IBM · KostasTsiounis · May 20, 2026 · Aug 6, 2026 · Aug 6, 2026
diff --git a/.github/workflows/github-actions.yml b/.github/workflows/github-actions.yml
@@ -82,6 +82,16 @@ jobs:
           java-version: '27-ea'
           distribution: 'temurin'
           architecture: 'x64'
+      - name: Install OpenSSL Headers
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y libssl-dev
+          mkdir ${{ github.workspace }}/openssl
+          cd ${{ github.workspace }}/openssl
+          mkdir ${{ github.workspace }}/openssl/include
+          cd ${{ github.workspace }}/openssl/include
+          cp /usr/include/openssl/* .
+          cp /usr/include/x86_64-linux-gnu/openssl/* .
       # Uncomment to capture all files in the runner for debugging purposes.          
       # - name: List Files In Entire Runner
       #   run: |
@@ -91,6 +101,7 @@ jobs:
           mvn
           --batch-mode
           '-Dock.library.path=${{ github.workspace }}/OCK/'
+          '-Dopenssl.library.path=/usr/lib/x86_64-linux-gnu/'
           -Dtest='
           ibm.jceplus.junit.openjceplus.TestAll,
           ibm.jceplus.junit.TestMemStressAll,
@@ -100,11 +111,14 @@ jobs:
           install
         env:
           GSKIT_HOME: ${{ github.workspace }}/OCK/jgsk_sdk
+          OPENSSL_HOME: ${{ github.workspace }}/openssl
+          OPENSSL_LIB_LOCATION: /usr/lib/x86_64-linux-gnu/
       - name: Execute Migrated Maven Install Target And OpenJCEPlus Provider Tests
         run: > 
           mvn
           --batch-mode
           '-Dock.library.path=${{ github.workspace }}/OCK/'
+          '-Dopenssl.library.path=/usr/lib/x86_64-linux-gnu/'
           '-Dgroups=OpenJCEPlus'
           -Dtest='
           ibm.jceplus.junit.suites.TestOpenJCEPlus,

diff --git a/.gitignore b/.gitignore
@@ -41,6 +41,8 @@
 /src/main/native/ock/closed_Utils_c.h
 /src/main/native/ock/com_ibm_crypto_plus_provider_base_*.h
 /src/main/native/ock/com_ibm_crypto_plus_provider_ock_*.h
+/src/main/native/openssl/com_ibm_crypto_plus_provider_base_*.h
+/src/main/native/openssl/com_ibm_crypto_plus_provider_openssl_*.h
 
 # Files generated by tests.
 /0Test*.txt

diff --git a/Jenkinsfile b/Jenkinsfile
@@ -24,6 +24,7 @@ import groovy.transform.Field;
 @Field JAVA_RELEASE
 @Field OCK_RELEASE
 @Field OCK_FULL_URL
+@Field OPENSSL_RELEASE
 @Field EXECUTE_TESTS
 @Field SPECIFIC_TEST
 @Field PARALLEL_ITERATIONS
@@ -191,7 +192,7 @@ def archive(platform, iteration) {
     def specs = []
     def spec = ["pattern": "$fileLocation/$filename",
                 "target": "$directory/$filename",
-                "props": "java_release=$JAVA_RELEASE;ock_release=$OCK_RELEASE;repo=$repo;branch=$branch"]
+                "props": "java_release=$JAVA_RELEASE;ock_release=$OCK_RELEASE;openssl_release=$OPENSSL_RELEASE;repo=$repo;branch=$branch"]
     specs.add(spec)
 
     def uploadFiles = [files : specs]
@@ -276,9 +277,11 @@ def run(platform) {
                     echo "Binaries fetched"
                     externalLibrary.getMaven(software)
                     echo "Maven fetched"
+                    externalLibrary.getOpenSSL(hardware, software)
+                    echo "OpenSSL cloned"
                     def command = "install"
                     command += getTestFlag(hardware, software)
-                    externalLibrary.runOpenJCEPlus(command, software)
+                    externalLibrary.runOpenJCEPlus(command, hardware, software)
                     echo "OpenJCEPlus built"
                 } finally {
                     iteration++
@@ -382,6 +385,12 @@ pipeline {
             This parameter can be used if one wants to specify the full URL from which to get OCK.<br> \
             BEWARE: This can only be used with a single platform and it overrides OCK_RELEASE. \
         ')
+        string(name: 'OPENSSL_RELEASE', defaultValue: '', description: '\
+            Indicate the specific release of OpenSSL that you want to use to build your branch.<br> \
+            If left empty, the latest release will be used.<br> \
+            Specify the full name of the release.<br> \
+            (i.e., openssl-&ltopenssl version&gt => eg., openssl-3.6.3) \
+        ')
         separator(name: "TestOptions", sectionHeader: "Test Options",
             separatorStyle: "border-width: 0",
             sectionHeaderStyle: """
@@ -461,6 +470,7 @@ pipeline {
                         JAVA_RELEASE="${params.JAVA_RELEASE}"
                         OCK_RELEASE="${params.OCK_RELEASE}"
                         OCK_FULL_URL="${params.OCK_FULL_URL}"
+                        OPENSSL_RELEASE="${params.OPENSSL_RELEASE}"
                         EXECUTE_TESTS="${params.EXECUTE_TESTS}"
                         SPECIFIC_TEST="${params.SPECIFIC_TEST}"
                         PARALLEL_ITERATIONS="${params.PARALLEL_ITERATIONS}"

