diff --git a/README.md b/README.md
index cd6bde3e9..572ae6fe3 100644
--- a/README.md
+++ b/README.md
@@ -42,7 +42,7 @@ Each project port included in this repository is contained in its own subdirecto
 | NXP SE05X Middleware | wolfSSL HostCrypto support patch | [Link](https://www.nxp.com/products/security-and-authentication/authentication/edgelock-se050-plug-trust-secure-element-family-enhanced-iot-security-with-high-flexibility:SE050) | | [README](./nxp-se05x-middleware/README.md) |
 | openldap | Open source lightweight directory access protocol | [Link](https://www.openldap.org/) | [Link](https://www.wolfssl.com/open-source-project-ports-openldap/) | [README](./openldap/2.4.47/README.md) |
 | openpegasus  | Open source DMTF CIM and WBEM | [Link](https://collaboration.opengroup.org/pegasus/) | [Link](https://www.wolfssl.com/openpegasus-port-support-added-wolfssl/) | [README](./openpegasus/2.14.1/README.md) |
-| openresty | Nginx and LuaJIT-based web platform | [Link](https://openresty.org/en/) | | [README](./openresty/INSTRUCTIONS.md) |
+| openresty | Nginx and LuaJIT-based web platform | [Link](https://openresty.org/en/) | | [README](./openresty/README.md) |
 | openssh-patches | OpenSSH | [Link](https://www.openssh.com/) | [Link](https://www.wolfssl.com/wolfssl-openssh-expanded-openssl-compatibility/) | [README](./openssh-patches/README) |
 | ppp | Paul's PPP Package | [Link](https://ppp.samba.org/) | | [README](./ppp/README) |
 | Python | Python language and interpreter | [Link](https://www.python.org/) | | [README](./Python/README.txt) |
diff --git a/openresty/1.31.1.1-tests.patch b/openresty/1.31.1.1-tests.patch
new file mode 100644
index 000000000..81f284e3c
--- /dev/null
+++ b/openresty/1.31.1.1-tests.patch
@@ -0,0 +1,1566 @@
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/ocsp.t b/bundle/lua-resty-core-0.1.34rc3/t/ocsp.t
+index 8fc1d4b..f06653f 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/ocsp.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/ocsp.t
+@@ -8,6 +8,12 @@ use t::TestCore;
+ 
+ repeat_each(2);
+ 
++my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
++my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
++
+ plan tests => repeat_each() * (blocks() * 6 + 13);
+ 
+ no_long_string();
+@@ -1404,6 +1410,8 @@ OCSP response validation ok
+ 
+ === TEST 16: good status req from client
+ FIXME: check the OCSP staple actually received by the ssl client
++wolfSSL records the client's status_request only when OCSP stapling is enabled on the server, so ngx.ocsp.set_ocsp_status_resp() sees no request.
++--- skip_eval: 7:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl-cert.t b/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl-cert.t
+index a19c23a..e263de8 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl-cert.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl-cert.t
+@@ -11,6 +11,9 @@ repeat_each(2);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "proxy_ssl_certificate_by_lua* is not built with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
+     plan(skip_all => "too old OpenSSL, need >= 1.0.2e, was $1");
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl-verify.t b/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl-verify.t
+index 3c49646..138d72a 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl-verify.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl-verify.t
+@@ -11,6 +11,9 @@ repeat_each(2);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "proxy_ssl_verify_by_lua* needs SSL_set_retry_verify, not available with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need 1.1.1, was $1");
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl.t b/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl.t
+index ad6ebce..f1ce26c 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/proxy-ssl.t
+@@ -11,6 +11,9 @@ repeat_each(2);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "proxy_ssl_certificate_by_lua* is not built with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need 1.1.1, was $1");
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/socket-tcp-settrustedstore.t b/bundle/lua-resty-core-0.1.34rc3/t/socket-tcp-settrustedstore.t
+index 804a27d..908749f 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/socket-tcp-settrustedstore.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/socket-tcp-settrustedstore.t
+@@ -7,6 +7,9 @@ repeat_each(2);
+ 
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "FFI calls into libcrypto symbols that wolfSSL does not export");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need 1.1.1, was $1");
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/ssl-client-hello.t b/bundle/lua-resty-core-0.1.34rc3/t/ssl-client-hello.t
+index 8c6266e..424a879 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/ssl-client-hello.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/ssl-client-hello.t
+@@ -11,6 +11,9 @@ repeat_each(2);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "ssl_client_hello_by_lua* needs SSL_CTX_set_client_hello_cb, not available with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need 1.1.1, was $1");
+@@ -111,7 +114,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -212,7 +215,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -343,7 +346,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -445,7 +448,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -552,7 +555,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -658,7 +661,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/ssl-session-fetch.t b/bundle/lua-resty-core-0.1.34rc3/t/ssl-session-fetch.t
+index 801b83f..7296aa5 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/ssl-session-fetch.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/ssl-session-fetch.t
+@@ -11,6 +11,12 @@ use File::Basename;
+ 
+ repeat_each(2);
+ 
++my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
++my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
++
+ plan tests => repeat_each() * (blocks() * 6);
+ 
+ no_long_string();
+@@ -409,6 +415,8 @@ $/s,
+ 
+ 
+ === TEST 5: yield during doing handshake with client which uses low version OpenSSL
++Drives openssl s_client with -sess_out/-sess_in; fails with the OpenSSL 3 s_client on Ubuntu 24.04 whatever the server library.
++--- skip_eval: 7:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- no_check_leak
+ --- http_config
+     lua_shared_dict done 16k;
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/ssl-session-store.t b/bundle/lua-resty-core-0.1.34rc3/t/ssl-session-store.t
+index f68e89c..36b091c 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/ssl-session-store.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/ssl-session-store.t
+@@ -10,6 +10,12 @@ use File::Basename;
+ 
+ repeat_each(2);
+ 
++my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
++my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
++
+ plan tests => repeat_each() * (blocks() * 6 + 2);
+ 
+ no_long_string();
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/ssl.t b/bundle/lua-resty-core-0.1.34rc3/t/ssl.t
+index fe3dd37..f78114f 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/ssl.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/ssl.t
+@@ -15,6 +15,9 @@ no_long_string();
+ 
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
+ 
+ if ($openssl_version =~ m/\bBoringSSL\b/) {
+     $ENV{TEST_NGINX_BORINGSSL} = 1;
+@@ -29,6 +32,8 @@ run_tests();
+ __DATA__
+ 
+ === TEST 1: clear certs
++wolfSSL sends a different alert than OpenSSL's handshake_failure (alert 40) for a server without a certificate.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -219,7 +224,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -318,7 +323,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -418,7 +423,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -534,7 +539,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -655,7 +660,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -774,7 +779,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -897,7 +902,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1024,7 +1029,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1350,6 +1355,8 @@ got TLS1 version: TLSv1.2,
+ 
+ 
+ === TEST 14: ngx.semaphore in ssl_certificate_by_lua*
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 7:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -1552,7 +1559,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1686,7 +1693,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1705,6 +1712,8 @@ lua ssl server name: "test.com"
+ 
+ 
+ === TEST 17: parse PEM cert and key to cdata (bad cert 0 in the chain)
++nginx logs wolfSSL handshake failures at [crit]: wolfSSL error codes are not the OpenSSL reasons nginx maps to [info].
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -1830,6 +1839,8 @@ qr/\[error\] .*? failed to parse pem cert: PEM_read_bio_X509_AUX\(\) failed/
+ 
+ 
+ === TEST 18: parse PEM cert and key to cdata (bad cert 2 in the chain)
++nginx logs wolfSSL handshake failures at [crit]: wolfSSL error codes are not the OpenSSL reasons nginx maps to [info].
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -1955,6 +1966,8 @@ qr/\[error\] .*? failed to parse pem cert: PEM_read_bio_X509\(\) failed/
+ 
+ 
+ === TEST 19: parse PEM cert and key to cdata (bad priv key)
++nginx logs wolfSSL handshake failures at [crit]: wolfSSL error codes are not the OpenSSL reasons nginx maps to [info].
