diff --git a/configure.py b/configure.py
index a879a9661d65f7..0df9fc8f675524 100755
--- a/configure.py
+++ b/configure.py
@@ -201,6 +201,12 @@
     default=None,
     help='specifies that the OpenSSL library is FIPS compatible')
 
+parser.add_argument('--openssl-legacy-module',
+    action='store_true',
+    dest='openssl_legacy_module',
+    default=None,
+    help='specifies that the OpenSSL legacy module is to be built')
+
 parser.add_argument('--openssl-use-def-ca-store',
     action='store_true',
     dest='use_openssl_ca_store',
@@ -1410,6 +1416,7 @@ def configure_openssl(o):
   variables['node_shared_nghttp3'] = b(options.shared_nghttp3)
   variables['openssl_is_fips'] = b(options.openssl_is_fips)
   variables['node_fipsinstall'] = b(False)
+  variables['node_openssl_legacy_module'] = b(False)
 
   if options.openssl_no_asm:
     variables['openssl_no_asm'] = 1
@@ -1466,6 +1473,9 @@ def without_ssl_error(option):
     o['defines'] += ['OPENSSL_FIPS']
     variables['node_fipsinstall'] = b(True)
 
+  if options.openssl_legacy_module and not options.shared_openssl:
+    variables['node_openssl_legacy_module'] = b(True)
+
   if options.shared_openssl:
     has_quic = getsharedopensslhasquic.get_has_quic(options.__dict__['shared_openssl_includes'])
   else:
diff --git a/deps/openssl/config/generate_gypi.pl b/deps/openssl/config/generate_gypi.pl
index 99352b4027b4fc..acf5c118eee797 100755
--- a/deps/openssl/config/generate_gypi.pl
+++ b/deps/openssl/config/generate_gypi.pl
@@ -50,7 +50,8 @@
 my $progs = "apps/progs.h";
 my $prov_headers = "providers/common/include/prov/der_dsa.h providers/common/include/prov/der_wrap.h providers/common/include/prov/der_rsa.h providers/common/include/prov/der_ecx.h providers/common/include/prov/der_sm2.h providers/common/include/prov/der_ec.h providers/common/include/prov/der_digests.h";
 my $fips_ld = ($arch =~ m/linux/ ? "providers/fips.ld" : "");
-my $cmd1 = "cd ../openssl; make -f $makefile clean build_generated $buildinf $progs $prov_headers $fips_ld;";
+my $legacy_ld = ($arch =~ m/linux/ ? "providers/legacy.ld" : "");
+my $cmd1 = "cd ../openssl; make -f $makefile clean build_generated $buildinf $progs $prov_headers $fips_ld $legacy_ld;";
 system($cmd1) == 0 or die "Error in system($cmd1)";
 
 # Copy and move all arch dependent header files into config/archs
@@ -100,11 +101,19 @@
 copy("$src_dir/providers/common/include/prov/der_digests.h",
      "$base_dir/providers/common/include/prov/") or die "Copy failed: $!";
 
-my $fips_linker_script = "";
+my $version_script_dir = "\$(srcdir)/deps/openssl/config/archs/$arch/$asm/providers";
+my $fips_version_script = "";
 if ($fips_ld ne "") {
-  $fips_linker_script = "$base_dir/providers/fips.ld";
+  $fips_version_script = "$version_script_dir/fips.ld";
   copy("$src_dir/providers/fips.ld",
-       $fips_linker_script) or die "Copy failed: $!";
+       "$base_dir/providers/fips.ld") or die "Copy failed: $!";
+}
+
+my $legacy_version_script = "";
+if ($legacy_ld ne "") {
+  $legacy_version_script = "$version_script_dir/legacy.ld";
+  copy("$src_dir/providers/legacy.ld",
+       "$base_dir/providers/legacy.ld") or die "Copy failed: $!";
 }
 
 
@@ -172,27 +181,52 @@
     $src =~ s\.[sS]$\.asm\ if ($is_win);
     push(@generated_srcs, $src);
   } else {
-    if ($src =~ m/\.c$/) { 
+    if ($src =~ m/\.c$/) {
       push(@libcrypto_srcs, $src);
     }
   }
 }
 
+my @liblegacy_srcs = ();
+
 foreach my $obj (@{$unified_info{sources}->{'providers/liblegacy.a'}}) {
   my $src = ${$unified_info{sources}->{$obj}}[0];
-  #print("liblegacy src: $src \n");
+  #print("providers/liblegacy.a obj: $obj src: $src \n");
   # .S files should be preprocessed into .s
   if ($unified_info{generate}->{$src}) {
