
         if(!PKCS12_add_localkeyid(bag, keyid, keyidlen)) return NULL;
 
-        if(!sk_push(bags, (char *)bag)) {
+        if(!sk_PKCS12_SAFEBAG_push(bags, bag)) {
                 PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -106,7 +109,7 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
                 for(i = 0; i < sk_X509_num(ca); i++) {
                         tcert = sk_X509_value(ca, i);
                         if(!(bag = M_PKCS12_x5092certbag(tcert))) return NULL;
-                        if(!sk_push(bags, (char *)bag)) {
+                        if(!sk_PKCS12_SAFEBAG_push(bags, bag)) {
                                 PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
                                 return NULL;
                         }
@@ -116,11 +119,12 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
         /* Turn certbags into encrypted authsafe */
         authsafe = PKCS12_pack_p7encdata (nid_cert, pass, -1, NULL, 0,
                                           iter, bags);
-        sk_pop_free(bags, PKCS12_SAFEBAG_free);
+        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
 
         if (!authsafe) return NULL;
 
-        if(!(safes = sk_new (NULL)) || !sk_push(safes, (char *)authsafe)) {
+        if(!(safes = sk_PKCS7_new_null ())
+           || !sk_PKCS7_push(safes, authsafe)) {
                 PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -133,14 +137,15 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
         PKCS8_PRIV_KEY_INFO_free(p8);
         if (name && !PKCS12_add_friendlyname (bag, name, -1)) return NULL;
         if(!PKCS12_add_localkeyid (bag, keyid, keyidlen)) return NULL;
-        if(!(bags = sk_new(NULL)) || !sk_push (bags, (char *)bag)) {
+        if(!(bags = sk_PKCS12_SAFEBAG_new_null())
+           || !sk_PKCS12_SAFEBAG_push (bags, bag)) {
                 PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
         /* Turn it into unencrypted safe bag */
         if(!(authsafe = PKCS12_pack_p7data (bags))) return NULL;
-        sk_pop_free(bags, PKCS12_SAFEBAG_free);
-        if(!sk_push(safes, (char *)authsafe)) {
+        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+        if(!sk_PKCS7_push(safes, authsafe)) {
                 PKCS12err(PKCS12_F_PKCS12_CREATE,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -149,7 +154,7 @@ PKCS12 *PKCS12_create(char *pass, char *name, EVP_PKEY *pkey, X509 *cert,
 
         if(!M_PKCS12_pack_authsafes (p12, safes)) return NULL;
 
-        sk_pop_free(safes, PKCS7_free);
+        sk_PKCS7_pop_free(safes, PKCS7_free);
 
         if(!PKCS12_set_mac (p12, pass, -1, NULL, 0, mac_iter, NULL))
             return NULL;
diff --git a/src/lib/libcrypto/pkcs12/p12_decr.c b/src/lib/libcrypto/pkcs12/p12_decr.c
index 4be44eac50..8cd7e2f414 100644
--- a/src/lib/libcrypto/pkcs12/p12_decr.c
+++ b/src/lib/libcrypto/pkcs12/p12_decr.c
@@ -65,7 +65,7 @@
 
 
 /* Encrypt/Decrypt a buffer based on password and algor, result in a
- * Malloc'ed buffer
+ * OPENSSL_malloc'ed buffer
  */
 
 unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,
@@ -83,7 +83,7 @@ unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,
                 return NULL;
         }
 
-        if(!(out = Malloc (inlen + EVP_CIPHER_CTX_block_size(&ctx)))) {
+        if(!(out = OPENSSL_malloc (inlen + EVP_CIPHER_CTX_block_size(&ctx)))) {
                 PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -91,7 +91,7 @@ unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,
         EVP_CipherUpdate (&ctx, out, &i, in, inlen);
         outlen = i;
         if(!EVP_CipherFinal (&ctx, out + i, &i)) {
-                Free (out);
+                OPENSSL_free (out);
                 PKCS12err(PKCS12_F_PKCS12_PBE_CRYPT,PKCS12_R_PKCS12_CIPHERFINAL_ERROR);
                 return NULL;
         }
@@ -109,7 +109,7 @@ unsigned char * PKCS12_pbe_crypt (X509_ALGOR *algor, const char *pass,
  */
 
 char * PKCS12_decrypt_d2i (X509_ALGOR *algor, char * (*d2i)(),
-             void (*free_func)(), const char *pass, int passlen,
+             void (*free_func)(void *), const char *pass, int passlen,
              ASN1_OCTET_STRING *oct, int seq)
 {
         unsigned char *out, *p;
@@ -139,7 +139,7 @@ char * PKCS12_decrypt_d2i (X509_ALGOR *algor, char * (*d2i)(),
         else ret = d2i(NULL, &p, outlen);
         if (seq & 2) memset(out, 0, outlen);
         if(!ret) PKCS12err(PKCS12_F_PKCS12_DECRYPT_D2I,PKCS12_R_DECODE_ERROR);
-        Free (out);
+        OPENSSL_free (out);
         return ret;
 }
 