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -2164,7 +2177,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2183,6 +2196,8 @@ client ip: 127.0.0.1
+ 
+ 
+ === TEST 21: yield during doing handshake with client which uses low version OpenSSL
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- no_check_leak
+ --- http_config
+     lua_shared_dict done 16k;
+@@ -2411,6 +2426,8 @@ client certificate subject: emailAddress=agentzh@gmail.com,CN=test.com
+ 
+ 
+ === TEST 24: verify client without CA certificates
++wolfSSL's certificate verify error text differs from OpenSSL's.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -2605,7 +2622,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2705,7 +2722,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2837,7 +2854,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2971,7 +2988,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -3077,7 +3094,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -3096,6 +3113,8 @@ client-random length: 32
+ 
+ 
+ === TEST 31: export_keying_material
++ngx.ssl.export_keying_material() needs OpenSSL >= 1.1.1a; wolfSSL reports OpenSSL 1.1.0 compatibility.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -3185,7 +3204,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -3291,7 +3310,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -3436,6 +3455,8 @@ SUCCESS
+ 
+ 
+ === TEST 35: get shared SSL ciphers
++ngx.ssl.get_shared_ssl_ciphers() needs OpenSSL >= 1.1.1a; wolfSSL reports OpenSSL 1.1.0 compatibility.
++--- skip_eval: 7:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+     server {
+@@ -3629,7 +3650,7 @@ ssl pointer: cdata
+ ssl ctx: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -3733,7 +3754,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -3846,7 +3867,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 200 OK
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 51
+ received: Connection: close
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/stream/socket-tcp-settrustedstore.t b/bundle/lua-resty-core-0.1.34rc3/t/stream/socket-tcp-settrustedstore.t
+index cdc2c90..cb16290 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/stream/socket-tcp-settrustedstore.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/stream/socket-tcp-settrustedstore.t
+@@ -7,6 +7,9 @@ repeat_each(2);
+ 
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "FFI calls into libcrypto symbols that wolfSSL does not export");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need 1.1.1, was $1");
+diff --git a/bundle/lua-resty-core-0.1.34rc3/t/stream/ssl.t b/bundle/lua-resty-core-0.1.34rc3/t/stream/ssl.t
+index f08a31e..ac531a1 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/t/stream/ssl.t
++++ b/bundle/lua-resty-core-0.1.34rc3/t/stream/ssl.t
+@@ -15,6 +15,9 @@ no_long_string();
+ 
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
+ 
+ if ($openssl_version =~ m/\bBoringSSL\b/) {
+     $ENV{TEST_NGINX_BORINGSSL} = 1;
+@@ -29,6 +32,8 @@ run_tests();
+ __DATA__
+ 
+ === TEST 1: clear certs
++wolfSSL sends a different alert than OpenSSL's handshake_failure (alert 40) for a server without a certificate.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -1071,6 +1076,8 @@ got TLS1 version: TLSv1.2,
+ 
+ 
+ === TEST 14: ngx.semaphore in ssl_certificate_by_lua*
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 7:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -1361,6 +1368,8 @@ lua ssl server name: "test.com"
+ 
+ 
+ === TEST 17: parse PEM cert and key to cdata (bad cert 0 in the chain)
++nginx logs wolfSSL handshake failures at [crit]: wolfSSL error codes are not the OpenSSL reasons nginx maps to [info].
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -1466,6 +1475,8 @@ qr/\[error\] .*? failed to parse pem cert: PEM_read_bio_X509_AUX\(\) failed/
+ 
+ 
+ === TEST 18: parse PEM cert and key to cdata (bad cert 2 in the chain)
++nginx logs wolfSSL handshake failures at [crit]: wolfSSL error codes are not the OpenSSL reasons nginx maps to [info].
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -1571,6 +1582,8 @@ qr/\[error\] .*? failed to parse pem cert: PEM_read_bio_X509\(\) failed/
+ 
+ 
+ === TEST 19: parse PEM cert and key to cdata (bad priv key)
++nginx logs wolfSSL handshake failures at [crit]: wolfSSL error codes are not the OpenSSL reasons nginx maps to [info].
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+@@ -1752,6 +1765,8 @@ client ip: 127.0.0.1
+ 
+ 
+ === TEST 21: yield during doing handshake with client which uses low version OpenSSL
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- no_check_leak
+ --- stream_config
+     lua_shared_dict done 16k;
+@@ -1959,6 +1974,8 @@ client certificate subject: emailAddress=agentzh@gmail.com,CN=test.com
+ 
+ 
+ === TEST 24: verify client without CA certificates
++wolfSSL's certificate verify error text differs from OpenSSL's.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -2346,6 +2363,8 @@ client-random length: 32
+ 
+ 
+ === TEST 29: get shared SSL ciphers
++ngx.ssl.get_shared_ssl_ciphers() needs OpenSSL >= 1.1.1a; wolfSSL reports OpenSSL 1.1.0 compatibility.
++--- skip_eval: 7:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     lua_package_path "$TEST_NGINX_LUA_PACKAGE_PATH";
+ 
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/129-ssl-socket.t b/bundle/ngx_lua-0.10.31rc5/t/129-ssl-socket.t
+index 7782fcc..df58361 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/129-ssl-socket.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/129-ssl-socket.t
+@@ -1747,7 +1747,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1852,7 +1852,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2513,7 +2513,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/139-ssl-cert-by.t b/bundle/ngx_lua-0.10.31rc5/t/139-ssl-cert-by.t
+index d905cb3..805757c 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/139-ssl-cert-by.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/139-ssl-cert-by.t
+@@ -7,6 +7,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
+ if ($openssl_version =~ m/BoringSSL/) {
+     $ENV{TEST_NGINX_USE_BORINGSSL} = 1;
+ }
+@@ -107,7 +110,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -137,6 +140,8 @@ ssl_certificate_by_lua\(nginx.conf:28\):1: ssl cert by lua is running!,/
+ 
+ 
+ === TEST 2: sleep
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -216,7 +221,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -321,7 +326,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -340,6 +345,8 @@ my timer run!
+ 
+ 
+ === TEST 4: cosocket
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -439,7 +446,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -525,6 +532,8 @@ should never reached here
+ 
+ 
+ === TEST 6: ngx.exit(ngx.ERROR) - no yield
++wolfSSL reports a failed certificate callback with its own error text, not OpenSSL's "cert cb error".
++--- skip_eval: 8:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -595,6 +604,8 @@ should never reached here
+ 
+ 
+ === TEST 7: ngx.exit(0) -  yield
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 7:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -664,6 +675,8 @@ should never reached here
+ 
+ 
+ === TEST 8: ngx.exit(ngx.ERROR) - yield
++wolfSSL reports a failed certificate callback with its own error text, not OpenSSL's "cert cb error".
++--- skip_eval: 8:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -736,6 +749,8 @@ should never reached here
+ 
+ 
+ === TEST 9: lua exception - no yield
++wolfSSL reports a failed certificate callback with its own error text, not OpenSSL's "cert cb error".
++--- skip_eval: 9:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -807,6 +822,8 @@ should never reached here
+ 
+ 
+ === TEST 10: lua exception - yield
++wolfSSL reports a failed certificate callback with its own error text, not OpenSSL's "cert cb error".
++--- skip_eval: 8:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -941,6 +958,8 @@ get_phase: ssl_cert
+ 
+ 
+ === TEST 12: connection aborted prematurely
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1006,6 +1025,8 @@ ssl-cert-by-lua: after sleeping
+ 
+ 
+ === TEST 13: subrequests disabled
++wolfSSL reports a failed certificate callback with its own error text, not OpenSSL's "cert cb error".
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1144,7 +1165,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1255,7 +1276,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1282,6 +1303,8 @@ lua ssl server name: "test.com"
+ 
+ 
+ === TEST 16: simple user thread wait with yielding
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 5:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1379,7 +1402,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1475,7 +1498,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1573,7 +1596,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1675,7 +1698,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 59 bytes.
+ received: HTTP/1.1 200 OK
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 2
+ received: Connection: close
+@@ -1695,6 +1718,8 @@ close: 1 nil
+ 
+ 
+ === TEST 20: some server {} block missing ssl_certificate_by_lua* handlers (literal server name)
++nginx logs wolfSSL handshake failures at [crit]: wolfSSL error codes are not the OpenSSL reasons nginx maps to [info].
