diff --git a/usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c b/usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c
--- a/usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c
+++ b/usr.sbin/rpc.tlsclntd/rpc.tlsclntd.c
@@ -299,7 +299,6 @@
 	rpctls_syscall(RPCTLS_SYSC_CLSHUTDOWN, "");
 
 	SSL_CTX_free(rpctls_ctx);
-	EVP_cleanup();
 	return (0);
 }
 
@@ -480,17 +479,12 @@
 	size_t len, rlen;
 	int ret;
 
-	SSL_library_init();
-	SSL_load_error_strings();
-	OpenSSL_add_all_algorithms();
-
 	ctx = SSL_CTX_new(TLS_client_method());
 	if (ctx == NULL) {
 		rpctls_verbose_out("rpctls_setupcl_ssl: SSL_CTX_new "
 		    "failed\n");
 		return (NULL);
 	}
-	SSL_CTX_set_ecdh_auto(ctx, 1);
 
 	if (rpctls_ciphers != NULL) {
 		/*
@@ -686,7 +680,11 @@
 		return (NULL);
 	}
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+	cert = SSL_get1_peer_certificate(ssl);
+#else
 	cert = SSL_get_peer_certificate(ssl);
+#endif
 	if (cert == NULL) {
 		rpctls_verbose_out("rpctls_connect: get peer"
 		    " certificate failed\n");
diff --git a/usr.sbin/rpc.tlsservd/rpc.tlsservd.c b/usr.sbin/rpc.tlsservd/rpc.tlsservd.c
--- a/usr.sbin/rpc.tlsservd/rpc.tlsservd.c
+++ b/usr.sbin/rpc.tlsservd/rpc.tlsservd.c
@@ -416,7 +416,6 @@
 	rpctls_svc_run();
 
 	SSL_CTX_free(rpctls_ctx);
-	EVP_cleanup();
 	return (0);
 }
 
@@ -652,16 +651,11 @@
 	size_t len, rlen;
 	int ret;
 
-	SSL_library_init();
-	SSL_load_error_strings();
-	OpenSSL_add_all_algorithms();
-
 	ctx = SSL_CTX_new(TLS_server_method());
 	if (ctx == NULL) {
 		rpctls_verbose_out("rpctls_setup_ssl: SSL_CTX_new failed\n");
 		return (NULL);
 	}
-	SSL_CTX_set_ecdh_auto(ctx, 1);
 
 	if (rpctls_ciphers != NULL) {
 		/*
@@ -811,7 +805,11 @@
 		    SSL_get_cipher(ssl));
 	}
 	if (rpctls_do_mutual) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000
+		cert = SSL_get1_peer_certificate(ssl);
+#else
 		cert = SSL_get_peer_certificate(ssl);
+#endif
 		if (cert != NULL) {
 			if (!rpctls_verbose) {
 				gethostret = rpctls_gethost(s, sad, hostnam,