diff -dupr samba-4.0.0/source4/heimdal_build/crypto-headers.h samba-4.0.0/source4/heimdal_build/crypto-headers.h
--- samba-4.0.0/source4/heimdal_build/crypto-headers.h	2012-10-02 10:24:47.000000000 +0200
+++ samba-4.0.0/source4/heimdal_build/crypto-headers.h	2012-12-12 09:23:29.533400171 +0100
@@ -3,6 +3,7 @@
 #ifdef KRB5
 #include <krb5-types.h>
 #endif
+#if 0
 #include <hcrypto/evp.h>
 #include <hcrypto/des.h>
 #include <hcrypto/md2.h>
@@ -17,4 +18,20 @@
 #include <hcrypto/engine.h>
 #include <hcrypto/pkcs12.h>
 #include <hcrypto/hmac.h>
+#else
+#include <openssl/evp.h>
+#include <openssl/des.h>
+//#include <openssl/md2.h>
+#include <openssl/md4.h>
+#include <openssl/md5.h>
+#include <openssl/sha.h>
+#include <openssl/rc4.h>
+#include <openssl/rc2.h>
+#include <openssl/aes.h>
+#include <openssl/ui.h>
+#include <openssl/rand.h>
+#include <openssl/engine.h>
+#include <openssl/pkcs12.h>
+#include <openssl/hmac.h>
+#endif
 #endif /* __crypto_headers_h__ */
diff -dupr samba-4.0.0/source4/heimdal_build/wscript_build samba-4.0.0/source4/heimdal_build/wscript_build
--- samba-4.0.0/source4/heimdal_build/wscript_build	2012-12-04 11:07:44.000000000 +0100
+++ samba-4.0.0/source4/heimdal_build/wscript_build	2012-12-12 10:32:15.990686184 +0100
@@ -941,19 +941,22 @@ if not bld.CONFIG_SET('USING_SYSTEM_COMP
 
 HEIMDAL_BINARY('samba4kinit',
     'kuser/kinit.c',
-    deps='krb5 heimntlm roken HEIMDAL_VERS hcrypto',
+#    deps='krb5 heimntlm roken HEIMDAL_VERS hcrypto',
+    deps='krb5 heimntlm roken HEIMDAL_VERS libcrypto',
     install=False
     )
 
 HEIMDAL_BINARY('samba4kgetcred',
     'kuser/kgetcred.c',
-    deps='krb5 heimntlm roken HEIMDAL_VERS hcrypto asn1',
+#    deps='krb5 heimntlm roken HEIMDAL_VERS hcrypto asn1',
+    deps='krb5 heimntlm roken HEIMDAL_VERS libcrypto asn1',
     install=False
     )
 
 HEIMDAL_BINARY('samba4kpasswd',
     'kpasswd/kpasswd.c',
-    deps='krb5 heimntlm roken HEIMDAL_VERS hcrypto',
+#    deps='krb5 heimntlm roken HEIMDAL_VERS hcrypto',
+    deps='krb5 heimntlm roken HEIMDAL_VERS libcrypto',
     install=False
     )
 
diff -dupr samba-4.0.0/source4/heimdal_build/wscript_configure samba-4.0.0/source4/heimdal_build/wscript_configure
--- samba-4.0.0/source4/heimdal_build/wscript_configure	2012-12-04 11:07:44.000000000 +0100
+++ samba-4.0.0/source4/heimdal_build/wscript_configure	2012-12-12 11:28:31.095614437 +0100
@@ -224,17 +224,28 @@ try:
     check_system_heimdal_lib("hx509", "hx509_bitstring_print", "hx509.h", onlyif="roken wind")
     check_system_heimdal_lib("asn1", "initialize_asn1_error_table", "asn1_err.h", onlyif="roken com_err")
     check_system_heimdal_lib("heimbase", "heim_cmp", "heimbase.h", onlyif="roken")
-    check_system_heimdal_lib("hcrypto", "MD4_Init", "hcrypto/md4.h",
-        onlyif="asn1 roken com_err")
+    #check_system_heimdal_lib("hcrypto", "MD4_Init", "hcrypto/md4.h",
+    #    onlyif="asn1 roken com_err")
+    if conf.check_cfg(package='libcrypto',
+#                      uselib_store='HCRYPTO',
+                      args='--cflags --libs',
+                      msg='Checking for crypto'):
+        conf.SET_TARGET_TYPE('libcrypto', 'SYSLIB')
+    
+    conf.define('USING_SYSTEM_HCRYPTO', 1)
     if check_system_heimdal_lib("krb5", "krb5_anyaddr", "krb5.h",
-        onlyif="roken wind asn1 hx509 hcrypto com_err heimbase"):
+    #    onlyif="roken wind asn1 hx509 hcrypto com_err heimbase"):
+        onlyif="roken wind asn1 hx509 com_err heimbase"):
         conf.CHECK_FUNCS_IN('krb5_free_unparsed_name', 'krb5', headers="krb5.h")
     check_system_heimdal_lib("gssapi", "gss_oid_to_name", "gssapi.h",
-        onlyif="hcrypto asn1 roken krb5 com_err wind")
+#        onlyif="hcrypto asn1 roken krb5 com_err wind")
+        onlyif="asn1 roken krb5 com_err wind")
     check_system_heimdal_lib("heimntlm", "heim_ntlm_ntlmv2_key", "heimntlm.h",
-        onlyif="roken hcrypto krb5")
+#        onlyif="roken hcrypto krb5")
+        onlyif="roken krb5")
     if check_system_heimdal_lib("hdb", "hdb_db_dir", "krb5.h hdb.h",
-        onlyif="roken krb5 hcrypto com_err wind"):
+#        onlyif="roken krb5 hcrypto com_err wind"):
+        onlyif="roken krb5 com_err wind"):
         conf.CHECK_CODE('''
             #include <hdb.h>
             int main(void) { hdb_enctype2key(NULL, NULL, NULL, 0, NULL); }
@@ -246,7 +257,8 @@ try:
             local_include=False)
 