++--- skip_eval: 4:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1790,6 +1815,8 @@ qr/\[info\] .*? SSL_do_handshake\(\) failed\b/,
+ 
+ 
+ === TEST 21: some server {} block missing ssl_certificate_by_lua* handlers (regex server name)
++nginx logs wolfSSL handshake failures at [crit]: wolfSSL error codes are not the OpenSSL reasons nginx maps to [info].
++--- skip_eval: 4:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1970,7 +1997,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2070,7 +2097,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2155,6 +2182,8 @@ qr/elapsed in ssl_certificate_by_lua\*: 0\.(?:09|1\d)\d+,/,
+ 
+ 
+ === TEST 25: cosocket (UDP)
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/140-ssl-c-api.t b/bundle/ngx_lua-0.10.31rc5/t/140-ssl-c-api.t
+index 466f85f..b37eb5f 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/140-ssl-c-api.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/140-ssl-c-api.t
+@@ -13,6 +13,9 @@ if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
+ } elsif ($openssl_version =~ m/BoringSSL/) {
+     $ENV{TEST_NGINX_USE_BORINGSSL} = 1;
+     plan tests => repeat_each() * (blocks() * 6 - 8);
++} elsif ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++    plan tests => repeat_each() * (blocks() * 5 - 5);
+ } else {
+     plan tests => repeat_each() * (blocks() * 5 - 5);
+     $ENV{TEST_NGINX_USE_OPENSSL} = 1;
+@@ -240,7 +243,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -394,7 +397,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -522,7 +525,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -673,7 +676,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -823,7 +826,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -916,6 +919,8 @@ client certificate subject: emailAddress=agentzh@gmail.com,CN=test.com
+ 
+ 
+ === TEST 7: verify client without CA certificates
++wolfSSL's certificate verify error text differs from OpenSSL's.
++--- skip_eval: 5:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1205,7 +1210,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1223,7 +1228,8 @@ lua ssl server name: "test.com"
+ 
+ 
+ === TEST 10: Raw SSL pointer
+---- skip_eval: 8:$ENV{TEST_NGINX_USE_BORINGSSL}
++FFI call to an OpenSSL symbol: wolfSSL only exports wolfSSL_ prefixed names.
++--- skip_eval: 5:$ENV{TEST_NGINX_USE_BORINGSSL} || $ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1330,7 +1336,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1480,7 +1486,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1621,7 +1627,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1793,7 +1799,8 @@ SUCCESS
+ 
+ 
+ === TEST 15: Get supported ciphers
+---- skip_eval: 8:$ENV{TEST_NGINX_USE_BORINGSSL}
++nginx's "SSL: TLSv1.2, cipher:" debug log line needs SSL_CIPHER_description(), which wolfSSL does not provide.
++--- skip_eval: 3:$ENV{TEST_NGINX_USE_BORINGSSL} || $ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1854,7 +1861,8 @@ TLSv1.2, cipher: "ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(
+ 
+ 
+ === TEST 16: SSL cipher API error handling (no SSL)
+---- skip_eval: 8:$ENV{TEST_NGINX_USE_BORINGSSL}
++nginx's "SSL: TLSv1.2, cipher:" debug log line needs SSL_CIPHER_description(), which wolfSSL does not provide.
++--- skip_eval: 4:$ENV{TEST_NGINX_USE_BORINGSSL} || $ENV{TEST_NGINX_USE_WOLFSSL}
+ --- config
+     location /t {
+         content_by_lua_block {
+@@ -1887,7 +1895,8 @@ err: bad request
+ 
+ 
+ === TEST 17: Buffer overflow handling
+---- skip_eval: 8:$ENV{TEST_NGINX_USE_BORINGSSL}
++nginx's "SSL: TLSv1.2, cipher:" debug log line needs SSL_CIPHER_description(), which wolfSSL does not provide.
++--- skip_eval: 3:$ENV{TEST_NGINX_USE_BORINGSSL} || $ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1949,7 +1958,7 @@ TLSv1.2, cipher: "ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(
+ 
+ 
+ === TEST 18: BORINGSSL error handling
+---- skip_eval: 8:$ENV{TEST_NGINX_USE_OPENSSL}
++--- skip_eval: 8:!$ENV{TEST_NGINX_USE_BORINGSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -2005,7 +2014,8 @@ Error: BoringSSL is not supported for SSL cipher operations
+ 
+ 
+ === TEST 19: Get supported ciphers with GREASE filtering
+---- skip_eval: 8:$ENV{TEST_NGINX_USE_BORINGSSL}
++nginx's "SSL: TLSv1.2, cipher:" debug log line needs SSL_CIPHER_description(), which wolfSSL does not provide.
++--- skip_eval: 3:$ENV{TEST_NGINX_USE_BORINGSSL} || $ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -2212,7 +2222,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2361,7 +2371,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/142-ssl-session-store.t b/bundle/ngx_lua-0.10.31rc5/t/142-ssl-session-store.t
+index 11deb83..024776e 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/142-ssl-session-store.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/142-ssl-session-store.t
+@@ -6,6 +6,12 @@ use File::Basename;
+ 
+ repeat_each(3);
+ 
++my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
++my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
++
+ plan tests => repeat_each() * (blocks() * 6 - 1);
+ 
+ $ENV{TEST_NGINX_HTML_DIR} ||= html_dir();
+@@ -622,6 +628,9 @@ get_phase: ssl_session_store
+ 
+ 
+ === TEST 9: inter-operation with ssl_certificate_by_lua
++Timing window widened as in the ngx_stream_lua twin: a 0.1 s sleep can take 0.12 s on a loaded runner.
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 7:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     ssl_session_store_by_lua_block { print("ssl store session by lua is running!") }
+     server {
+@@ -686,7 +695,7 @@ close: 1 nil
+ --- error_log eval
+ [
+ 'lua ssl server name: "test.com"',
+-qr/elapsed in ssl cert by lua: 0.(?:09|1[01])\d+,/,
++qr/elapsed in ssl cert by lua: 0.(?:09|1\d)\d+,/,
+ 'ssl_session_store_by_lua(nginx.conf:25):1: ssl store session by lua is running!',
+ ]
+ 
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/143-ssl-session-fetch.t b/bundle/ngx_lua-0.10.31rc5/t/143-ssl-session-fetch.t
+index 3fbb46e..f1a4aaa 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/143-ssl-session-fetch.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/143-ssl-session-fetch.t
+@@ -11,6 +11,9 @@ plan "no_plan";
+ 
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
+ if ($openssl_version =~ m/BoringSSL/) {
+     $ENV{TEST_NGINX_USE_BORINGSSL} = 1;
+ }
+@@ -1279,6 +1282,8 @@ GET /t
+ 
+ 
+ === TEST 15: ssl_session_fetch_by_lua* is skipped when session ticket is provided
++wolfSSL clients request session tickets only after wolfSSL_UseSessionTicket(); the cosocket client resumes by session ID, which consults ssl_session_fetch_by_lua*.