     # .S or .s files should be preprocessed into .asm for WIN
-    $src =~ s\.[sS]$\.asm\ if ($is_win);
-    push(@generated_srcs, $src);
+    #$src =~ s\.[sS]$\.asm\ if ($is_win);
+    #push(@generated_srcs, $src);
   } else {
-    if ($src =~ m/\.c$/) { 
-      push(@libcrypto_srcs, $src);
+    if ($src =~ m/\.c$/) {
+      push(@liblegacy_srcs, $src);
+    }
+  }
+}
+
+foreach my $obj (@{$unified_info{sources}->{'providers/legacy'}}) {
+  if ($obj eq 'providers/legacy.ld') {
+    push(@generated_srcs, $obj);
+  } else {
+    my $src = ${$unified_info{sources}->{$obj}}[0];
+    #print("providers/fips obj: $obj, src: $src\n");
+    if ($src =~ m/\.c$/) {
+      push(@liblegacy_srcs, $src);
     }
   }
 }
 
+my @liblegacy_defines = ();
+foreach my $df (@{$unified_info{defines}->{'providers/liblegacy.a'}}) {
+  #print("liblegacy defines: $df\n");
+  push(@liblegacy_defines, $df);
+}
+
+foreach my $df (@{$unified_info{defines}->{'providers/legacy'}}) {
+  #print("liblegacy defines: $df\n");
+  push(@liblegacy_srcs, $df);
+}
+
 my @libfips_srcs = ();
 foreach my $obj (@{$unified_info{sources}->{'providers/libfips.a'}}) {
   my $src = ${$unified_info{sources}->{$obj}}[0];
@@ -316,12 +350,37 @@
         arch => \$arch,
         lib_cppflags => \@lib_cppflags,
         is_win => \$is_win,
-	linker_script => \rel2abs($fips_linker_script),
+	version_script => $fips_version_script,
     });
 
 open(FIPSGYPI, "> ./archs/$arch/$asm/openssl-fips.gypi");
 print FIPSGYPI "$fipsgypi";
 close(FIPSGYPI);
+#
+# Create openssl-fips.gypi
+my $legacytemplate =
+    Text::Template->new(TYPE => 'FILE',
+                        SOURCE => 'openssl-legacy.gypi.tmpl',
+                        DELIMITERS => [ "%%-", "-%%" ]
+                        );
+my $legacygypi = $legacytemplate->fill_in(
+    HASH => {
+        liblegacy_srcs => \@liblegacy_srcs,
+        liblegacy_defines => \@liblegacy_defines,
+	#generated_srcs => \@generated_srcs,
+        config => \%config,
+        target => \%target,
+        cflags => \@cflags,
+        asm => \$asm,
+        arch => \$arch,
+        lib_cppflags => \@lib_cppflags,
+        is_win => \$is_win,
+	version_script => $legacy_version_script,
+    });
+
+open(LEGACYGYPI, "> ./archs/$arch/$asm/openssl-legacy.gypi");
+print LEGACYGYPI "$legacygypi";
+close(LEGACYGYPI);
 
 # Create openssl-cl.gypi
 my $cltemplate =
diff --git a/deps/openssl/config/openssl-fips.gypi.tmpl b/deps/openssl/config/openssl-fips.gypi.tmpl
index b3c6530d0a61bf..1e1e2a904dba4e 100644
--- a/deps/openssl/config/openssl-fips.gypi.tmpl
+++ b/deps/openssl/config/openssl-fips.gypi.tmpl
@@ -33,7 +33,7 @@
     'openssl_ex_libs_%%-$arch-%%': [
       '%%-$target{ex_libs}-%%',
     ],
-    'linker_script': '%%-$linker_script-%%'
+    'version_script': '%%-$version_script-%%'
   },
   'include_dirs': [
     '.',
@@ -46,8 +46,8 @@
 %%- if (!$is_win) {
       $OUT .= "  'cflags': ['<@(openssl_cflags_$arch)'],\n";
       $OUT .= "  'libraries': ['<@(openssl_ex_libs_$arch)'],\n";
-      if ($linker_script ne "") {
-        $OUT .= "  'ldflags': ['-Wl,--version-script=<@(linker_script)'],";
+      if ($version_script ne "") {
+        $OUT .= "  'ldflags': ['-Wl,--version-script=<@(version_script)'],";
       }
 } -%%
   'sources': ['<@(openssl_sources)', '<@(openssl_sources_%%-$arch-%%)'],
diff --git a/deps/openssl/config/openssl-legacy.gypi.tmpl b/deps/openssl/config/openssl-legacy.gypi.tmpl
new file mode 100644
index 00000000000000..c9033bcefff0fd
--- /dev/null
+++ b/deps/openssl/config/openssl-legacy.gypi.tmpl
@@ -0,0 +1,58 @@
+{
+  'variables': {
+    'openssl_sources': [
+%%- foreach $src (@liblegacy_srcs) {
+  $OUT .= "      'openssl/$src',\n";
+} -%%
+    ],