@@ -166,7 +166,7 @@ ASN1_OCTET_STRING *PKCS12_i2d_encrypt (X509_ALGOR *algor, int (*i2d)(),
                 PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,PKCS12_R_ENCODE_ERROR);
                 return NULL;
         }
-        if (!(in = Malloc (inlen))) {
+        if (!(in = OPENSSL_malloc (inlen))) {
                 PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,ERR_R_MALLOC_FAILURE);
                 return NULL;
         }
@@ -177,9 +177,11 @@ ASN1_OCTET_STRING *PKCS12_i2d_encrypt (X509_ALGOR *algor, int (*i2d)(),
         if (!PKCS12_pbe_crypt (algor, pass, passlen, in, inlen, &oct->data,
                                  &oct->length, 1)) {
                 PKCS12err(PKCS12_F_PKCS12_I2D_ENCRYPT,PKCS12_R_ENCRYPT_ERROR);
-                Free(in);
+                OPENSSL_free(in);
                 return NULL;
         }
-        Free (in);
+        OPENSSL_free (in);
         return oct;
 }
+
+IMPLEMENT_PKCS12_STACK_OF(PKCS7)
diff --git a/src/lib/libcrypto/pkcs12/p12_key.c b/src/lib/libcrypto/pkcs12/p12_key.c
index b364671ed2..b042dcf05c 100644
--- a/src/lib/libcrypto/pkcs12/p12_key.c
+++ b/src/lib/libcrypto/pkcs12/p12_key.c
@@ -74,25 +74,30 @@ void h__dump (unsigned char *p, int len);
 #define min(a,b) ((a) < (b) ? (a) : (b))
 #endif
 
-int PKCS12_key_gen_asc (const char *pass, int passlen, unsigned char *salt,
+int PKCS12_key_gen_asc(const char *pass, int passlen, unsigned char *salt,
              int saltlen, int id, int iter, int n, unsigned char *out,
              const EVP_MD *md_type)
 {
         int ret;
         unsigned char *unipass;
         int uniplen;
-        if (!asc2uni (pass, &unipass, &uniplen)) {
+        if(!pass) {
+                unipass = NULL;
+                uniplen = 0;
+        } else if (!asc2uni(pass, &unipass, &uniplen)) {
                 PKCS12err(PKCS12_F_PKCS12_KEY_GEN_ASC,ERR_R_MALLOC_FAILURE);
                 return 0;
         }
-        ret = PKCS12_key_gen_uni (unipass, uniplen, salt, saltlen,
+        ret = PKCS12_key_gen_uni(unipass, uniplen, salt, saltlen,
                                                  id, iter, n, out, md_type);
-        memset(unipass, 0, uniplen);    /* Clear password from memory */
-        Free(unipass);
+        if(unipass) {
+                memset(unipass, 0, uniplen);    /* Clear password from memory */
+                OPENSSL_free(unipass);
+        }
         return ret;
 }
 
-int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
+int PKCS12_key_gen_uni(unsigned char *pass, int passlen, unsigned char *salt,
              int saltlen, int id, int iter, int n, unsigned char *out,
              const EVP_MD *md_type)
 {
@@ -106,10 +111,12 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
         int tmpn = n;
 #endif
 
+#if 0
         if (!pass) {
                 PKCS12err(PKCS12_F_PKCS12_KEY_GEN_UNI,ERR_R_PASSED_NULL_PARAMETER);
                 return 0;
         }
+#endif
 
 #ifdef  DEBUG_KEYGEN
         fprintf(stderr, "KEYGEN DEBUG\n");
@@ -121,13 +128,14 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
 #endif
         v = EVP_MD_block_size (md_type);
         u = EVP_MD_size (md_type);
-        D = Malloc (v);
-        Ai = Malloc (u);
-        B = Malloc (v + 1);
+        D = OPENSSL_malloc (v);
+        Ai = OPENSSL_malloc (u);
+        B = OPENSSL_malloc (v + 1);
         Slen = v * ((saltlen+v-1)/v);
-        Plen = v * ((passlen+v-1)/v);
+        if(passlen) Plen = v * ((passlen+v-1)/v);
+        else Plen = 0;
         Ilen = Slen + Plen;
-        I = Malloc (Ilen);
+        I = OPENSSL_malloc (Ilen);
         Ij = BN_new();
         Bpl1 = BN_new();
         if (!D || !Ai || !B || !I || !Ij || !Bpl1) {
@@ -150,10 +158,10 @@ int PKCS12_key_gen_uni (unsigned char *pass, int passlen, unsigned char *salt,
                 }
                 memcpy (out, Ai, min (n, u));
                 if (u >= n) {
-                        Free (Ai);
-                        Free (B);
-                        Free (D);
-                        Free (I);
+                        OPENSSL_free (Ai);
+                        OPENSSL_free (B);
+                        OPENSSL_free (D);
+                        OPENSSL_free (I);
                         BN_free (Ij);
                         BN_free (Bpl1);
 #ifdef DEBUG_KEYGEN
diff --git a/src/lib/libcrypto/pkcs12/p12_kiss.c b/src/lib/libcrypto/pkcs12/p12_kiss.c
index ee257ffbad..1fbbd6c99f 100644
--- a/src/lib/libcrypto/pkcs12/p12_kiss.c
+++ b/src/lib/libcrypto/pkcs12/p12_kiss.c
@@ -65,9 +65,10 @@
 static int parse_pk12( PKCS12 *p12, const char *pass, int passlen,
                 EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca);
 