++--- skip_eval: 5:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- http_config
+     ssl_session_fetch_by_lua_block { ngx.log(ngx.ERR, "ssl_session_fetch_by_lua* is running!") }
+     server {
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/155-tls13.t b/bundle/ngx_lua-0.10.31rc5/t/155-tls13.t
+index 54379e4..7f4fc51 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/155-tls13.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/155-tls13.t
+@@ -7,6 +7,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need >= 1.1.1, was $1");
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/166-ssl-client-hello.t b/bundle/ngx_lua-0.10.31rc5/t/166-ssl-client-hello.t
+index 4372d0d..b51da0c 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/166-ssl-client-hello.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/166-ssl-client-hello.t
+@@ -7,6 +7,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "ssl_client_hello_by_lua* needs SSL_CTX_set_client_hello_cb, not available with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need >= 1.1.1, was $1");
+@@ -108,7 +111,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -217,7 +220,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -322,7 +325,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -440,7 +443,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1143,7 +1146,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1254,7 +1257,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1378,7 +1381,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1474,7 +1477,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1569,7 +1572,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1653,7 +1656,7 @@ GET /t
+ connected: 1
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1734,7 +1737,7 @@ GET /t
+ connected: 1
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1825,7 +1828,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -1910,7 +1913,7 @@ GET /t
+ connected: 1
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2013,7 +2016,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 57 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 5
+ received: Connection: close
+@@ -2111,7 +2114,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2216,7 +2219,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+@@ -2316,7 +2319,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/169-proxy-ssl-verify.t b/bundle/ngx_lua-0.10.31rc5/t/169-proxy-ssl-verify.t
+index 95ecc1f..9807afe 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/169-proxy-ssl-verify.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/169-proxy-ssl-verify.t
+@@ -7,6 +7,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "proxy_ssl_verify_by_lua* needs SSL_set_retry_verify, not available with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (\d+)\.(\d+)\.(\d+)/) {
+     my ($major, $minor, $patch) = ($1, $2, $3);
+@@ -1325,7 +1328,7 @@ simple logging return
+ connected: 1
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/170-proxy-ssl-cert.t b/bundle/ngx_lua-0.10.31rc5/t/170-proxy-ssl-cert.t
+index 798cfaf..677db41 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/170-proxy-ssl-cert.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/170-proxy-ssl-cert.t
+@@ -7,6 +7,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "proxy_ssl_certificate_by_lua* is not built with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/BoringSSL/) {
+     plan(skip_all => "does not support BoringSSL");
+@@ -1265,7 +1268,7 @@ simple logging return
+ connected: 1
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/187-ssl-two-verification.t b/bundle/ngx_lua-0.10.31rc5/t/187-ssl-two-verification.t
+index bea4aae..04c9bcc 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/187-ssl-two-verification.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/187-ssl-two-verification.t
+@@ -7,6 +7,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "ssl_client_hello_by_lua* needs SSL_CTX_set_client_hello_cb, not available with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need >= 1.1.1, was $1");
+@@ -116,7 +119,7 @@ connected: 1
+ ssl handshake: cdata
+ sent http request: 56 bytes.
+ received: HTTP/1.1 201 Created
+-received: Server: nginx
++received: Server: openresty
+ received: Content-Type: text/plain
+ received: Content-Length: 4
+ received: Connection: close
+diff --git a/bundle/ngx_lua-0.10.31rc5/t/193-ssl-trusted-store.t b/bundle/ngx_lua-0.10.31rc5/t/193-ssl-trusted-store.t
+index 4b937b4..256fdaf 100644
+--- a/bundle/ngx_lua-0.10.31rc5/t/193-ssl-trusted-store.t
++++ b/bundle/ngx_lua-0.10.31rc5/t/193-ssl-trusted-store.t
+@@ -4,6 +4,12 @@ use Test::Nginx::Socket::Lua;
+ 
+ repeat_each(2);
+ 
++my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
++my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "FFI calls into libcrypto symbols that wolfSSL does not export");
++}
++
+ plan tests => repeat_each() * (blocks() * 6);
+ 
+ log_level 'debug';
+diff --git a/bundle/ngx_stream_lua-0.0.19rc4/t/139-ssl-cert-by.t b/bundle/ngx_stream_lua-0.0.19rc4/t/139-ssl-cert-by.t
+index 95e86a6..8664c2d 100644
+--- a/bundle/ngx_stream_lua-0.0.19rc4/t/139-ssl-cert-by.t
++++ b/bundle/ngx_stream_lua-0.0.19rc4/t/139-ssl-cert-by.t
+@@ -6,6 +6,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
+     plan(skip_all => "too old OpenSSL, need >= 1.0.2e, was $1");
+@@ -107,6 +110,8 @@ reusable connection: 0
+ 
+ 
+ === TEST 2: sleep
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -256,6 +261,8 @@ my timer run!
+ 
+ 
+ === TEST 4: cosocket
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -403,6 +410,8 @@ should never reached here
+ 
+ 
+ === TEST 6: ngx.exit(ngx.ERROR) - no yield
++wolfSSL reports a failed certificate callback with its own error text, not OpenSSL's "cert cb error".
++--- skip_eval: 8:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -462,6 +471,8 @@ should never reached here
+ 
+ 
+ === TEST 7: ngx.exit(0) -  yield
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 7:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -520,6 +531,8 @@ should never reached here
+ 
+ 
+ === TEST 8: ngx.exit(ngx.ERROR) - yield
++wolfSSL reports a failed certificate callback with its own error text, not OpenSSL's "cert cb error".
++--- skip_eval: 8:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -581,6 +594,8 @@ should never reached here
+ 
+ 
+ === TEST 9: lua exception - no yield
++wolfSSL reports a failed certificate callback with its own error text, not OpenSSL's "cert cb error".
++--- skip_eval: 9:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -641,6 +656,8 @@ should never reached here
+ 
+ 
+ === TEST 10: lua exception - yield
++wolfSSL reports a failed certificate callback with its own error text, not OpenSSL's "cert cb error".
++--- skip_eval: 8:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen 127.0.0.2:$TEST_NGINX_RAND_PORT_1 ssl;
+@@ -753,6 +770,8 @@ get_phase: ssl_cert
+ 
+ 
+ === TEST 12: connection aborted prematurely
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 6:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -975,6 +994,8 @@ lua ssl server name: "test.com"
+ 
+ 
+ === TEST 15: simple user thread wait with yielding
++wolfSSL's certificate callback cannot suspend the handshake, so yielding in ssl_certificate_by_lua* fails the handshake.
++--- skip_eval: 5:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+diff --git a/bundle/ngx_stream_lua-0.0.19rc4/t/140-ssl-c-api.t b/bundle/ngx_stream_lua-0.0.19rc4/t/140-ssl-c-api.t
+index 4f775b5..e98567f 100644
+--- a/bundle/ngx_stream_lua-0.0.19rc4/t/140-ssl-c-api.t
++++ b/bundle/ngx_stream_lua-0.0.19rc4/t/140-ssl-c-api.t
+@@ -6,6 +6,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    $ENV{TEST_NGINX_USE_WOLFSSL} = 1;
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
+     plan(skip_all => "too old OpenSSL, need >= 1.0.2e, was $1");
+@@ -760,6 +763,8 @@ client certificate subject: emailAddress=agentzh@gmail.com,CN=test.com
+ 
+ 
+ === TEST 7: verify client without CA certificates
++wolfSSL's certificate verify error text differs from OpenSSL's.
++--- skip_eval: 5:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1381,6 +1386,8 @@ SUCCESS
+ 
+ 
+ === TEST 14: Get supported ciphers
++nginx's "SSL: TLSv1.2, cipher:" debug log line needs SSL_CIPHER_description(), which wolfSSL does not provide.
++--- skip_eval: 5:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
+@@ -1512,6 +1519,8 @@ with_filter:
+ 
+ 
+ === TEST 16: SSL cipher API error handling (no SSL)
++nginx's "SSL: TLSv1.2, cipher:" debug log line needs SSL_CIPHER_description(), which wolfSSL does not provide.