+    'openssl_sources_%%-$arch-%%': [
+%%- foreach $src (@generated_srcs) {
+  $OUT .= "      './config/archs/$arch/$asm/$src',\n";
+} -%%
+    ],
+    'openssl_defines_%%-$arch-%%': [
+%%- foreach $define (@{$config{defines}}) {
+      $OUT .= "      '$define',\n";
+    }
+    foreach $define (@lib_cppflags) {
+      $OUT .= "      '$define',\n";
+    }
+    foreach $define (@{$target{defines}}) {
+      $OUT .= "      '$define',\n";
+    }
+    foreach $define (@{liblegacy_defines}) {
+      $OUT .= "      '$define',\n";
+    }
+    foreach $define (@{$config{liblegacy_defines}}) {
+  $OUT .= "      '$define',\n";
+} -%%    ],
+    'openssl_cflags_%%-$arch-%%': [
+%%- foreach $cflag (@cflags) {
+      $OUT .= "      '$cflag',\n";
+} -%%    ],
+    'openssl_ex_libs_%%-$arch-%%': [
+      '%%-$target{ex_libs}-%%',
+    ],
+    'version_script': '%%-$version_script-%%'
+  },
+  'include_dirs': [
+    '.',
+    './include',
+    './crypto',
+    './crypto/include/internal',
+    './providers/common/include',
+  ],
+  'defines': ['<@(openssl_defines_%%-$arch-%%)'],
+%%- if (!$is_win) {
+      $OUT .= "  'cflags': ['<@(openssl_cflags_$arch)'],\n";
+      $OUT .= "  'libraries': ['<@(openssl_ex_libs_$arch)'],\n";
+      if ($version_script ne "") {
+        $OUT .= "  'ldflags': ['-Wl,--version-script=<@(version_script)'],";
+      }
+} -%%
+  'sources': ['<@(openssl_sources)', '<@(openssl_sources_%%-$arch-%%)'],
+  'direct_dependent_settings': {
+    'include_dirs': ['./include', '.'],
+    'defines': ['<@(openssl_defines_%%-$arch-%%)'],
+  },
+}
diff --git a/deps/openssl/openssl-legacy_asm.gypi b/deps/openssl/openssl-legacy_asm.gypi
new file mode 100644
index 00000000000000..ddeb4e1738e753
--- /dev/null
+++ b/deps/openssl/openssl-legacy_asm.gypi
@@ -0,0 +1,85 @@
+{
+  'conditions': [
+    ['target_arch=="ppc" and OS=="aix"', {
+      'includes': ['config/archs/aix-gcc/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc" and OS=="linux"', {
+      'includes': ['config/archs/linux-ppc/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc64" and OS=="aix"', {
+      'includes': ['config/archs/aix64-gcc-as/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc64" and OS=="linux" and node_byteorder =="little"', {
+      'includes': ['config/archs/linux-ppc64le/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc64" and OS=="linux"', {
+      'includes': ['config/archs/linux-ppc64/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="s390x" and OS=="linux"', {
+      'includes': ['config/archs/linux64-s390x/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="arm" and OS=="linux"', {
+      'includes': ['config/archs/linux-armv4/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="arm64" and OS=="linux"', {
+      'includes': ['config/archs/linux-aarch64/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="arm64" and OS=="mac"', {
+      'includes': ['config/archs/darwin64-arm64-cc/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="freebsd"', {
+      'includes': ['config/archs/BSD-x86/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="linux"', {
+      'includes': ['config/archs/linux-elf/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="mac"', {
+      'includes': ['config/archs/darwin-i386-cc/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="solaris"', {
+      'includes': ['config/archs/solaris-x86-gcc/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="win"', {
+      'includes': ['config/archs/VC-WIN32/asm/openssl-legacy.gypi'],
+      'rules': [
+        {
+          'rule_name': 'Assemble',
+          'extension': 'asm',
+          'inputs': [],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).obj',
+          ],