diff --git a/JenkinsfilePerformance b/JenkinsfilePerformance
@@ -239,7 +239,7 @@ def run(platform) {
 
                     if (!allowedProviders.isEmpty()) {
                         def command = "clean install -DskipTests -Djmh.benchmark.skip=false -Djmh.benchmark=" + BENCHMARK + " -Djmh.allowedProviders=" + allowedProviders.join(",")
-                        externalLibrary.runOpenJCEPlus(command, software)
+                        externalLibrary.runOpenJCEPlus(command, hardware, software)
                         echo "OpenJCEPlus built"
                     } else {
                         echo "No providers specified. Nothing to run."

diff --git a/buildNative.sh b/buildNative.sh
@@ -24,6 +24,12 @@ if [ -z "$GSKIT_HOME" ];
   exit;
 fi
 
+if [ -z "$OPENSSL_HOME" ];
+  then
+  echo "Error: OPENSSL_HOME is not defined or is empty";
+  exit;
+fi
+
 if [ -z "$PLATFORM" ];
   then
   echo "Error: PLATFORM is not defined or is empty";
@@ -56,3 +62,8 @@ cd src/main/native/ock
 
 ${make} -f jgskit.mak clean
 ${make} -f jgskit.mak
+
+cd ../openssl
+
+make -f openjceplus.mak clean
+make -f openjceplus.mak
diff --git a/buildNativeMac.sh b/buildNativeMac.sh
@@ -22,7 +22,18 @@ if [ -z "$GSKIT_HOME" ];
   exit;
 fi
 
+if [ -z "$OPENSSL_HOME" ];
+  then
+  echo "Error: OPENSSL_HOME is not defined or is empty";
+  exit;
+fi
+
 cd src/main/native/ock
 
 make -f jgskit.mac.mak clean
-make -f jgskit.mac.mak
+make -f jgskit.mac.mak
+
+cd ../openssl
+
+make -f openjceplus.mac.mak clean
+make -f openjceplus.mac.mak
diff --git a/buildNativeWin64.bat b/buildNativeWin64.bat
@@ -19,6 +19,10 @@ IF NOT DEFINED GSKIT_HOME (
 	echo "GSKIT_HOME must be set"
 	goto :eof
 )
+IF NOT DEFINED OPENSSL_HOME (
+	echo "OPENSSL_HOME must be set"
+	goto :eof
+)
 
 :: This check for the presence of the VCVARS_64_SCRIPT was commented out since the github
 :: action being used calls the equivilant of the vcvars64.bat file prior to 
@@ -36,4 +40,9 @@ cd src/main/native/ock
 @call nmake -nologo -f jgskit.win64.cygwin.mak clean
 @call nmake -nologo -f jgskit.win64.cygwin.mak
 