++--- skip_eval: 4:$ENV{TEST_NGINX_USE_WOLFSSL}
+ --- stream_config
+     server {
+         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock;
+diff --git a/bundle/ngx_stream_lua-0.0.19rc4/t/162-ssl-client-hello-by.t b/bundle/ngx_stream_lua-0.0.19rc4/t/162-ssl-client-hello-by.t
+index 8c6bcf6..120f0c0 100644
+--- a/bundle/ngx_stream_lua-0.0.19rc4/t/162-ssl-client-hello-by.t
++++ b/bundle/ngx_stream_lua-0.0.19rc4/t/162-ssl-client-hello-by.t
+@@ -6,6 +6,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "ssl_client_hello_by_lua* needs SSL_CTX_set_client_hello_cb, not available with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need >= 1.1.1, was $1");
+diff --git a/bundle/ngx_stream_lua-0.0.19rc4/t/163-ssl-two-verification.t b/bundle/ngx_stream_lua-0.0.19rc4/t/163-ssl-two-verification.t
+index 394a43c..7cc502b 100644
+--- a/bundle/ngx_stream_lua-0.0.19rc4/t/163-ssl-two-verification.t
++++ b/bundle/ngx_stream_lua-0.0.19rc4/t/163-ssl-two-verification.t
+@@ -7,6 +7,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "ssl_client_hello_by_lua* needs SSL_CTX_set_client_hello_cb, not available with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
+     plan(skip_all => "too old OpenSSL, need >= 1.1.1, was $1");
+diff --git a/bundle/ngx_stream_lua-0.0.19rc4/t/164-proxy-ssl-verify-by.t b/bundle/ngx_stream_lua-0.0.19rc4/t/164-proxy-ssl-verify-by.t
+index 8436b6b..e382571 100644
+--- a/bundle/ngx_stream_lua-0.0.19rc4/t/164-proxy-ssl-verify-by.t
++++ b/bundle/ngx_stream_lua-0.0.19rc4/t/164-proxy-ssl-verify-by.t
+@@ -6,6 +6,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "proxy_ssl_verify_by_lua* needs SSL_set_retry_verify, not available with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (\d+)\.(\d+)\.(\d+)/) {
+     my ($major, $minor, $patch) = ($1, $2, $3);
+diff --git a/bundle/ngx_stream_lua-0.0.19rc4/t/165-proxy-ssl-cert-by.t b/bundle/ngx_stream_lua-0.0.19rc4/t/165-proxy-ssl-cert-by.t
+index d8a56a6..484dada 100644
+--- a/bundle/ngx_stream_lua-0.0.19rc4/t/165-proxy-ssl-cert-by.t
++++ b/bundle/ngx_stream_lua-0.0.19rc4/t/165-proxy-ssl-cert-by.t
+@@ -6,6 +6,9 @@ repeat_each(3);
+ # All these tests need to have new openssl
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "proxy_ssl_certificate_by_lua* is not built with wolfSSL");
++}
+ 
+ if ($openssl_version =~ m/built with OpenSSL (0|1\.0\.(?:0|1[^\d]|2[a-d]).*)/) {
+     plan(skip_all => "too old OpenSSL, need >= 1.0.2e, was $1");
+diff --git a/bundle/ngx_stream_lua-0.0.19rc4/t/171-ssl-trusted-store.t b/bundle/ngx_stream_lua-0.0.19rc4/t/171-ssl-trusted-store.t
+index 4e9863c..d284e40 100644
+--- a/bundle/ngx_stream_lua-0.0.19rc4/t/171-ssl-trusted-store.t
++++ b/bundle/ngx_stream_lua-0.0.19rc4/t/171-ssl-trusted-store.t
+@@ -6,10 +6,13 @@ use File::Basename;
+ 
+ repeat_each(2);
+ 
+-plan tests => repeat_each() * (blocks() * 5);
+-
+ my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
+ my $openssl_version = eval { `$NginxBinary -V 2>&1` };
++if ($openssl_version =~ m/built with wolfSSL/) {
++    plan(skip_all => "FFI calls into libcrypto symbols that wolfSSL does not export");
++}
++
++plan tests => repeat_each() * (blocks() * 5);
+ 
+ if ($openssl_version =~ m/\bBoringSSL\b/) {
+     $ENV{TEST_NGINX_BORINGSSL} = 1;
diff --git a/openresty/1.31.1.1.patch b/openresty/1.31.1.1.patch
new file mode 100644
index 000000000..6ac65720e
--- /dev/null
+++ b/openresty/1.31.1.1.patch
@@ -0,0 +1,485 @@
+From e2cefbdb8f58e0453b8b3b2699bc19216ad4e710 Mon Sep 17 00:00:00 2001
+From: Juliusz Sosinowicz <juliusz@wolfssl.com>
+Date: Wed, 16 Sep 2026 15:40:12 +0000
+Subject: [PATCH] Compile with wolfSSL
+
+---
+ .../lua-resty-core-0.1.34rc3/lib/ngx/ssl.lua  |   7 +-
+ bundle/nginx-wolfssl.patch                    | 332 ++++++++++++++++++
+ .../src/ngx_http_lua_ssl_certby.c             |   8 +
+ .../src/ngx_stream_lua_module.c               |   4 +-
+ .../src/ngx_stream_lua_ssl_certby.c           |   8 +
+ configure                                     |  14 +-
+ 6 files changed, 370 insertions(+), 3 deletions(-)
+ create mode 100644 bundle/nginx-wolfssl.patch
+
+diff --git a/bundle/lua-resty-core-0.1.34rc3/lib/ngx/ssl.lua b/bundle/lua-resty-core-0.1.34rc3/lib/ngx/ssl.lua
+index 027ab8a..b39b46e 100644
+--- a/bundle/lua-resty-core-0.1.34rc3/lib/ngx/ssl.lua
++++ b/bundle/lua-resty-core-0.1.34rc3/lib/ngx/ssl.lua
+@@ -53,6 +53,7 @@ local ngx_lua_ffi_req_shared_ssl_ciphers
+ ffi.cdef[[
+ typedef struct SSL SSL;
+ int SSL_session_reused(const SSL *ssl);
++int wolfSSL_session_reused(const SSL *ssl);
+ ]]
+ 
+ if subsystem == 'http' then
+@@ -664,7 +665,11 @@ function _M.ssl_session_reused(ssl)
+         return nil, "bad ssl"
+     end
+ 
+-    local reused = C.SSL_session_reused(ssl)
++    local ok, reused = pcall(function() return C.SSL_session_reused(ssl) end)
++    if not ok then
++        -- wolfSSL exports the prefixed name only
++        reused = C.wolfSSL_session_reused(ssl)
++    end
+     return tonumber(reused) == 1 and true or false
+ end
+ 
+diff --git a/bundle/nginx-wolfssl.patch b/bundle/nginx-wolfssl.patch
+new file mode 100644
+index 0000000..baedb7e
+--- /dev/null
++++ b/bundle/nginx-wolfssl.patch
+@@ -0,0 +1,332 @@
++diff --git a/auto/lib/openssl/conf b/auto/lib/openssl/conf
++index 3068cae..9ac125e 100644
++--- a/auto/lib/openssl/conf
+++++ b/auto/lib/openssl/conf
++@@ -65,8 +65,39 @@ else
++         ngx_feature_path=
++         ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL $NGX_LIBPTHREAD"
++         ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
+++
+++        if [ $WOLFSSL != NONE ]; then
+++            ngx_feature="wolfSSL library in $WOLFSSL"
+++            ngx_feature_path="$WOLFSSL/include/wolfssl $WOLFSSL/include"
+++            ngx_feature_incs="
+++            #ifndef WOLFSSL_USER_SETTINGS
+++                #include <wolfssl/options.h>
+++            #endif
+++            #include <wolfssl/wolfcrypt/settings.h>
+++            #include <openssl/ssl.h>"
+++
+++            if [ $NGX_RPATH = YES ]; then
+++                ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+++            else
+++                ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+++            fi
+++
+++            CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl"
+++            CFLAGS="$CFLAGS -DWOLFSSL_NGINX"
+++        fi
+++
++         . auto/feature
++ 
+++        if [ $WOLFSSL != NONE -a $ngx_found = no ]; then
+++cat << END
+++
+++$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl.
+++SSL modules require the wolfSSL library.