     check_system_heimdal_lib("kdc", "kdc_log", "kdc.h",
-        onlyif="roken krb5 hdb asn1 heimntlm hcrypto com_err wind heimbase")
+#        onlyif="roken krb5 hdb asn1 heimntlm hcrypto com_err wind heimbase")
+        onlyif="roken krb5 hdb asn1 heimntlm com_err wind heimbase")
 finally:
     conf.env.CCDEFINES = CCDEFINES
 
diff -dupr samba-4.0.0/source4/rpc_server/backupkey/dcesrv_backupkey.c samba-4.0.0/source4/rpc_server/backupkey/dcesrv_backupkey.c
--- samba-4.0.0/source4/rpc_server/backupkey/dcesrv_backupkey.c	2012-10-02 10:24:48.000000000 +0200
+++ samba-4.0.0/source4/rpc_server/backupkey/dcesrv_backupkey.c	2012-12-12 08:53:52.220941673 +0100
@@ -31,9 +31,15 @@
 #include "system/network.h"
 #include <com_err.h>
 #include <hx509.h>
+#if 0
 #include <hcrypto/rsa.h>
 #include <hcrypto/bn.h>
 #include <hcrypto/sha.h>
+#else
+#include <openssl/rsa.h>
+#include <openssl/bn.h>
+#include <openssl/sha.h>
+#endif
 #include <der.h>
 #include "../lib/tsocket/tsocket.h"
 #include "../libcli/security/security.h"
@@ -454,7 +460,8 @@ static WERROR get_and_verify_access_chec
 	if (version == 2) {
 		uint32_t hash_size = 20;
 		uint8_t hash[hash_size];
-		struct sha sctx;
+		//struct sha sctx;
+		SHA_CTX sctx;
 		struct bkrp_access_check_v2 uncrypted_accesscheckv2;
 
 		ndr_err = ndr_pull_struct_blob(&blob_us, sub_ctx, &uncrypted_accesscheckv2,
@@ -493,7 +500,8 @@ static WERROR get_and_verify_access_chec
 	if (version == 3) {
 		uint32_t hash_size = 64;
 		uint8_t hash[hash_size];
-		struct hc_sha512state sctx;
+		//struct hc_sha512state sctx;
+		SHA512_CTX sctx;
 		struct bkrp_access_check_v3 uncrypted_accesscheckv3;
 
 		ndr_err = ndr_pull_struct_blob(&blob_us, sub_ctx, &uncrypted_accesscheckv3,
diff -dupr samba-4.0.0/source4/rpc_server/wscript_build samba-4.0.0/source4/rpc_server/wscript_build
--- samba-4.0.0/source4/rpc_server/wscript_build	2012-10-30 10:01:47.000000000 +0100
+++ samba-4.0.0/source4/rpc_server/wscript_build	2012-12-12 10:51:34.459540782 +0100
@@ -114,7 +114,8 @@ bld.SAMBA_MODULE('dcerpc_backupkey',
 	autoproto='backupkey/proto.h',
 	subsystem='dcerpc_server',
 	init_function='dcerpc_server_backupkey_init',
-	deps='samdb DCERPC_COMMON NDR_BACKUPKEY RPC_NDR_BACKUPKEY krb5 hx509 hcrypto'
+#	deps='samdb DCERPC_COMMON NDR_BACKUPKEY RPC_NDR_BACKUPKEY krb5 hx509 hcrypto'
+	deps='samdb DCERPC_COMMON NDR_BACKUPKEY RPC_NDR_BACKUPKEY krb5 hx509 libcrypto'
 	)
 
 
diff -dupr samba-4.0.0/source4/torture/rpc/backupkey.c samba-4.0.0/source4/torture/rpc/backupkey.c
--- samba-4.0.0/source4/torture/rpc/backupkey.c	2012-10-02 10:24:49.000000000 +0200
+++ samba-4.0.0/source4/torture/rpc/backupkey.c	2012-12-12 09:04:19.591691294 +0100
@@ -26,7 +26,11 @@
 #include "torture/rpc/torture_rpc.h"
 #include "lib/cmdline/popt_common.h"
 #include <com_err.h>
+#if 0
 #include <hcrypto/sha.h>
+#else
+#include <openssl/sha.h>
+#endif
 #include <system/network.h>
 #include <hx509.h>
 #include <der.h>
@@ -255,7 +259,8 @@ static DATA_BLOB *create_access_check(st
 
 	if (version == 2) {
 		struct bkrp_access_check_v2 access_struct;
-		struct sha sctx;
+		//struct sha sctx;
+		SHA_CTX sctx;
 		uint8_t nonce[32];
 
 		ZERO_STRUCT(access_struct);
@@ -290,7 +295,8 @@ static DATA_BLOB *create_access_check(st
 
 	if (version == 3) {
 		struct bkrp_access_check_v3 access_struct;
-		struct hc_sha512state sctx;
+		//struct hc_sha512state sctx;
+		SHA512_CTX sctx;
 		uint8_t nonce[32];
 
 		ZERO_STRUCT(access_struct);