+cd ../openssl
+
+@call nmake -nologo -f openjceplus.win64.cygwin.mak clean
+@call nmake -nologo -f openjceplus.win64.cygwin.mak
+
 @endlocal
diff --git a/pom.xml b/pom.xml
@@ -19,7 +19,7 @@
         <maven.build.timestamp.format>yyyyMMdd</maven.build.timestamp.format>
         <jmh.benchmark>ibm.jceplus.jmh.RunAll</jmh.benchmark>
         <jmh.benchmark.skip>true</jmh.benchmark.skip>
-        <consoleOutputReporter.disable>true</consoleOutputReporter.disable>
+        <consoleOutputReporter.disable>false</consoleOutputReporter.disable>
     </properties>
         <profiles>
           <profile>
@@ -34,6 +34,7 @@
                 <build.native.file>${basedir}/buildNative.sh</build.native.file>
                 <build.platform.value>arm-linux64</build.platform.value>
                 <build.target.jgskitlib.dir>${project.basedir}/target/jgskit-xr-64/</build.target.jgskitlib.dir>
+                <build.target.ojplib.dir>${project.basedir}/target/ojp-xr-64/</build.target.ojplib.dir>
             </properties>
           </profile>
           <profile>
@@ -48,6 +49,7 @@
                 <build.native.file>${basedir}/buildNative.sh</build.native.file>
                 <build.platform.value>x86-linux64</build.platform.value>
                 <build.target.jgskitlib.dir>${project.basedir}/target/jgskit-xa-64/</build.target.jgskitlib.dir>
+                <build.target.ojplib.dir>${project.basedir}/target/ojp-xa-64/</build.target.ojplib.dir>
             </properties>
           </profile>
           <profile>
@@ -121,6 +123,7 @@
                 <build.native.file>${basedir}/buildNative.sh</build.native.file>
                 <build.platform.value>s390-linux64</build.platform.value>
                 <build.target.jgskitlib.dir>${project.basedir}/target/jgskit-xz-64/</build.target.jgskitlib.dir>
+                <build.target.ojplib.dir>${project.basedir}/target/ojp-xz-64/</build.target.ojplib.dir>
             </properties>
           </profile>
           <profile>
@@ -135,6 +138,7 @@
                 <build.native.file>${basedir}/buildNative.sh</build.native.file>
                 <build.platform.value>ppcle-linux64</build.platform.value>
                 <build.target.jgskitlib.dir>${project.basedir}/target/jgskit-xl-64/</build.target.jgskitlib.dir>
+                <build.target.ojplib.dir>${project.basedir}/target/ojp-xl-64/</build.target.ojplib.dir>
             </properties>
           </profile>
           <profile>
@@ -149,6 +153,7 @@
                 <build.native.file>${basedir}/buildNativeWin64.bat</build.native.file>
                 <build.platform.value>win</build.platform.value>
                 <build.target.jgskitlib.dir>${project.basedir}\target\buildwin\host64\</build.target.jgskitlib.dir>
+                <build.target.ojplib.dir>${project.basedir}\target\buildwin\ojp-host64\</build.target.ojplib.dir>
             </properties>
           </profile>
           <profile>
@@ -163,6 +168,7 @@
                 <build.native.file>${basedir}/buildNative.sh</build.native.file>
                 <build.platform.value>ppc-aix64</build.platform.value>
                 <build.target.jgskitlib.dir>${project.basedir}/target/jgskit-ap-64/</build.target.jgskitlib.dir>
+                <build.target.ojplib.dir>${project.basedir}/target/ojp-ap-64/</build.target.ojplib.dir>
             </properties>
           </profile>
           <profile>
@@ -177,6 +183,7 @@
                 <build.native.file>${basedir}/buildNativeMac.sh</build.native.file>
                 <build.platform.value>aarch64-mac</build.platform.value>
                 <build.target.jgskitlib.dir>${project.basedir}/target/jgskit-aarch64-mac/</build.target.jgskitlib.dir>
+                <build.target.ojplib.dir>${project.basedir}/target/ojp-aarch64-mac/</build.target.ojplib.dir>
             </properties>
           </profile>
           <profile>
@@ -191,6 +198,7 @@
                 <build.native.file>${basedir}/buildNativeMac.sh</build.native.file>
                 <build.platform.value>x86_64-mac</build.platform.value>
                 <build.target.jgskitlib.dir>${project.basedir}/target/jgskit-x86_64-mac/</build.target.jgskitlib.dir>
+                <build.target.ojplib.dir>${project.basedir}/target/ojp-x86_64-mac/</build.target.ojplib.dir>
             </properties>
           </profile>
           <profile>
@@ -279,6 +287,7 @@
                     <groups>${groups}</groups>
                     <systemPropertyVariables>
                       <jgskit.library.path>${build.target.jgskitlib.dir}</jgskit.library.path>
+                      <openjceplus.library.path>${build.target.ojplib.dir}</openjceplus.library.path>
                     </systemPropertyVariables>
                     <includes>
                       <include>
@@ -354,10 +363,18 @@
                               <key>ock.library.path</key>
                               <value>${ock.library.path}</value>
                             </systemProperty>
+                            <systemProperty>
+                              <key>openssl.library.path</key>
+                              <value>${openssl.library.path}</value>
+                            </systemProperty>
                             <systemProperty>
                               <key>jgskit.library.path</key>
                               <value>${build.target.jgskitlib.dir}</value>
                             </systemProperty>
+                            <systemProperty>
+                              <key>openjceplus.library.path</key>
+                              <value>${build.target.ojplib.dir}</value>
+                            </systemProperty>
                             <systemProperty>
                               <key>java.io.tmpdir</key>
                               <value>.</value>

diff --git a/src/main/java/com/ibm/crypto/plus/provider/base/Digest.java b/src/main/java/com/ibm/crypto/plus/provider/base/Digest.java
@@ -10,6 +10,8 @@
 
 import com.ibm.crypto.plus.provider.OpenJCEPlusProvider;
 import com.ibm.crypto.plus.provider.PrimitiveWrapper;
+import java.util.HashMap;
+import java.util.Map;
 import java.util.concurrent.ConcurrentLinkedQueue;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -43,11 +45,9 @@ public final class Digest implements Cloneable {
     final static int numShaAlgos = 5;
     private static final String DIGEST_CONTEXT_CACHE_SIZE = "com.ibm.crypto.provider.DigestContextCacheSize";
 