+++
+++END
+++            exit 1
+++        fi
+++
++         if [ $ngx_found = no ]; then
++ 
++             # FreeBSD port
++diff --git a/auto/options b/auto/options
++index 0f8bb96..19edec4 100644
++--- a/auto/options
+++++ b/auto/options
++@@ -159,6 +159,7 @@ PCRE2=YES
++ USE_OPENSSL=NO
++ USE_OPENSSL_QUIC=NO
++ OPENSSL=NONE
+++WOLFSSL=NONE
++ 
++ USE_ZLIB=NO
++ ZLIB=NONE
++@@ -388,6 +389,7 @@ use the \"--with-mail_ssl_module\" option instead"
++         --with-pcre-jit)                 PCRE_JIT=YES               ;;
++         --without-pcre2)                 PCRE2=DISABLED             ;;
++ 
+++        --with-wolfssl=*)                WOLFSSL="$value"           ;;
++         --with-openssl=*)                OPENSSL="$value"           ;;
++         --with-openssl-opt=*)            OPENSSL_OPT="$value"       ;;
++ 
++@@ -626,6 +628,7 @@ cat << END
++   --with-libatomic                   force libatomic_ops library usage
++   --with-libatomic=DIR               set path to libatomic_ops library sources
++ 
+++  --with-wolfssl=DIR                 set path to wolfSSL headers and library
++   --with-openssl=DIR                 set path to OpenSSL library sources
++   --with-openssl-opt=OPTIONS         set additional build options for OpenSSL
++ 
++diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
++index e0ca592..9e527f2 100644
++--- a/src/event/ngx_event_openssl.c
+++++ b/src/event/ngx_event_openssl.c
++@@ -211,6 +211,14 @@ ngx_ssl_init(ngx_log_t *log)
++ 
++ #endif
++ 
+++#ifdef WOLFSSL_NGINX
+++   /* Run all casts on initialization with these FIPS versions to avoid
+++    * threaded competition when running them ad hoc */
+++   #if FIPS_VERSION3_GE(5,2,1) && !FIPS_VERSION3_GE(6,0,0)
+++      wc_RunAllCast_fips();
+++   #endif
+++#endif
+++
++ #ifndef SSL_OP_NO_COMPRESSION
++     {
++     /*
++@@ -290,6 +298,7 @@ ngx_ssl_init(ngx_log_t *log)
++         return NGX_ERROR;
++     }
++ 
+++#ifndef WOLFSSL_NGINX
++     ngx_ssl_client_hello_arg_index = SSL_CTX_get_ex_new_index(0, NULL, NULL,
++                                                               NULL, NULL);
++     if (ngx_ssl_client_hello_arg_index == -1) {
++@@ -297,6 +306,7 @@ ngx_ssl_init(ngx_log_t *log)
++                       "SSL_CTX_get_ex_new_index() failed");
++         return NGX_ERROR;
++     }
+++#endif
++ 
++     return NGX_OK;
++ }
++@@ -401,6 +411,8 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
++     }
++ #endif
++ 
+++#ifndef WOLFSSL_NGINX
+++    /* These override the options set above. No need to call this. */
++ #ifdef SSL_CTX_set_min_proto_version
++     SSL_CTX_set_min_proto_version(ssl->ctx, 0);
++     SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_2_VERSION);
++@@ -410,6 +422,7 @@ ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)
++     SSL_CTX_set_min_proto_version(ssl->ctx, 0);
++     SSL_CTX_set_max_proto_version(ssl->ctx, TLS1_3_VERSION);
++ #endif
+++#endif
++ 
++ #ifdef SSL_OP_NO_COMPRESSION
++     SSL_CTX_set_options(ssl->ctx, SSL_OP_NO_COMPRESSION);
++@@ -663,6 +676,12 @@ retry:
++ 
++     x509 = sk_X509_shift(chain);
++ 
+++#ifdef WOLFSSL_NGINX
+++    /* Remove current chain */
+++    if (sk_X509_NAME_num(chain) > 0)
+++        wolfSSL_UnloadCertsKeys(c->ssl->connection);
+++#endif
+++
++     if (SSL_use_certificate(c->ssl->connection, x509) == 0) {
++         ngx_ssl_error(NGX_LOG_ERR, c->log, 0,
++                       "SSL_use_certificate(\"%s\") failed", cert->data);
++@@ -674,7 +693,9 @@ retry:
++     X509_free(x509);
++ 
++ #ifdef SSL_set0_chain
++-
+++#ifdef WOLFSSL_NGINX
+++#error If SSL_set0_chain is defined then reset this function
+++#endif
++     /*
++      * SSL_set0_chain() is only available in OpenSSL 1.0.2+,
++      * but this function is only called via certificate callback,
++@@ -687,7 +708,19 @@ retry:
++         sk_X509_pop_free(chain, X509_free);
++         return NGX_ERROR;
++     }
++-
+++#endif
+++#ifdef WOLFSSL_NGINX
+++    {
+++        int i;
+++        for (i = sk_X509_num(chain) - 1; i > 0; i--) {
+++            if (wolfSSL_add0_chain_cert(c->ssl->connection,
+++                    sk_X509_value(chain, i)) == 0) {
+++                sk_X509_pop_free(chain, X509_free);
+++                return NGX_ERROR;
+++            }
+++        }
+++        sk_X509_pop_free(chain, X509_free);
+++    }
++ #endif
++ 
++     pkey = ngx_ssl_cache_connection_fetch(cache, pool,
++@@ -3893,6 +3926,27 @@ ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
++     int         n;
++     ngx_uint_t  level;
++ 
+++#ifdef WOLFSSL_NGINX
+++    WOLFSSL_ALERT_HISTORY h;
+++
+++    if (c && c->ssl && c->ssl->connection) {
+++        wolfSSL_get_alert_history(c->ssl->connection, &h);
+++        if (h.last_rx.level == alert_warning || h.last_rx.level == alert_fatal ||
+++            h.last_tx.level == alert_warning || h.last_tx.level == alert_fatal) {
+++            const char *rx_code, *rx_lvl, *tx_code, *tx_lvl;
+++            rx_lvl = ((h.last_rx.level == alert_fatal) ? "fatal" : ((h.last_rx.level == alert_warning) ? "warning" : "none"));
+++            tx_lvl = ((h.last_tx.level == alert_fatal) ? "fatal" : ((h.last_tx.level == alert_warning) ? "warning" : "none"));
+++            rx_code = wolfSSL_alert_desc_string_long(h.last_rx.code);
+++            tx_code = wolfSSL_alert_desc_string_long(h.last_tx.code);
+++            if (!rx_code) rx_code = "none";
+++            if (!tx_code) tx_code = "none";
+++            ngx_log_error(NGX_LOG_CRIT, c->log, 0,
+++                        "%s (RX alert: level=%s,code=%s, TX alert: level=%s,code=%s)",
+++                        text, rx_lvl, rx_code, tx_lvl, tx_code);
+++        }
+++    }
+++#endif
+++
++     level = NGX_LOG_CRIT;
++ 
++     if (sslerr == SSL_ERROR_SYSCALL) {
++@@ -4095,8 +4149,20 @@ ngx_ssl_connection_error(ngx_connection_t *c, int sslerr, ngx_err_t err,
++ #ifdef SSL_R_BAD_RECORD_TYPE
++             || n == SSL_R_BAD_RECORD_TYPE                            /*  443 */
++ #endif
+++#ifdef SSL_AD_REASON_OFFSET
++             || (n >= SSL_AD_REASON_OFFSET                            /* 1000 */
++                 && n <= SSL_AD_REASON_OFFSET + 255)
+++#else
+++#ifdef SSL_R_SSLV3_ALERT_BAD_CERTIFICATE
+++            || n == SSL_R_SSLV3_ALERT_BAD_CERTIFICATE
+++#endif
+++#ifdef SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN
+++            || n == SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN
+++#endif
+++#ifdef SSL_R_TLSV1_ALERT_UNKNOWN_CA
+++            || n == SSL_R_TLSV1_ALERT_UNKNOWN_CA
+++#endif
+++#endif
++             )
++         {
++             switch (c->log_error) {
++@@ -5091,7 +5157,8 @@ ngx_ssl_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
++             return -1;
++         }
++ 
++-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+++    (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
++         if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
++             ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
++             return -1;
++@@ -5134,7 +5201,8 @@ ngx_ssl_ticket_key_callback(ngx_ssl_conn_t *ssl_conn,
++             size = 32;
++         }
++ 
++-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+++    (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
++         if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
++             ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
