diff --git a/Net-SSLeay-1.90-openssl3.0.0-32_x509_get_cert_info.patch b/Net-SSLeay-1.90-openssl3.0.0-32_x509_get_cert_info.patch
new file mode 100644
index 0000000..7292928
--- /dev/null
+++ b/Net-SSLeay-1.90-openssl3.0.0-32_x509_get_cert_info.patch
@@ -0,0 +1,12 @@
+diff -ru Net-SSLeay-1.90.orig/t/local/32_x509_get_cert_info.t Net-SSLeay-1.90/t/local/32_x509_get_cert_info.t
+--- Net-SSLeay-1.90.orig/t/local/32_x509_get_cert_info.t	2020-11-18 10:12:44.000000000 +0100
++++ Net-SSLeay-1.90/t/local/32_x509_get_cert_info.t	2021-06-02 00:37:27.881748999 +0200
+@@ -190,7 +190,7 @@
+                           Net::SSLeay::SSLeay < 0x30000000
+                           || (
+                                   Net::SSLeay::SSLeay == 0x30000000
+-                               && Net::SSLeay::SSLeay_version( Net::SSLeay::SSLEAY_VERSION() ) =~ /-alpha1/
++                               && Net::SSLeay::SSLeay_version( Net::SSLeay::SSLEAY_VERSION() ) =~ /-alpha1\ /
+                           )
+                       )
+                   ) {
diff --git a/Net-SSLeay-1.90-openssl3.0.0-33_x509_create_cert.patch b/Net-SSLeay-1.90-openssl3.0.0-33_x509_create_cert.patch
new file mode 100644
index 0000000..3c653fa
--- /dev/null
+++ b/Net-SSLeay-1.90-openssl3.0.0-33_x509_create_cert.patch
@@ -0,0 +1,12 @@
+diff -ru Net-SSLeay-1.90.orig/SSLeay.xs Net-SSLeay-1.90/SSLeay.xs
+--- Net-SSLeay-1.90.orig/SSLeay.xs	2021-01-21 16:14:11.000000000 +0100
++++ Net-SSLeay-1.90/SSLeay.xs	2021-06-02 01:47:55.724962156 +0200
+@@ -4556,7 +4556,7 @@
+             if (passwd_len>0) {
+                 /* encrypted key */
+                 if (!enc_alg)
+-                    PEM_write_bio_PrivateKey(bp,pk,EVP_des_cbc(),(unsigned char *)passwd,passwd_len,cb,u);
++                    PEM_write_bio_PrivateKey(bp,pk,EVP_des_ede(),(unsigned char *)passwd,passwd_len,cb,u);
+                 else
+                     PEM_write_bio_PrivateKey(bp,pk,enc_alg,(unsigned char *)passwd,passwd_len,cb,u);
+             }
diff --git a/Net-SSLeay-1.90-openssl3.0.0-39_pkcs12.patch b/Net-SSLeay-1.90-openssl3.0.0-39_pkcs12.patch
new file mode 100644
index 0000000..67cc775
--- /dev/null
+++ b/Net-SSLeay-1.90-openssl3.0.0-39_pkcs12.patch
@@ -0,0 +1,38 @@
+diff -ru Net-SSLeay-1.90.orig/t/local/39_pkcs12.t Net-SSLeay-1.90/t/local/39_pkcs12.t
+--- Net-SSLeay-1.90.orig/t/local/39_pkcs12.t	2020-11-18 10:12:44.000000000 +0100
++++ Net-SSLeay-1.90/t/local/39_pkcs12.t	2021-06-04 10:34:00.190276286 +0200
+@@ -3,7 +3,7 @@
+ use Net::SSLeay;
+ use Test::Net::SSLeay qw( data_file_path initialise_libssl );
+ 
+-plan tests => 19;
++plan tests => 18;
+ 
+ initialise_libssl();
+ 
+@@ -38,11 +38,20 @@
+   is(Net::SSLeay::X509_NAME_oneline($subj_name), '/C=PL/O=Net-SSLeay/OU=Test Suite/CN=simple-cert.net-ssleay.example', "X509_NAME_oneline [2/1]");
+   like(Net::SSLeay::X509_NAME_oneline($ca1_subj_name), qr/C=.*CN=.*/, "X509_NAME_oneline [2/2]");
+   like(Net::SSLeay::X509_NAME_oneline($ca2_subj_name), qr/C=.*CN=.*/, "X509_NAME_oneline [2/3]");
+-  SKIP: {
+-    skip("cert order in CA chain is different in openssl pre-1.0.0", 2) unless Net::SSLeay::SSLeay >= 0x01000000;
+-    is(Net::SSLeay::X509_NAME_oneline($ca1_subj_name), '/C=PL/O=Net-SSLeay/OU=Test Suite/CN=Root CA', "X509_NAME_oneline [2/4]");