-static int parse_bags( STACK *bags, const char *pass, int passlen,
-                EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
-                ASN1_OCTET_STRING **keyid, char *keymatch);
+static int parse_bags( STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
+                       int passlen, EVP_PKEY **pkey, X509 **cert,
+                       STACK_OF(X509) **ca, ASN1_OCTET_STRING **keyid,
+                       char *keymatch);
 
 static int parse_bag( PKCS12_SAFEBAG *bag, const char *pass, int passlen,
                         EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
@@ -85,32 +86,41 @@ int PKCS12_parse (PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 
         /* Check for NULL PKCS12 structure */
 
-        if(!p12)
-                {
+        if(!p12) {
                 PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_INVALID_NULL_PKCS12_POINTER);
                 return 0;
-                }
+        }
 
         /* Allocate stack for ca certificates if needed */
-        if ((ca != NULL) && (*ca == NULL))
-                {
-                if (!(*ca = sk_X509_new(NULL)))
-                        {
+        if ((ca != NULL) && (*ca == NULL)) {
+                if (!(*ca = sk_X509_new_null())) {
                         PKCS12err(PKCS12_F_PKCS12_PARSE,ERR_R_MALLOC_FAILURE);
                         return 0;
-                        }
                 }
+        }
 
         if(pkey) *pkey = NULL;
         if(cert) *cert = NULL;
 
         /* Check the mac */
 
-        if (!PKCS12_verify_mac (p12, pass, -1))
-                {
+        /* If password is zero length or NULL then try verifying both cases
+         * to determine which password is correct. The reason for this is that
+         * under PKCS#12 password based encryption no password and a zero length
+         * password are two different things...
+         */
+
+        if(!pass || !*pass) {
+                if(PKCS12_verify_mac(p12, NULL, 0)) pass = NULL;
+                else if(PKCS12_verify_mac(p12, "", 0)) pass = "";
+                else {
+                        PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_MAC_VERIFY_FAILURE);
+                        goto err;
+                }
+        } else if (!PKCS12_verify_mac(p12, pass, -1)) {
                 PKCS12err(PKCS12_F_PKCS12_PARSE,PKCS12_R_MAC_VERIFY_FAILURE);
                 goto err;
-                }
+        }
 
         if (!parse_pk12 (p12, pass, -1, pkey, cert, ca))
                 {
@@ -122,9 +132,9 @@ int PKCS12_parse (PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 
  err:
 
-        if (pkey && *pkey) EVP_PKEY_free (*pkey);
-        if (cert && *cert) X509_free (*cert);
-        if (ca) sk_X509_pop_free (*ca, X509_free);
+        if (pkey && *pkey) EVP_PKEY_free(*pkey);
+        if (cert && *cert) X509_free(*cert);
+        if (ca) sk_X509_pop_free(*ca, X509_free);
         return 0;
 
 }
@@ -134,45 +144,48 @@ int PKCS12_parse (PKCS12 *p12, const char *pass, EVP_PKEY **pkey, X509 **cert,
 static int parse_pk12 (PKCS12 *p12, const char *pass, int passlen,
              EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca)
 {
-        STACK *asafes, *bags;
+        STACK_OF(PKCS7) *asafes;
+        STACK_OF(PKCS12_SAFEBAG) *bags;
         int i, bagnid;
         PKCS7 *p7;
         ASN1_OCTET_STRING *keyid = NULL;
+
         char keymatch = 0;
         if (!( asafes = M_PKCS12_unpack_authsafes (p12))) return 0;
-        for (i = 0; i < sk_num (asafes); i++) {
-                p7 = (PKCS7 *) sk_value (asafes, i);
+        for (i = 0; i < sk_PKCS7_num (asafes); i++) {
+                p7 = sk_PKCS7_value (asafes, i);
                 bagnid = OBJ_obj2nid (p7->type);
                 if (bagnid == NID_pkcs7_data) {
-                        bags = M_PKCS12_unpack_p7data (p7);
+                        bags = M_PKCS12_unpack_p7data(p7);
                 } else if (bagnid == NID_pkcs7_encrypted) {
-                        bags = M_PKCS12_unpack_p7encdata (p7, pass, passlen);
+                        bags = M_PKCS12_unpack_p7encdata(p7, pass, passlen);
                 } else continue;
                 if (!bags) {
-                        sk_pop_free (asafes, PKCS7_free);
+                        sk_PKCS7_pop_free(asafes, PKCS7_free);
                         return 0;
                 }
                 if (!parse_bags(bags, pass, passlen, pkey, cert, ca,
                                                          &keyid, &keymatch)) {
-                        sk_pop_free(bags, PKCS12_SAFEBAG_free);
-                        sk_pop_free(asafes, PKCS7_free);
+                        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+                        sk_PKCS7_pop_free(asafes, PKCS7_free);
                         return 0;
                 }
-                sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
         }
-        sk_pop_free(asafes, PKCS7_free);
+        sk_PKCS7_pop_free(asafes, PKCS7_free);
         if (keyid) M_ASN1_OCTET_STRING_free(keyid);
         return 1;
 }
 