+          'action': [
+            'nasm.exe',
+            '-f win32',
+            '-o', '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).obj',
+            '<(RULE_INPUT_PATH)',
+          ],
+        }
+      ],
+    }, 'target_arch=="ia32"', {
+      'includes': ['config/archs/linux-elf/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="freebsd"', {
+      'includes': ['config/archs/BSD-x86_64/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="mac"', {
+      'includes': ['config/archs/darwin64-x86_64-cc/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="solaris"', {
+      'includes': ['config/archs/solaris64-x86_64-gcc/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="win"', {
+      'includes': ['config/archs/VC-WIN64A/asm/openssl-legacy.gypi'],
+      'rules': [
+        {
+          'rule_name': 'Assemble',
+          'extension': 'asm',
+          'inputs': [],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).obj',
+          ],
+          'action': [
+            'nasm.exe',
+            '-f win64',
+            '-DNEAR',
+            '-Ox',
+            '-g',
+            '-o', '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).obj',
+            '<(RULE_INPUT_PATH)',
+          ],
+        }
+      ],
+    }, 'target_arch=="x64" and OS=="linux"', {
+      'includes': ['config/archs/linux-x86_64/asm/openssl-legacy.gypi'],
+    }, 'target_arch=="mips64el" and OS=="linux"', {
+      'includes': ['config/archs/linux64-mips64/asm/openssl-legacy.gypi'],
+    }, {
+      # Other architectures don't use assembly
+      'includes': ['config/archs/linux-x86_64/asm/openssl-legacy.gypi'],
+    }],
+  ],
+}
diff --git a/deps/openssl/openssl-legacy_asm_avx2.gypi b/deps/openssl/openssl-legacy_asm_avx2.gypi
new file mode 100644
index 00000000000000..47ceb8f5104080
--- /dev/null
+++ b/deps/openssl/openssl-legacy_asm_avx2.gypi
@@ -0,0 +1,83 @@
+{
+  'conditions': [
+    ['target_arch=="ppc" and OS=="aix"', {
+      'includes': ['config/archs/aix-gcc/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc" and OS=="linux"', {
+      'includes': ['config/archs/linux-ppc/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc64" and OS=="aix"', {
+      'includes': ['config/archs/aix64-gcc-as/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc64" and OS=="linux" and node_byteorder =="little"', {
+      'includes': ['config/archs/linux-ppc64le/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc64" and OS=="linux"', {
+      'includes': ['config/archs/linux-ppc64/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="s390x" and OS=="linux"', {
+      'includes': ['config/archs/linux64-s390x/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="arm" and OS=="linux"', {
+      'includes': ['config/archs/linux-armv4/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="arm64" and OS=="linux"', {
+      'includes': ['config/archs/linux-aarch64/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="freebsd"', {
+      'includes': ['config/archs/BSD-x86/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="linux"', {
+      'includes': ['config/archs/linux-elf/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="mac"', {
+      'includes': ['config/archs/darwin-i386-cc/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="solaris"', {
+      'includes': ['config/archs/solaris-x86-gcc/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="win"', {
+      'includes': ['config/archs/VC-WIN32/asm_avx2/openssl-legacy.gypi'],
+      'rules': [
+        {
+          'rule_name': 'Assemble',
+          'extension': 'asm',
+          'inputs': [],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).obj',
+          ],
+          'action': [