+-    is(Net::SSLeay::X509_NAME_oneline($ca2_subj_name), '/C=PL/O=Net-SSLeay/OU=Test Suite/CN=Intermediate CA', "X509_NAME_oneline [2/5]");
+-  }
++
++  # Different order in CA chain in some versions (e.g. openssl pre-1.0.0, openssl 3.0.0 alpha17)
++  my @x509_ascii_names = sort { $a cmp $b } (
++    Net::SSLeay::X509_NAME_oneline($ca1_subj_name),
++    Net::SSLeay::X509_NAME_oneline($ca2_subj_name),
++  );
++  is_deeply(
++    \@x509_ascii_names,
++    [
++      '/C=PL/O=Net-SSLeay/OU=Test Suite/CN=Intermediate CA',
++      '/C=PL/O=Net-SSLeay/OU=Test Suite/CN=Root CA',
++    ],
++    'X509_NAME_oneline [2/4]',
++  );
+ }
+ 
+ {
diff --git a/Net-SSLeay-1.90-openssl3.0.0-43_misc_functions.patch b/Net-SSLeay-1.90-openssl3.0.0-43_misc_functions.patch
new file mode 100644
index 0000000..2b5679c
--- /dev/null
+++ b/Net-SSLeay-1.90-openssl3.0.0-43_misc_functions.patch
@@ -0,0 +1,42 @@
+diff -ru Net-SSLeay-1.90.orig/t/local/43_misc_functions.t Net-SSLeay-1.90/t/local/43_misc_functions.t
+--- Net-SSLeay-1.90.orig/t/local/43_misc_functions.t	2021-01-21 16:14:11.000000000 +0100
++++ Net-SSLeay-1.90/t/local/43_misc_functions.t	2021-06-04 17:30:29.508947419 +0200
+@@ -245,6 +245,20 @@
+ 
+     my $ciphersuites = join(':', keys(%tls_1_3_aead_cipher_to_keyblock_size));
+ 
++    # In OpenSSL 3.0.0 alpha 11 (commit c1e8a0c66e32b4144fdeb49bd5ff7acb76df72b9) was
++    # changed api of set_ciphersuites to ignore unknown ciphers.
++    my $ret_partially_bad_ciphersuites;
++    my $ssleay_version = Net::SSLeay::SSLeay_version( Net::SSLeay::SSLEAY_VERSION() );
++    my $openssl_alpha_version;
++    if (Net::SSLeay::SSLeay == 0x30000000 && $ssleay_version =~ /-alpha(\d+)\ /) {
++	$openssl_alpha_version = $1;
++    }
++    if (Net::SSLeay::SSLeay >= 0x30000000 && defined $openssl_alpha_version && $openssl_alpha_version > 10) {
++	$ret_partially_bad_ciphersuites = 1;
++    } else {
++	$ret_partially_bad_ciphersuites = 0;
++    }
++
+     my ($ctx, $rv, $ssl);
+     $ctx = Net::SSLeay::CTX_new();
+     $rv = Net::SSLeay::CTX_set_ciphersuites($ctx, $ciphersuites);
+@@ -257,7 +271,7 @@
+     };
+     is($rv, 1, 'CTX set undef ciphersuites');
+     $rv = Net::SSLeay::CTX_set_ciphersuites($ctx, 'nosuchthing:' . $ciphersuites);
+-    is($rv, 0, 'CTX set partially bad ciphersuites');
++    is($rv, $ret_partially_bad_ciphersuites, 'CTX set partially bad ciphersuites');
+     $rv = Net::SSLeay::CTX_set_ciphersuites($ctx, 'nosuchthing:');
+     is($rv, 0, 'CTX set bad ciphersuites');
+ 
+@@ -272,7 +286,7 @@
+     };
+     is($rv, 1, 'SSL set undef ciphersuites');
+     $rv = Net::SSLeay::set_ciphersuites($ssl, 'nosuchthing:' . $ciphersuites);
+-    is($rv, 0, 'SSL set partially bad ciphersuites');
++    is($rv, $ret_partially_bad_ciphersuites, 'SSL set partially bad ciphersuites');
+     $rv = Net::SSLeay::set_ciphersuites($ssl, 'nosuchthing:');
+     is($rv, 0, 'SSL set bad ciphersuites');
+ 
diff --git a/Net-SSLeay-1.90-openssl3.0.0-tests-disable_TLS1_and_TLS1_1.patch b/Net-SSLeay-1.90-openssl3.0.0-tests-disable_TLS1_and_TLS1_1.patch
new file mode 100644
index 0000000..8cc220c
--- /dev/null
+++ b/Net-SSLeay-1.90-openssl3.0.0-tests-disable_TLS1_and_TLS1_1.patch
@@ -0,0 +1,37 @@
+diff -ru Net-SSLeay-1.90.orig/t/local/44_sess.t Net-SSLeay-1.90/t/local/44_sess.t
+--- Net-SSLeay-1.90.orig/t/local/44_sess.t	2020-12-12 14:55:23.000000000 +0100