 
-static int parse_bags (STACK *bags, const char *pass, int passlen,
-                       EVP_PKEY **pkey, X509 **cert, STACK_OF(X509) **ca,
-                       ASN1_OCTET_STRING **keyid, char *keymatch)
+static int parse_bags (STACK_OF(PKCS12_SAFEBAG) *bags, const char *pass,
+                       int passlen, EVP_PKEY **pkey, X509 **cert,
+                       STACK_OF(X509) **ca, ASN1_OCTET_STRING **keyid,
+                       char *keymatch)
 {
         int i;
-        for (i = 0; i < sk_num(bags); i++) {
-                if (!parse_bag((PKCS12_SAFEBAG *)sk_value (bags, i),
+        for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
+                if (!parse_bag(sk_PKCS12_SAFEBAG_value (bags, i),
                          pass, passlen, pkey, cert, ca, keyid,
                                                          keymatch)) return 0;
         }
@@ -190,12 +203,17 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
 {
         PKCS8_PRIV_KEY_INFO *p8;
         X509 *x509;
-        ASN1_OCTET_STRING *lkey = NULL;
+        ASN1_OCTET_STRING *lkey = NULL, *ckid = NULL;
         ASN1_TYPE *attrib;
+        ASN1_BMPSTRING *fname = NULL;
 
+        if ((attrib = PKCS12_get_attr (bag, NID_friendlyName)))
+                fname = attrib->value.bmpstring;
 
-        if ((attrib = PKCS12_get_attr (bag, NID_localKeyID)))
-                                            lkey = attrib->value.octet_string;
+        if ((attrib = PKCS12_get_attr (bag, NID_localKeyID))) {
+                lkey = attrib->value.octet_string;
+                ckid = lkey;
+        }
 
         /* Check for any local key id matching (if needed) */
         if (lkey && ((*keymatch & MATCH_ALL) != MATCH_ALL)) {
@@ -231,6 +249,18 @@ static int parse_bag(PKCS12_SAFEBAG *bag, const char *pass, int passlen,
                 if (M_PKCS12_cert_bag_type(bag) != NID_x509Certificate )
                                                                  return 1;
                 if (!(x509 = M_PKCS12_certbag2x509(bag))) return 0;
+                if(ckid) X509_keyid_set1(x509, ckid->data, ckid->length);
+                if(fname) {
+                        int len;
+                        unsigned char *data;
+                        len = ASN1_STRING_to_UTF8(&data, fname);
+                        if(len > 0) {
+                                X509_alias_set1(x509, data, len);
+                                OPENSSL_free(data);
+                        }
+                }
+
+
                 if (lkey) {
                         *keymatch |= MATCH_CERT;
                         if (cert) *cert = x509;
diff --git a/src/lib/libcrypto/pkcs12/p12_lib.c b/src/lib/libcrypto/pkcs12/p12_lib.c
index 7ca9c14908..7d464e3a32 100644
--- a/src/lib/libcrypto/pkcs12/p12_lib.c
+++ b/src/lib/libcrypto/pkcs12/p12_lib.c
@@ -107,5 +107,5 @@ void PKCS12_free (PKCS12 *a)
         M_ASN1_INTEGER_free(a->version);
         PKCS12_MAC_DATA_free (a->mac);
         PKCS7_free (a->authsafes);
-        Free (a);
+        OPENSSL_free (a);
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_mac.c b/src/lib/libcrypto/pkcs12/p12_mac.c
index f5ab0d6464..fbd1eca24f 100644
--- a/src/lib/libcrypto/pkcs12/p12_mac.c
+++ b/src/lib/libcrypto/pkcs12/p12_mac.c
@@ -106,5 +106,5 @@ void PKCS12_MAC_DATA_free (PKCS12_MAC_DATA *a)
         X509_SIG_free (a->dinfo);
         M_ASN1_OCTET_STRING_free(a->salt);
         M_ASN1_INTEGER_free(a->iter);
-        Free (a);
+        OPENSSL_free (a);
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_mutl.c b/src/lib/libcrypto/pkcs12/p12_mutl.c
index 369257ed4c..13d866da51 100644
--- a/src/lib/libcrypto/pkcs12/p12_mutl.c
+++ b/src/lib/libcrypto/pkcs12/p12_mutl.c
@@ -106,10 +106,7 @@ int PKCS12_verify_mac (PKCS12 *p12, const char *pass, int passlen)
                 return 0;
         }
         if ((maclen != (unsigned int)p12->mac->dinfo->digest->length)
-        || memcmp (mac, p12->mac->dinfo->digest->data, maclen)) {
-                PKCS12err(PKCS12_F_VERIFY_MAC,PKCS12_R_MAC_VERIFY_ERROR);
-                return 0;
-        }
+        || memcmp (mac, p12->mac->dinfo->digest->data, maclen)) return 0;
         return 1;
 }
 