++             return -1;
++@@ -5655,6 +5723,14 @@ ngx_ssl_get_curve(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
++ 
++ #endif
++ 
+++#ifdef WOLFSSL_NGINX
+++    s->data = (u_char*)wolfSSL_get_curve_name(c->ssl->connection);
+++    if (s->data != NULL) {
+++        s->len = ngx_strlen(s->data);
+++        return NGX_OK;
+++    }
+++#endif
+++
++     s->len = 0;
++     return NGX_OK;
++ }
++diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
++index 40f9183..ad66732 100644
++--- a/src/event/ngx_event_openssl.h
+++++ b/src/event/ngx_event_openssl.h
++@@ -14,6 +14,17 @@
++ 
++ #define OPENSSL_SUPPRESS_DEPRECATED
++ 
+++#ifdef WOLFSSL_NGINX
+++#ifdef HAVE_CONFIG_H
+++    #include <config.h>
+++#endif
+++
+++#ifndef WOLFSSL_USER_SETTINGS
+++    #include <wolfssl/options.h>
+++#endif
+++#include <wolfssl/wolfcrypt/settings.h>
+++#include <openssl/pem.h>
+++#endif
++ #include <openssl/ssl.h>
++ #include <openssl/err.h>
++ #include <openssl/bn.h>
++@@ -67,7 +78,7 @@
++ #endif
++ 
++ 
++-#if (OPENSSL_VERSION_NUMBER < 0x1010000fL)
+++#if (OPENSSL_VERSION_NUMBER < 0x1010000fL && !defined WOLFSSL_NGINX)
++ #define ASN1_STRING_get0_data(x)     (x)->data
++ #endif
++ 
++diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
++index 43fcafd..6071374 100644
++--- a/src/http/modules/ngx_http_ssl_module.c
+++++ b/src/http/modules/ngx_http_ssl_module.c
++@@ -18,7 +18,11 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
++     ngx_pool_t *pool, ngx_str_t *s);
++ 
++ 
+++#ifndef WOLFSSL_NGINX
++ #define NGX_DEFAULT_CIPHERS     "HIGH:!aNULL:!MD5"
+++#else
+++#define NGX_DEFAULT_CIPHERS     "ALL"
+++#endif
++ #define NGX_DEFAULT_ECDH_CURVE  "auto"
++ 
++ #define NGX_HTTP_ALPN_PROTOS    "\x08http/1.1\x08http/1.0\x08http/0.9"
++diff --git a/src/mail/ngx_mail_ssl_module.c b/src/mail/ngx_mail_ssl_module.c
++index 079d0e7..c0319d4 100644
++--- a/src/mail/ngx_mail_ssl_module.c
+++++ b/src/mail/ngx_mail_ssl_module.c
++@@ -10,7 +10,11 @@
++ #include <ngx_mail.h>
++ 
++ 
+++#ifndef WOLFSSL_NGINX
++ #define NGX_DEFAULT_CIPHERS     "HIGH:!aNULL:!MD5"
+++#else
+++#define NGX_DEFAULT_CIPHERS     "ALL"
+++#endif
++ #define NGX_DEFAULT_ECDH_CURVE  "auto"
++ 
++ 
++diff --git a/src/stream/ngx_stream_ssl_module.c b/src/stream/ngx_stream_ssl_module.c
++index 0e17cff..9c3a037 100644
++--- a/src/stream/ngx_stream_ssl_module.c
+++++ b/src/stream/ngx_stream_ssl_module.c
++@@ -14,7 +14,11 @@ typedef ngx_int_t (*ngx_ssl_variable_handler_pt)(ngx_connection_t *c,
++     ngx_pool_t *pool, ngx_str_t *s);
++ 
++ 
+++#ifndef WOLFSSL_NGINX
++ #define NGX_DEFAULT_CIPHERS     "HIGH:!aNULL:!MD5"
+++#else
+++#define NGX_DEFAULT_CIPHERS     "ALL"
+++#endif
++ #define NGX_DEFAULT_ECDH_CURVE  "auto"
++ 
++ 
+diff --git a/bundle/ngx_lua-0.10.31rc5/src/ngx_http_lua_ssl_certby.c b/bundle/ngx_lua-0.10.31rc5/src/ngx_http_lua_ssl_certby.c
+index ac2bd9a..11015aa 100644
+--- a/bundle/ngx_lua-0.10.31rc5/src/ngx_http_lua_ssl_certby.c
++++ b/bundle/ngx_lua-0.10.31rc5/src/ngx_http_lua_ssl_certby.c
+@@ -350,7 +350,15 @@ ngx_http_lua_ssl_cert_handler(ngx_ssl_conn_t *ssl_conn, void *data)
+ 
+     *cctx->cleanup = ngx_http_lua_ssl_cert_aborted;
+ 
++#ifdef WOLFSSL_NGINX
++    ngx_log_error(NGX_LOG_CRIT, c->log, 0,
++                  "lua: cannot yield in cert cb: "
++                  "missing async cert cb support in wolfSSL");
++
++    /* fall through to the "failed" label below */
++#else
+     return -1;
++#endif
+ 
+ failed:
+ 
+diff --git a/bundle/ngx_stream_lua-0.0.19rc4/src/ngx_stream_lua_module.c b/bundle/ngx_stream_lua-0.0.19rc4/src/ngx_stream_lua_module.c
+index 772e8c5..070ecb7 100644
+--- a/bundle/ngx_stream_lua-0.0.19rc4/src/ngx_stream_lua_module.c
++++ b/bundle/ngx_stream_lua-0.0.19rc4/src/ngx_stream_lua_module.c
+@@ -921,10 +921,12 @@ ngx_stream_lua_create_srv_conf(ngx_conf_t *cf)
+ 
+     conf->log_socket_errors = NGX_CONF_UNSET;
+ 
+-#ifdef HAVE_LUA_PROXY_SSL
++#if (NGX_STREAM_SSL)
+     conf->ssl_verify_depth = NGX_CONF_UNSET_UINT;
+     conf->ssl_certificates = NGX_CONF_UNSET_PTR;
+     conf->ssl_certificate_keys = NGX_CONF_UNSET_PTR;
++#endif
++#ifdef HAVE_LUA_PROXY_SSL
+     conf->ups.upstream_skip_openssl_default_verify = NGX_CONF_UNSET;
+ #endif
+ 
+diff --git a/bundle/ngx_stream_lua-0.0.19rc4/src/ngx_stream_lua_ssl_certby.c b/bundle/ngx_stream_lua-0.0.19rc4/src/ngx_stream_lua_ssl_certby.c
+index d25a32d..6a9dfe2 100644
+--- a/bundle/ngx_stream_lua-0.0.19rc4/src/ngx_stream_lua_ssl_certby.c
++++ b/bundle/ngx_stream_lua-0.0.19rc4/src/ngx_stream_lua_ssl_certby.c
+@@ -351,7 +351,15 @@ ngx_stream_lua_ssl_cert_handler(ngx_ssl_conn_t *ssl_conn, void *data)
+ 
+     *cctx->cleanup = ngx_stream_lua_ssl_cert_aborted;
+ 
++#ifdef WOLFSSL_NGINX
++    ngx_log_error(NGX_LOG_CRIT, c->log, 0,
++                  "lua: cannot yield in cert cb: "
++                  "missing async cert cb support in wolfSSL");
++
++    /* fall through to the "failed" label below */
++#else
+     return -1;
++#endif
+ 
+ #if 1
+ failed:
+diff --git a/configure b/configure
+index 5f8a119..fc7b6e7 100755
+--- a/configure
++++ b/configure
+@@ -344,7 +344,7 @@ for my $opt (@ARGV) {
+         my $mod_path = File::Spec->rel2abs($1);
+         push @ngx_opts, "--add-dynamic-module=$mod_path";
+ 
+-    } elsif ($opt =~ /^--with-(openssl|pcre|zlib|libatomic|md5|sha1)=(.*)/) {
++    } elsif ($opt =~ /^--with-(wolfssl|openssl|pcre|zlib|libatomic|md5|sha1)=(.*)/) {
+ 
+         my ($lib, $path) = ($1, $2);
+         if ($lib eq 'openssl' && $OS eq 'darwin') {
+@@ -353,6 +353,9 @@ for my $opt (@ARGV) {
+                 push @extra_make_env, 'KERNEL_BITS=64';
+             }
+         }
++        if ($lib eq 'wolfssl') {
++            $resty_opts{wolfssl} = 1;
++        }
+         $path = File::Spec->rel2abs($path);
+         push @ngx_opts, "--with-$lib=$path";
+         $with_ext_lib{$lib} = 1;
+@@ -652,6 +655,13 @@ _END_
+         shell "patch -p0 < nginx-no_pool.patch";
+     }
+ 
++    if ($opts->{wolfssl}) {
++        $ngx_dir = auto_complete "nginx";
++        cd $ngx_dir;
++        shell "patch -p1 < ../nginx-wolfssl.patch";
++        cd '..';
++    }
++
+     if (my $drizzle_prefix = $opts->{libdrizzle}) {
+         my $drizzle_lib = "$drizzle_prefix/lib";
+         env LIBDRIZZLE_LIB => $drizzle_lib;
+@@ -1536,6 +1546,8 @@ Options directly inherited from nginx
+   --with-openssl=DIR                 set path to OpenSSL library sources
+   --with-openssl-opt=OPTIONS         set additional build options for OpenSSL
+ 
++  --with-wolfssl=DIR                 set path to wolfSSL library sources
++
+   --dry-run                          dry running the configure, for testing only
+   --platform=PLATFORM                forcibly specify a platform name, for testing only
+ _EOC_
+-- 
+2.43.0
+
diff --git a/openresty/README.md b/openresty/README.md
index 2f7a51e47..1db46bb00 100644
--- a/openresty/README.md
+++ b/openresty/README.md
@@ -10,6 +10,8 @@ Patch the `configure` script to link against wolfSSL instead of OpenSSL. In the
 patch -p1 < <version>.patch
 ```
 Patches for the following versions are available in this directory:
+* 1.31.1.1
+* 1.25.3.1
 * 1.19.9.1
 * 1.19.3.1
 * 1.13.6.2
@@ -27,14 +29,51 @@ make install
 make
 ```
 
+# Known limitations with wolfSSL (1.31.1.1)
+The following features need OpenSSL APIs that wolfSSL does not provide. They fail at configuration time or return an error; the rest of `ngx.ssl` works.
