diff --git a/.fmf/version b/.fmf/version
new file mode 100644
index 0000000..d00491f
--- /dev/null
+++ b/.fmf/version
@@ -0,0 +1 @@
+1
diff --git a/Net-SSLeay-1.90-openssl3.0.0-tests-disable_TLS1_and_TLS1_1.patch b/Net-SSLeay-1.90-openssl3.0.0-tests-disable_TLS1_and_TLS1_1.patch
new file mode 100644
index 0000000..53c45dc
--- /dev/null
+++ b/Net-SSLeay-1.90-openssl3.0.0-tests-disable_TLS1_and_TLS1_1.patch
@@ -0,0 +1,37 @@
+diff -up Net-SSLeay-1.94/t/local/44_sess.t.orig Net-SSLeay-1.94/t/local/44_sess.t
+--- Net-SSLeay-1.94/t/local/44_sess.t.orig	2024-06-17 15:55:57.760001634 +0200
++++ Net-SSLeay-1.94/t/local/44_sess.t	2024-06-17 15:57:33.333795022 +0200
+@@ -15,13 +15,13 @@ use English qw( $EVAL_ERROR $OSNAME $PER
+ if (not can_fork()) {
+     plan skip_all => "fork() not supported on this system";
+ } else {
+-    plan tests => 67;
++    plan tests => 39;
+ }
+ 
+ initialise_libssl();
+ 
+ my @rounds = qw(
+-    TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 TLSv1.3-num-tickets-ssl
++    TLSv1.2 TLSv1.3 TLSv1.3-num-tickets-ssl
+     TLSv1.3-num-tickets-ctx-6 TLSv1.3-num-tickets-ctx-0
+ );
+ 
+diff -up Net-SSLeay-1.94/t/local/45_exporter.t.orig Net-SSLeay-1.94/t/local/45_exporter.t
+--- Net-SSLeay-1.94/t/local/45_exporter.t.orig	2024-06-17 15:57:56.945991033 +0200
++++ Net-SSLeay-1.94/t/local/45_exporter.t	2024-06-17 16:00:55.358499773 +0200
+@@ -16,12 +16,12 @@ if (not can_fork()) {
+ } elsif (!defined &Net::SSLeay::export_keying_material) {
+     plan skip_all => "No export_keying_material()";
+ } else {
+-    plan tests => 37;
++    plan tests => 19;
+ }
+ 
+ initialise_libssl();
+ 
+-my @rounds = qw( TLSv1 TLSv1.1 TLSv1.2 TLSv1.3 );
++my @rounds = qw( TLSv1.2 TLSv1.3 );
+ 
+ my %usable =
+     map {
diff --git a/gating.yaml b/gating.yaml
new file mode 100644
index 0000000..3f29218
--- /dev/null
+++ b/gating.yaml
@@ -0,0 +1,8 @@
+--- !Policy
+product_versions:
+  - rhel-10
+decision_context: osci_compose_gate
+rules:
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/sanity.functional}
+  - !PassingTestCaseRule {test_case_name: osci.brew-build./plans/public.functional}
+
diff --git a/perl-Net-SSLeay.spec b/perl-Net-SSLeay.spec
index ca05a35..1898584 100644
--- a/perl-Net-SSLeay.spec
+++ b/perl-Net-SSLeay.spec
@@ -6,12 +6,13 @@
 
 Name:		perl-Net-SSLeay
 Version:	1.94
-Release:	3%{?dist}
+Release:	4%{?dist}
 Summary:	Perl extension for using OpenSSL
 License:	Artistic-2.0
 URL:		https://metacpan.org/release/Net-SSLeay
 Source0:	https://cpan.metacpan.org/modules/by-module/Net/Net-SSLeay-%{version}.tar.gz
 Patch10:	Net-SSLeay-1.90-pkgconfig.patch
+Patch11:	Net-SSLeay-1.90-openssl3.0.0-tests-disable_TLS1_and_TLS1_1.patch
 # =========== Module Build ===========================
 BuildRequires:	coreutils
 BuildRequires:	findutils
@@ -28,6 +29,7 @@ BuildRequires:	perl(ExtUtils::MakeMaker) >= 6.76
 BuildRequires:	perl(ExtUtils::PkgConfig)
 BuildRequires:	perl(ExtUtils::MM)
 BuildRequires:	perl(File::Basename)
+BuildRequires:	perl(File::Path)
 BuildRequires:	perl(File::Spec::Functions)
 BuildRequires:	perl(Symbol)
 BuildRequires:	perl(Text::Wrap)
@@ -73,6 +75,11 @@ Requires:	perl(XSLoader)
 # Don't "provide" private Perl libs or the redundant unversioned perl(Net::SSLeay) provide
 %global __provides_exclude ^(perl\\(Net::SSLeay\\)$|SSLeay\\.so)
 
+# Filter modules bundled for tests
+%global __provides_exclude_from %{?__provides_exclude_from:%__provides_exclude_from|}^%{_libexecdir}
+%global __requires_exclude %{?__requires_exclude:%__requires_exclude|}^perl\\(Test::Net::SSLeay.*\\)
+%global __requires_exclude %{__requires_exclude}|^perl\\(Net::PcapWriter\\)
+
 %description
 This module offers some high level convenience functions for accessing
 web pages on SSL servers (for symmetry, same API is offered for
@@ -80,6 +87,15 @@ accessing http servers, too), a sslcat() function for writing your own
 clients, and finally access to the SSL API of SSLeay/OpenSSL package
 so you can write servers or clients for more complicated applications.
 