@@ -152,7 +149,7 @@ int PKCS12_setup_mac (PKCS12 *p12, int iter, unsigned char *salt, int saltlen,
         }
         if (!saltlen) saltlen = PKCS12_SALT_LEN;
         p12->mac->salt->length = saltlen;
-        if (!(p12->mac->salt->data = Malloc (saltlen))) {
+        if (!(p12->mac->salt->data = OPENSSL_malloc (saltlen))) {
                 PKCS12err(PKCS12_F_PKCS12_SETUP_MAC, ERR_R_MALLOC_FAILURE);
                 return 0;
         }
diff --git a/src/lib/libcrypto/pkcs12/p12_npas.c b/src/lib/libcrypto/pkcs12/p12_npas.c
index ee71707e2c..84e31a7f21 100644
--- a/src/lib/libcrypto/pkcs12/p12_npas.c
+++ b/src/lib/libcrypto/pkcs12/p12_npas.c
@@ -66,7 +66,8 @@
 /* PKCS#12 password change routine */
 
 static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass);
-static int newpass_bags(STACK *bags, char *oldpass,  char *newpass);
+static int newpass_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *oldpass,
+                        char *newpass);
 static int newpass_bag(PKCS12_SAFEBAG *bag, char *oldpass, char *newpass);
 static int alg_get(X509_ALGOR *alg, int *pnid, int *piter, int *psaltlen);
 
@@ -104,16 +105,18 @@ return 1;
 
 static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass)
 {
-        STACK *asafes, *newsafes, *bags;
+        STACK_OF(PKCS7) *asafes, *newsafes;
+        STACK_OF(PKCS12_SAFEBAG) *bags;
         int i, bagnid, pbe_nid, pbe_iter, pbe_saltlen;
         PKCS7 *p7, *p7new;
         ASN1_OCTET_STRING *p12_data_tmp = NULL, *macnew = NULL;
         unsigned char mac[EVP_MAX_MD_SIZE];
         unsigned int maclen;
+
         if (!(asafes = M_PKCS12_unpack_authsafes(p12))) return 0;
-        if(!(newsafes = sk_new(NULL))) return 0;
-        for (i = 0; i < sk_num (asafes); i++) {
-                p7 = (PKCS7 *) sk_value(asafes, i);
+        if(!(newsafes = sk_PKCS7_new_null())) return 0;
+        for (i = 0; i < sk_PKCS7_num (asafes); i++) {
+                p7 = sk_PKCS7_value(asafes, i);
                 bagnid = OBJ_obj2nid(p7->type);
                 if (bagnid == NID_pkcs7_data) {
                         bags = M_PKCS12_unpack_p7data(p7);
@@ -123,26 +126,26 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass)
                                 &pbe_nid, &pbe_iter, &pbe_saltlen);
                 } else continue;
                 if (!bags) {
-                        sk_pop_free(asafes, PKCS7_free);
+                        sk_PKCS7_pop_free(asafes, PKCS7_free);
                         return 0;
                 }
                 if (!newpass_bags(bags, oldpass, newpass)) {
-                        sk_pop_free(bags, PKCS12_SAFEBAG_free);
-                        sk_pop_free(asafes, PKCS7_free);
+                        sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
+                        sk_PKCS7_pop_free(asafes, PKCS7_free);
                         return 0;
                 }
                 /* Repack bag in same form with new password */
                 if (bagnid == NID_pkcs7_data) p7new = PKCS12_pack_p7data(bags);
                 else p7new = PKCS12_pack_p7encdata(pbe_nid, newpass, -1, NULL,
                                                  pbe_saltlen, pbe_iter, bags);
-                sk_pop_free(bags, PKCS12_SAFEBAG_free);
+                sk_PKCS12_SAFEBAG_pop_free(bags, PKCS12_SAFEBAG_free);
                 if(!p7new) {
-                        sk_pop_free(asafes, PKCS7_free);
+                        sk_PKCS7_pop_free(asafes, PKCS7_free);
                         return 0;
                 }
-                sk_push(newsafes, (char *)p7new);
+                sk_PKCS7_push(newsafes, p7new);
         }
-        sk_pop_free(asafes, PKCS7_free);
+        sk_PKCS7_pop_free(asafes, PKCS7_free);
 