-    private static boolean needsInit = true;
+    private static final Map<NativeInterface, ConcurrentLinkedQueueLong[]> contextsPerBackend = new HashMap<>();
 
-    static private ConcurrentLinkedQueueLong contexts[];
-
-    static private int runtimeContextNum[];
+    private static final Map<NativeInterface, Integer[]> runtimeContextNumPerBackend = new HashMap<>();
 
     class ConcurrentLinkedQueueLong extends ConcurrentLinkedQueue<Long> {
         private static final long serialVersionUID = 196745693267521676L;
@@ -70,17 +70,21 @@ class ConcurrentLinkedQueueLong extends ConcurrentLinkedQueue<Long> {
     }
 
     void getContext() throws NativeException {
-        if (needsInit) {
+        ConcurrentLinkedQueueLong[] contexts = contextsPerBackend.get(this.nativeInterface);
+        Integer[] runtimeContextNum = runtimeContextNumPerBackend.get(this.nativeInterface);
+        if (contexts == null) {
             synchronized (Digest.class) {
-                if (needsInit) {
+                contexts = contextsPerBackend.get(this.nativeInterface);
+                if (contexts == null) {
                     contexts = new ConcurrentLinkedQueueLong[numShaAlgos];
-                    runtimeContextNum = new int[numShaAlgos];
+                    runtimeContextNum = new Integer[numShaAlgos];
 
                     for (int i = 0; i < numShaAlgos; i++) {
                         contexts[i] = new ConcurrentLinkedQueueLong();
                         runtimeContextNum[i] = 0;
                     }
-                    needsInit = false;
+                    contextsPerBackend.put(this.nativeInterface, contexts);
+                    runtimeContextNumPerBackend.put(this.nativeInterface, runtimeContextNum);
                 }
             }
         }
@@ -399,7 +403,7 @@ private Runnable cleanOCKResources(long digestId, int algIndx, boolean contextFr
                         if (needsReinit.getValue()) {
                             nativeInterface.DIGEST_reset(digestId);
                         }
-                        Digest.contexts[algIndx].add(digestId);
+                        Digest.contextsPerBackend.get(nativeInterface)[algIndx].add(digestId);
                     } else {
                         nativeInterface.DIGEST_delete(digestId);
                     }

diff --git a/src/main/java/com/ibm/crypto/plus/provider/base/NativeCryptoSelector.java b/src/main/java/com/ibm/crypto/plus/provider/base/NativeCryptoSelector.java
@@ -11,7 +11,9 @@
 import com.ibm.crypto.plus.provider.OpenJCEPlusProvider;
 import com.ibm.crypto.plus.provider.ock.NativeOCKAdapterFIPS;
 import com.ibm.crypto.plus.provider.ock.NativeOCKAdapterNonFIPS;
+import com.ibm.crypto.plus.provider.openssl.NativeOpenSSLAdapterNonFIPS;
 import java.security.Provider;
+import java.security.ProviderException;
 import sun.security.util.Debug;
 
 /**
@@ -64,7 +66,11 @@ private static NativeInterface getBackend(Backend backend, boolean isFIPS) {
                 return ockBackend;
             }
         } else if (backend == Backend.OPENSSL) {
-            return opensslBackend;
+            if (isFIPS) {
+                throw new ProviderException("FIPS not supported through OpenSSL.");
+            } else {
+                return NativeOpenSSLAdapterNonFIPS.getInstance();
+            }
         }
         return null;
     }

diff --git a/src/main/java/com/ibm/crypto/plus/provider/base/NativeException.java b/src/main/java/com/ibm/crypto/plus/provider/base/NativeException.java
@@ -24,8 +24,6 @@ public class NativeException extends java.lang.Exception {
     protected int code = -1; // Non-specific value designed to be overriden.
 
     // These codes must be overriden by library-specific native exceptions.
-    public static final int GKR_FIPS_MODE_INVALID = -1;
-    public static final int GKR_OCK_ATTACH_FAILED = -1;
     public static final int GKR_DECRYPT_FINAL_BAD_PADDING_ERROR = -1;
     public static final int GKR_UNSPECIFIED = -1;