+%package tests
+Summary:        Tests for %{name}
+Requires:       %{name} = %{?epoch:%{epoch}:}%{version}-%{release}
+Requires:       perl-Test-Harness
+
+%description tests
+Tests from %{name}. Execute them
+with "%{_libexecdir}/%{name}/test".
+
 %prep
 %setup -q -n Net-SSLeay-%{version}
 
@@ -87,16 +103,25 @@ so you can write servers or clients for more complicated applications.
 # https://github.com/radiator-software/p5-net-ssleay/pull/127
 %patch -P 10
 
+# Disable TLS1 and TLS1_1 from tests
+%patch -P 11 -p1
+
 # Fix permissions in examples to avoid bogus doc-file dependencies
 chmod -c 644 examples/*
 
+# Help generators to recognize Perl scripts
+for F in `find t -name *.t -o -name *.pl`; do
+    perl -i -MConfig -ple 'print $Config{startperl} if $. == 1 && !s{\A#!.*perl\b}{$Config{startperl}}' "$F"
+    chmod +x "$F"
+done
+
 %build
 unset OPENSSL_PREFIX
 PERL_MM_USE_DEFAULT=1 perl Makefile.PL \
 	INSTALLDIRS=vendor \
 	NO_PACKLIST=1 \
 	NO_PERLLOCAL=1 \
-	OPTIMIZE="%{optflags}" < /dev/null
+	OPTIMIZE="%{optflags} -DOPENSSL_NO_ENGINE" < /dev/null
 %{make_build}
 
 %install
@@ -107,9 +132,23 @@ find %{buildroot} -type f -name '*.bs' -empty -delete
 # Remove script we don't want packaged
 rm -f %{buildroot}%{perl_vendorarch}/Net/ptrtstrun.pl
 
+# Install tests
+mkdir -p %{buildroot}%{_libexecdir}/%{name}
+cp -a t inc %{buildroot}%{_libexecdir}/%{name}
+rm %{buildroot}%{_libexecdir}/%{name}/t/external/ocsp.t
+rm %{buildroot}%{_libexecdir}/%{name}/t/local/kwalitee.t
+rm %{buildroot}%{_libexecdir}/%{name}/t/local/02_pod_coverage.t
+
+cat > %{buildroot}%{_libexecdir}/%{name}/test << 'EOF'
+#!/bin/sh
+unset RELEASE_TESTING
+cd %{_libexecdir}/%{name} && exec prove -I . -r -j "$(getconf _NPROCESSORS_ONLN)"
+EOF
+chmod +x %{buildroot}%{_libexecdir}/%{name}/test
+
 %check
 unset RELEASE_TESTING
-make test
+OPENSSL_ENABLE_SHA1_SIGNATURES=1 make test
 
 %files
 %license LICENSE
@@ -122,7 +161,14 @@ make test
 %{_mandir}/man3/Net::SSLeay.3*
 %{_mandir}/man3/Net::SSLeay::Handle.3*
 
+%files tests
+%{_libexecdir}/%{name}
+
 %changelog
+* Tue Jul 02 2024 Jitka Plesnikova <jplesnik@redhat.com> - 1.94-4
+- Resolves: RHEL-33744 - Stop using OpenSSL ENGINE API
+- Package tests
+
 * Thu Jan 25 2024 Fedora Release Engineering <releng@fedoraproject.org> - 1.94-3
 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild
 
diff --git a/plans/internal.fmf b/plans/internal.fmf
new file mode 100644
index 0000000..74b95cd
--- /dev/null
+++ b/plans/internal.fmf
@@ -0,0 +1,12 @@
+summary: Private (RHEL) beakerlib tests
+enabled: false
+adjust:
+  - when: distro == rhel
+    enabled: true
+    because: private tests are accesible only within rhel pipline
+discover:
+  - name: rhel
+    how: fmf
+    url: https://pkgs.devel.redhat.com/git/tests/perl-Net-SSLeay
+execute:
+    how: tmt
diff --git a/plans/sanity.fmf b/plans/sanity.fmf
new file mode 100644
index 0000000..a72ded4
--- /dev/null
+++ b/plans/sanity.fmf
@@ -0,0 +1,5 @@
+summary: Sanity tests
+discover:
+    how: fmf
+execute:
+    how: tmt
diff --git a/tests/upstream-tests.fmf b/tests/upstream-tests.fmf
new file mode 100644
index 0000000..519f92b
--- /dev/null
+++ b/tests/upstream-tests.fmf
@@ -0,0 +1,12 @@
+summary: Upstream tests
+contact: Jitka Plesnikova <jplesnik@redhat.com>
+component: perl-Net-SSLeay
+require: perl-Net-SSLeay-tests
+test: /usr/libexec/perl-Net-SSLeay/test
+enabled: true
+tag:
+  - rhel-buildroot
+adjust:
+  - enabled: false
+    when: distro < rhel-9 or distro < centos-stream-9
+    continue: false