         /* Repack safe: save old safe in case of error */
 
@@ -169,12 +172,14 @@ static int newpass_p12(PKCS12 *p12, char *oldpass, char *newpass)
 }
 
 
-static int newpass_bags(STACK *bags, char *oldpass,  char *newpass)
+static int newpass_bags(STACK_OF(PKCS12_SAFEBAG) *bags, char *oldpass,
+                        char *newpass)
 {
         int i;
-        for (i = 0; i < sk_num(bags); i++) {
-                if (!newpass_bag((PKCS12_SAFEBAG *)sk_value(bags, i),
-                                                 oldpass, newpass)) return 0;
+        for (i = 0; i < sk_PKCS12_SAFEBAG_num(bags); i++) {
+                if (!newpass_bag(sk_PKCS12_SAFEBAG_value(bags, i),
+                                 oldpass, newpass))
+                    return 0;
         }
         return 1;
 }
diff --git a/src/lib/libcrypto/pkcs12/p12_sbag.c b/src/lib/libcrypto/pkcs12/p12_sbag.c
index 1b3addece1..64ac32ee6f 100644
--- a/src/lib/libcrypto/pkcs12/p12_sbag.c
+++ b/src/lib/libcrypto/pkcs12/p12_sbag.c
@@ -81,8 +81,9 @@ int i2d_PKCS12_SAFEBAG(PKCS12_SAFEBAG *a, unsigned char **pp)
                 break;
 
                 case NID_safeContentsBag:
-                        M_ASN1_I2D_len_EXP_SEQUENCE_opt (a->value.safes,
-                                 i2d_PKCS12_SAFEBAG, 0, V_ASN1_SEQUENCE, v);
+                        M_ASN1_I2D_len_EXP_SEQUENCE_opt_type
+                          (PKCS12_SAFEBAG, a->value.safes, i2d_PKCS12_SAFEBAG,
+                           0, V_ASN1_SEQUENCE, v);
                 break;
 
                 case NID_certBag:
@@ -117,8 +118,9 @@ int i2d_PKCS12_SAFEBAG(PKCS12_SAFEBAG *a, unsigned char **pp)
                 break;
 
                 case NID_safeContentsBag:
-                        M_ASN1_I2D_put_EXP_SEQUENCE_opt (a->value.safes,
-                                 i2d_PKCS12_SAFEBAG, 0, V_ASN1_SEQUENCE, v);
+                        M_ASN1_I2D_put_EXP_SEQUENCE_opt_type
+                          (PKCS12_SAFEBAG, a->value.safes, i2d_PKCS12_SAFEBAG,
+                           0, V_ASN1_SEQUENCE, v);
                 break;
 
                 case NID_certBag:
@@ -175,9 +177,10 @@ PKCS12_SAFEBAG *d2i_PKCS12_SAFEBAG(PKCS12_SAFEBAG **a, unsigned char **pp,
                 break;
 
                 case NID_safeContentsBag:
-                        M_ASN1_D2I_get_EXP_set_opt(ret->value.safes,
-                                d2i_PKCS12_SAFEBAG, PKCS12_SAFEBAG_free,
-                                                         0, V_ASN1_SEQUENCE);
+                        M_ASN1_D2I_get_EXP_set_opt_type
+                          (PKCS12_SAFEBAG, ret->value.safes,
+                           d2i_PKCS12_SAFEBAG, PKCS12_SAFEBAG_free, 0,
+                           V_ASN1_SEQUENCE);
                 break;
 
                 case NID_certBag:
@@ -223,5 +226,9 @@ void PKCS12_SAFEBAG_free (PKCS12_SAFEBAG *a)
 