+            'nasm.exe',
+            '-f win32',
+            '-o', '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).obj',
+            '<(RULE_INPUT_PATH)',
+          ],
+        }
+      ],
+    }, 'target_arch=="ia32"', {
+      'includes': ['config/archs/linux-elf/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="freebsd"', {
+      'includes': ['config/archs/BSD-x86_64/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="mac"', {
+      'includes': ['config/archs/darwin64-x86_64-cc/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="arm64" and OS=="mac"', {
+      'includes': ['config/archs/darwin64-arm64-cc/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="solaris"', {
+      'includes': ['config/archs/solaris64-x86_64-gcc/asm_avx2/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="win"', {
+      'includes': ['config/archs/VC-WIN64A/asm_avx2/openssl-legacy.gypi'],
+      'rules': [
+        {
+          'rule_name': 'Assemble',
+          'extension': 'asm',
+          'inputs': [],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).obj',
+          ],
+          'action': [
+            'nasm.exe',
+            '-f win64',
+            '-DNEAR',
+            '-Ox',
+            '-g',
+            '-o', '<(INTERMEDIATE_DIR)/<(RULE_INPUT_ROOT).obj',
+            '<(RULE_INPUT_PATH)',
+          ],
+        }
+      ],
+    }, 'target_arch=="x64" and OS=="linux"', {
+      'includes': ['config/archs/linux-x86_64/asm_avx2/openssl-legacy.gypi'],
+    }, {
+      # Other architectures don't use assembly
+      'includes': ['config/archs/linux-x86_64/asm_avx2/openssl-legacy.gypi'],
+    }],
+  ],
+}
diff --git a/deps/openssl/openssl-legacy_no_asm.gypi b/deps/openssl/openssl-legacy_no_asm.gypi
new file mode 100644
index 00000000000000..9639155ebf62fd
--- /dev/null
+++ b/deps/openssl/openssl-legacy_no_asm.gypi
@@ -0,0 +1,54 @@
+{
+  'defines': ['OPENSSL_NO_ASM'],
+  'conditions': [
+    ['target_arch=="ppc" and OS=="aix"', {
+      'includes': ['config/archs/aix-gcc/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc" and OS=="linux"', {
+      'includes': ['config/archs/linux-ppc/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc64" and OS=="aix"', {
+      'includes': ['config/archs/aix64-gcc-as/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc64" and OS=="linux" and node_byteorder =="little"', {
+      'includes': ['config/archs/linux-ppc64le/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ppc64" and OS=="linux"', {
+      'includes': ['config/archs/linux-ppc64/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="s390x" and OS=="linux"', {
+      'includes': ['config/archs/linux64-s390x/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="arm" and OS in ("linux", "android")', {
+      'includes': ['config/archs/linux-armv4/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="arm64" and OS in ("linux", "android")', {
+      'includes': ['config/archs/linux-aarch64/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="freebsd"', {
+      'includes': ['config/archs/BSD-x86/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="linux"', {
+      'includes': ['config/archs/linux-elf/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="mac"', {
+      'includes': ['config/archs/darwin-i386-cc/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="solaris"', {
+      'includes': ['config/archs/solaris-x86-gcc/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32" and OS=="win"', {
+      'includes': ['config/archs/VC-WIN32/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="ia32"', {
+      # noasm linux-elf for other ia32 platforms
+      'includes': ['config/archs/linux-elf/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="freebsd"', {