++++ Net-SSLeay-1.90/t/local/44_sess.t	2021-06-04 18:50:09.733150048 +0200
+@@ -13,13 +13,13 @@
+ if (not can_fork()) {
+     plan skip_all => "fork() not supported on this system";
+ } else {
+-    plan tests => 58;
++    plan tests => 34;
+ }
+ 
+ initialise_libssl();
+ 
+ my @rounds = qw(
+-    TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 TLSv1.3-num-tickets-ssl
++    TLSv1.2 TLSv1.3 TLSv1.3-num-tickets-ssl
+     TLSv1.3-num-tickets-ctx-6 TLSv1.3-num-tickets-ctx-0
+ );
+ 
+diff -ru Net-SSLeay-1.90.orig/t/local/45_exporter.t Net-SSLeay-1.90/t/local/45_exporter.t
+--- Net-SSLeay-1.90.orig/t/local/45_exporter.t	2020-12-12 14:55:23.000000000 +0100
++++ Net-SSLeay-1.90/t/local/45_exporter.t	2021-06-04 18:50:13.931192784 +0200
+@@ -15,12 +15,12 @@
+ } elsif (!defined &Net::SSLeay::export_keying_material) {
+     plan skip_all => "No export_keying_material()";
+ } else {
+-    plan tests => 36;
++    plan tests => 18;
+ }
+ 
+ initialise_libssl();
+ 
+-my @rounds = qw( TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 );
++my @rounds = qw( TLSv1.2 TLSv1.3 );
+ 
+ my %usable =
+     map {
diff --git a/perl-Net-SSLeay.spec b/perl-Net-SSLeay.spec
index b6e217f..fa5fe88 100644
--- a/perl-Net-SSLeay.spec
+++ b/perl-Net-SSLeay.spec
@@ -6,12 +6,17 @@
 
 Name:		perl-Net-SSLeay
 Version:	1.90
-Release:	3%{?dist}
+Release:	4%{?dist}
 Summary:	Perl extension for using OpenSSL
 License:	Artistic 2.0
 URL:		https://metacpan.org/release/Net-SSLeay
 Source0:	https://cpan.metacpan.org/modules/by-module/Net/Net-SSLeay-%{version}.tar.gz
 Patch10:	Net-SSLeay-1.90-pkgconfig.patch
+Patch11:        Net-SSLeay-1.90-openssl3.0.0-32_x509_get_cert_info.patch
+Patch12:        Net-SSLeay-1.90-openssl3.0.0-33_x509_create_cert.patch
+Patch13:        Net-SSLeay-1.90-openssl3.0.0-39_pkcs12.patch
+Patch14:        Net-SSLeay-1.90-openssl3.0.0-43_misc_functions.patch
+Patch15:        Net-SSLeay-1.90-openssl3.0.0-tests-disable_TLS1_and_TLS1_1.patch
 # =========== Module Build ===========================
 BuildRequires:	coreutils
 BuildRequires:	findutils
@@ -81,6 +86,21 @@ so you can write servers or clients for more complicated applications.
 # https://github.com/radiator-software/p5-net-ssleay/pull/127
 %patch10
 
+# https://github.com/radiator-software/p5-net-ssleay/pull/271
+%patch11 -p1
+
+# https://github.com/radiator-software/p5-net-ssleay/issues/272
+%patch12 -p1
+
+# https://github.com/radiator-software/p5-net-ssleay/pull/274
+%patch13 -p1
+
+# https://github.com/radiator-software/p5-net-ssleay/pull/275
+%patch14 -p1
+
+# XXX Disable TLS1 and TLS1_1 from tests
+%patch15 -p1
+
 # Fix permissions in examples to avoid bogus doc-file dependencies
 chmod -c 644 examples/*
 
@@ -117,6 +137,15 @@ make test
 %{_mandir}/man3/Net::SSLeay::Handle.3*
 
 %changelog
+* Fri Jun 04 2021 Michal Josef Špaček <mspacek@redhat.com> - 1.90-4
+- Fix tests for openssl 3.0.0-alpha16. rhbz#1964854
+  - Fix check across alpha1 vs alpha17
+  - Change default alg for PEM_get_string_PrivateKey()
+  - Different order in CA chain in some versions
+  - Changed API of CTX_set_ciphersuites() and set_ciphersuites(), ignore
+    unknown ciphers
+  - Disable TLSv1 and TLSv1_1 usage in test
+
 * Fri Apr 16 2021 Mohan Boddu <mboddu@redhat.com> - 1.90-3
 - Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937