         ASN1_OBJECT_free (a->type);
         sk_X509_ATTRIBUTE_pop_free (a->attrib, X509_ATTRIBUTE_free);
-        Free (a);
+        OPENSSL_free (a);
 }
+
+IMPLEMENT_STACK_OF(PKCS12_SAFEBAG)
+IMPLEMENT_ASN1_SET_OF(PKCS12_SAFEBAG)
+IMPLEMENT_PKCS12_STACK_OF(PKCS12_SAFEBAG)
diff --git a/src/lib/libcrypto/pkcs12/p12_utl.c b/src/lib/libcrypto/pkcs12/p12_utl.c
index 2adcbc95e1..17f41b4549 100644
--- a/src/lib/libcrypto/pkcs12/p12_utl.c
+++ b/src/lib/libcrypto/pkcs12/p12_utl.c
@@ -67,7 +67,7 @@ unsigned char *asc2uni (const char *asc, unsigned char **uni, int *unilen)
         int ulen, i;
         unsigned char *unitmp;
         ulen = strlen(asc)*2  + 2;
-        if (!(unitmp = Malloc (ulen))) return NULL;
+        if (!(unitmp = OPENSSL_malloc (ulen))) return NULL;
         for (i = 0; i < ulen; i+=2) {
                 unitmp[i] = 0;
                 unitmp[i + 1] = asc[i>>1];
@@ -85,7 +85,7 @@ char *uni2asc (unsigned char *uni, int unilen)
         /* If no terminating zero allow for one */
         if (uni[unilen - 1]) asclen++;
         uni++;
-        if (!(asctmp = Malloc (asclen))) return NULL;
+        if (!(asctmp = OPENSSL_malloc (asclen))) return NULL;
         for (i = 0; i < unilen; i+=2) asctmp[i>>1] = uni[i];
         asctmp[asclen - 1] = 0;
         return asctmp;
diff --git a/src/lib/libcrypto/pkcs12/pkcs12.h b/src/lib/libcrypto/pkcs12/pkcs12.h
index dad356c00f..502fceff95 100644
--- a/src/lib/libcrypto/pkcs12/pkcs12.h
+++ b/src/lib/libcrypto/pkcs12/pkcs12.h
@@ -59,13 +59,13 @@
 #ifndef HEADER_PKCS12_H
 #define HEADER_PKCS12_H
 
+#include <openssl/bio.h>
+#include <openssl/x509.h>
+
 #ifdef __cplusplus
 extern "C" {
 #endif
 
-#include <openssl/bio.h>
-#include <openssl/x509.h>
-
 #define PKCS12_KEY_ID   1
 #define PKCS12_IV_ID    2
 #define PKCS12_MAC_ID   3
@@ -108,19 +108,25 @@ PKCS12_MAC_DATA *mac;
 PKCS7 *authsafes;
 } PKCS12;
 
+PREDECLARE_STACK_OF(PKCS12_SAFEBAG)
+
 typedef struct {
 ASN1_OBJECT *type;
 union {
         struct pkcs12_bag_st *bag; /* secret, crl and certbag */
         struct pkcs8_priv_key_info_st   *keybag; /* keybag */
         X509_SIG *shkeybag; /* shrouded key bag */
-        STACK /* PKCS12_SAFEBAG */ *safes;
+        STACK_OF(PKCS12_SAFEBAG) *safes;
         ASN1_TYPE *other;
 }value;
 STACK_OF(X509_ATTRIBUTE) *attrib;
 ASN1_TYPE *rest;
 } PKCS12_SAFEBAG;
 
+DECLARE_STACK_OF(PKCS12_SAFEBAG)
+DECLARE_ASN1_SET_OF(PKCS12_SAFEBAG)
+DECLARE_PKCS12_STACK_OF(PKCS12_SAFEBAG)
+
 typedef struct pkcs12_bag_st {
 ASN1_OBJECT *type;
 union {
@@ -140,50 +146,49 @@ union {
 #define M_PKCS12_crl_bag_type M_PKCS12_cert_bag_type
 
 #define M_PKCS12_x5092certbag(x509) \
-PKCS12_pack_safebag ((char *)(x509), i2d_X509, NID_x509Certificate, NID_certBag)
+PKCS12_pack_safebag((char *)(x509), i2d_X509, NID_x509Certificate, NID_certBag)
 
 #define M_PKCS12_x509crl2certbag(crl) \
-PKCS12_pack_safebag ((char *)(crl), i2d_X509CRL, NID_x509Crl, NID_crlBag)
+PKCS12_pack_safebag((char *)(crl), i2d_X509CRL, NID_x509Crl, NID_crlBag)
 
 #define M_PKCS12_certbag2x509(bg) \
-(X509 *) ASN1_unpack_string ((bg)->value.bag->value.octet, \
+(X509 *) ASN1_unpack_string((bg)->value.bag->value.octet, \
 (char *(*)())d2i_X509)
 
 #define M_PKCS12_certbag2x509crl(bg) \
-(X509CRL *) ASN1_unpack_string ((bg)->value.bag->value.octet, \
+(X509CRL *) ASN1_unpack_string((bg)->value.bag->value.octet, \
 (char *(*)())d2i_X509CRL)
 
 /*#define M_PKCS12_pkcs82rsa(p8) \
-(RSA *) ASN1_unpack_string ((p8)->pkey, (char *(*)())d2i_RSAPrivateKey)*/
+(RSA *) ASN1_unpack_string((p8)->pkey, (char *(*)())d2i_RSAPrivateKey)*/
 
 #define M_PKCS12_unpack_p7data(p7) \
-ASN1_seq_unpack ((p7)->d.data->data, p7->d.data->length, \
-                         (char *(*)())d2i_PKCS12_SAFEBAG, PKCS12_SAFEBAG_free)
+ASN1_seq_unpack_PKCS12_SAFEBAG((p7)->d.data->data, p7->d.data->length, \
+                                d2i_PKCS12_SAFEBAG, PKCS12_SAFEBAG_free)
 