+      'includes': ['config/archs/BSD-x86_64/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="mac"', {
+      'includes': ['config/archs/darwin64-x86_64-cc/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="arm64" and OS=="mac"', {
+      'includes': ['config/archs/darwin64-arm64-cc/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="solaris"', {
+      'includes': ['config/archs/solaris64-x86_64-gcc/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="win"', {
+      'includes': ['config/archs/VC-WIN64A/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="arm64" and OS=="win"', {
+      'includes': ['config/archs/VC-WIN64-ARM/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="x64" and OS=="linux"', {
+      'includes': ['config/archs/linux-x86_64/no-asm/openssl-legacy.gypi'],
+    }, 'target_arch=="mips64el" and OS=="linux"', {
+      'includes': ['config/archs/linux64-mips64/no-asm/openssl-legacy.gypi'],
+    }, {
+      # Other architectures don't use assembly
+      'includes': ['config/archs/linux-x86_64/no-asm/openssl-legacy.gypi'],
+    }],
+  ],
+}
diff --git a/deps/openssl/openssl.gyp b/deps/openssl/openssl.gyp
index 4d4e6f28010d29..cef60ceb054e1e 100644
--- a/deps/openssl/openssl.gyp
+++ b/deps/openssl/openssl.gyp
@@ -106,6 +106,33 @@
      'direct_dependent_settings': {
        'include_dirs': [ 'openssl/include', 'openssl/crypto/include']
      }
+    }, {
+      # openssl-legacy target
+      'target_name': 'legacy',
+      'type': 'shared_library',
+      'dependencies': ['openssl-cli'],
+      'includes': ['./openssl_common.gypi'],
+      'include_dirs+': ['openssl/apps/include'],
+      'cflags': [ '-fPIC' ],
+      'conditions': [
+        [ 'openssl_no_asm==1', {
+          'includes': ['./openssl-legacy_no_asm.gypi'],
+        }, 'target_arch=="arm64" and OS=="win"', {
+          # VC-WIN64-ARM inherits from VC-noCE-common that has no asms.
+          'includes': ['./openssl-legacy_no_asm.gypi'],
+        }, 'gas_version and v(gas_version) >= v("2.26") or '
+           'nasm_version and v(nasm_version) >= v("2.11.8")', {
+           # Require AVX512IFMA supported. See
+           # https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_ia32cap.html
+           # Currently crypto/poly1305/asm/poly1305-x86_64.pl requires AVX512IFMA.
+          'includes': ['./openssl-legacy_asm.gypi'],
+        }, {
+          'includes': ['./openssl-legacy_asm_avx2.gypi'],
+        }],
+     ],
+     'direct_dependent_settings': {
+       'include_dirs': [ 'openssl/include', 'openssl/crypto/include']
+     }
    },
   ]
 }
diff --git a/node.gyp b/node.gyp
index 39496fd0507718..1d79c3e160cfe2 100644
--- a/node.gyp
+++ b/node.gyp
@@ -342,7 +342,27 @@
             '<(obj_dir)/<(node_text_start_object_path)'
           ]
         }],
-
+        ['node_openssl_legacy_module=="true"', {
+          #'dependencies': [
+          #   './deps/openssl/openssl.gyp:legacy'
+          #],
+          'actions': [
+            {
+              'action_name': 'copy_legacy_module',
+              'inputs': [
+                '<(obj_dir)/deps/openssl/liblegacy.so',
+              ],
+              'outputs': [
+		 '<(obj_dir)/deps/openssl/lib/openssl-modules/legacy.so',
+              ],
+              'action': [
+                'python', 'tools/copyfile.py',
+                '<(obj_dir)/deps/openssl/liblegacy.so',
+		 '<(obj_dir)/deps/openssl/lib/openssl-modules/legacy.so',
+              ],
+            },
+          ],
+        }],
         ['node_fipsinstall=="true"', {
           'variables': {
             'openssl-cli': '<(PRODUCT_DIR)/<(EXECUTABLE_PREFIX)openssl-cli<(EXECUTABLE_SUFFIX)',