+* `ssl_client_hello_by_lua*` (needs the OpenSSL 1.1.1 ClientHello callback API).
+* `proxy_ssl_certificate_by_lua*` and `proxy_ssl_verify_by_lua*` (need OpenSSL 3.0.2 `SSL_set_retry_verify()`).
+* Yielding (cosockets, sleeps) inside `ssl_session_fetch_by_lua*`. The handler runs synchronously because wolfSSL has no equivalent of OpenResty's OpenSSL `sess_set_get_cb_yield` patch.
+* `lua_ssl_key_log`, `ngx.ssl.get_shared_ssl_ciphers()` and `ngx.ssl.export_keying_material*()` report "OpenSSL too old" because wolfSSL advertises OpenSSL 1.1.0 compatibility.
+* Lua libraries that load OpenSSL symbols through FFI (`lua-resty-string`, `lua-resty-rsa`, `lua-resty-openssl`). wolfSSL only exports `wolfSSL_`-prefixed symbols.
+* `ngx.ssl.set_der_cert()` with a certificate chain needs a wolfSSL release newer than 5.9.2 (`d2i_X509_bio()` fix). With older releases use `ngx.ssl.parse_pem_cert()` and `ngx.ssl.set_cert()` instead.
+* Yielding (cosockets, sleeps, `ngx.thread.wait()`, semaphores) inside `ssl_certificate_by_lua*`. wolfSSL's certificate callback cannot suspend the handshake, so the port fails the handshake and logs `lua: cannot yield in cert cb` at `[crit]` instead of hanging. Load certificates synchronously, for example from a `lua_shared_dict` filled by a timer.
+* `ngx.ocsp.validate_ocsp_response()` on a response without `nextUpdate` needs a wolfSSL release newer than 5.9.2.
+* With wolfSSL 5.9.2 and older, `ssl_session_fetch_by_lua*` also runs when the client resumes with a session ticket. Newer releases skip it for ticket resumptions unless `ssl_early_data` is on, as OpenSSL does.
+* HTTP/3 (`--with-http_v3_module`).
+* Cosocket clients do not request TLS 1.2 session tickets (a wolfSSL client only does after `wolfSSL_UseSessionTicket()`), so their resumptions use session IDs and run `ssl_session_fetch_by_lua*` on the server.
+
+# Running the bundled tests
+The Test::Nginx suites of the bundled modules (`ngx_lua`, `ngx_stream_lua`, `lua-resty-core`) check the `nginx -V` banner and expect an OpenSSL build. `<version>-tests.patch` (1.31.1.1 only) makes them run against a wolfSSL build:
+* `built with wolfSSL` in the banner sets `TEST_NGINX_USE_WOLFSSL=1`.
+* Files that need the APIs listed above skip as a whole (`plan(skip_all => ...)`). Blocks that check OpenSSL-specific log text, cipher descriptions or APIs, or that yield inside `ssl_certificate_by_lua*`, skip with `--- skip_eval: N:$ENV{TEST_NGINX_USE_WOLFSSL}` and a comment naming the reason.
+* The expected `Server` header is `openresty`, because the bundle and not a plain nginx serves the tests.
+
+Apply it after the port patch and build with `--with-debug`, because the tests read the debug log. Run `prove` from the module directory:
+```
+patch -p1 < <version>-tests.patch
+./configure --with-wolfssl=/usr/local --with-debug && make && make install
+cd bundle/ngx_lua-*
+TEST_NGINX_BINARY=/usr/local/openresty/nginx/sbin/nginx prove -I. t/139-ssl-cert-by.t
+```
+`lua-resty-core` needs its sibling directory named `lua-resty-lrucache`, some blocks need memcached on `TEST_NGINX_MEMCACHED_PORT` (11211) with UDP enabled (`memcached -U 11211`), and the unix socket paths under `t/servroot` must stay short. Do not set `TEST_NGINX_NO_CLEAN`, it leaves nginx running. wolfSSL's `.github/workflows/openresty.yml` runs the SSL test files in CI.
+
 # Developer notes
 When porting to a new version of OpenResty, you need to copy the appropriate Nginx patch from the wolfssl-nginx repo and rename it to `nginx-wolfssl.patch`. The patch file should be placed in the `bundle` directory.
 ```
 cp <path/to/wolfssl/nginx/patch> bundle/nginx-wolfssl.patch
 ```
+If wolfssl-nginx has no patch for the bundled nginx version, rebase the newest one. The nginx 1.31.1 patch inside `1.31.1.1.patch` was rebased from `nginx-1.28.1-wolfssl.patch`. The patch must apply cleanly against the nginx sources in `bundle/`, which carry OpenResty's own changes.
+
+`1.31.1.1.patch` also initialises the `lua_ssl_*` defaults of `ngx_stream_lua` 0.0.19rc4, which the module only does when its proxy SSL support is compiled in. Without it every `lua_ssl_verify_depth` in a `stream` block fails as a duplicate directive.
 
 Patches are generated with the following command:
 ```
 git format-patch -1
 ```
 
+The tests patch is a plain diff of the `t/` directories. Extract the tarball, apply `<version>.patch`, commit the tree in a scratch git repo, edit `bundle/*/t/*.t` and run:
+```
+git diff -- 'bundle/*/t/*' > <version>-tests.patch
+```
+
diff --git a/openresty/modules/encrypted-session-nginx-module/README.md b/openresty/modules/encrypted-session-nginx-module/README.md
index 05a016f43..ff104b4ff 100644
--- a/openresty/modules/encrypted-session-nginx-module/README.md
+++ b/openresty/modules/encrypted-session-nginx-module/README.md
@@ -1,8 +1,9 @@
 # Overview
 
 This is a patch for [encrypted-session-nginx-module](https://github.com/openresty/encrypted-session-nginx-module)
-version 0.08. It's intended to be used with nginx/OpenResty built with wolfSSL
-FIPS. The patch makes it so that SHA-256 will be used for digests instead of
+version 0.08. It also applies unchanged to version 0.09, which is bundled with
+OpenResty 1.31.1.1. It's intended to be used with nginx/OpenResty built with
+wolfSSL FIPS. The patch makes it so that SHA-256 will be used for digests instead of
 MD5, which isn't a FIPS-compliant algorithm.
 
 # Building