 #define M_PKCS12_pack_authsafes(p12, safes) \
-ASN1_seq_pack((safes), (int (*)())i2d_PKCS7,\
+ASN1_seq_pack_PKCS7((safes), i2d_PKCS7,\
         &(p12)->authsafes->d.data->data, &(p12)->authsafes->d.data->length)
 
 #define M_PKCS12_unpack_authsafes(p12) \
-ASN1_seq_unpack((p12)->authsafes->d.data->data, \
-                (p12)->authsafes->d.data->length, (char *(*)())d2i_PKCS7, \
-                                                        PKCS7_free)
+ASN1_seq_unpack_PKCS7((p12)->authsafes->d.data->data, \
+                (p12)->authsafes->d.data->length, d2i_PKCS7, PKCS7_free)
 
 #define M_PKCS12_unpack_p7encdata(p7, pass, passlen) \
-(STACK *) PKCS12_decrypt_d2i ((p7)->d.encrypted->enc_data->algorithm,\
-                         (char *(*)())d2i_PKCS12_SAFEBAG, PKCS12_SAFEBAG_free, \
-                                                        (pass), (passlen), \
-                        (p7)->d.encrypted->enc_data->enc_data, 3)
+PKCS12_decrypt_d2i_PKCS12_SAFEBAG((p7)->d.encrypted->enc_data->algorithm,\
+                                   d2i_PKCS12_SAFEBAG, PKCS12_SAFEBAG_free, \
+                                   (pass), (passlen), \
+                                   (p7)->d.encrypted->enc_data->enc_data, 3)
 
 #define M_PKCS12_decrypt_skey(bag, pass, passlen) \
-(PKCS8_PRIV_KEY_INFO *) PKCS12_decrypt_d2i ((bag)->value.shkeybag->algor, \
-(char *(*)())d2i_PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free, \
+(PKCS8_PRIV_KEY_INFO *) PKCS12_decrypt_d2i((bag)->value.shkeybag->algor, \
+(char *(*)())d2i_PKCS8_PRIV_KEY_INFO, (void (*)(void *))PKCS8_PRIV_KEY_INFO_free, \
                                                 (pass), (passlen), \
                          (bag)->value.shkeybag->digest, 2)
 
 #define M_PKCS8_decrypt(p8, pass, passlen) \
-(PKCS8_PRIV_KEY_INFO *) PKCS12_decrypt_d2i ((p8)->algor, \
-(char *(*)())d2i_PKCS8_PRIV_KEY_INFO, PKCS8_PRIV_KEY_INFO_free,\
+(PKCS8_PRIV_KEY_INFO *) PKCS12_decrypt_d2i((p8)->algor, \
+(char *(*)())d2i_PKCS8_PRIV_KEY_INFO, (void (*)(void *))PKCS8_PRIV_KEY_INFO_free,\
                          (pass), (passlen), (p8)->digest, 2)
 
 #define PKCS12_get_attr(bag, attr_nid) \
@@ -205,10 +210,10 @@ PKCS12_SAFEBAG *PKCS12_MAKE_SHKEYBAG(int pbe_nid, const char *pass,
                                      int passlen, unsigned char *salt,
                                      int saltlen, int iter,
                                      PKCS8_PRIV_KEY_INFO *p8);
-PKCS7 *PKCS12_pack_p7data(STACK *sk);
+PKCS7 *PKCS12_pack_p7data(STACK_OF(PKCS12_SAFEBAG) *sk);
 PKCS7 *PKCS12_pack_p7encdata(int pbe_nid, const char *pass, int passlen,
                              unsigned char *salt, int saltlen, int iter,
-                             STACK *bags);
+                             STACK_OF(PKCS12_SAFEBAG) *bags);
 int PKCS12_add_localkeyid(PKCS12_SAFEBAG *bag, unsigned char *name, int namelen);
 int PKCS12_add_friendlyname_asc(PKCS12_SAFEBAG *bag, const char *name,
                                 int namelen);
@@ -221,7 +226,7 @@ unsigned char *PKCS12_pbe_crypt(X509_ALGOR *algor, const char *pass,
                                 int passlen, unsigned char *in, int inlen,
                                 unsigned char **data, int *datalen, int en_de);
 char *PKCS12_decrypt_d2i(X509_ALGOR *algor, char *(*d2i)(),
-                         void (*free_func)(), const char *pass, int passlen,
+                         void (*free_func)(void *), const char *pass, int passlen,
                          ASN1_STRING *oct, int seq);
 ASN1_STRING *PKCS12_i2d_encrypt(X509_ALGOR *algor, int (*i2d)(),
                                 const char *pass, int passlen, char *obj,