--- a/BUILDING.md	
+++ a/BUILDING.md	
@@ -132,9 +132,18 @@ Depending on host platform, the selection of toolchains may vary.
 
 #### OpenSSL asm support
 
-OpenSSL-1.1.0 requires the following asssembler version for use of asm
+OpenSSL-1.1.1 requires the following asssembler version for use of asm
 support on x86_64 and ia32.
 
+For use of AVX-512,
+
+* gas (GNU assembler) version 2.26 or higher
+* nasm version 2.11.8 or higher in Windows
+
+Note that AVX-512 is disabled for Skylake-X by OpenSSL-1.1.1.
+
+For use of AVX2,
+ 
 * gas (GNU assembler) version 2.23 or higher
 * xcode version 5.0 or higher
 * llvm version 3.3 or higher
@@ -144,8 +153,7 @@ Otherwise `configure` will fail with an error. This can be avoided by
 either providing a newer assembler as per the list above or by
 using the `--openssl-no-asm` flag.
 
-*Note:* The forthcoming OpenSSL-1.1.1 will require higher
- version. Please refer
+ Please refer to
  https://www.openssl.org/docs/man1.1.1/man3/OPENSSL_ia32cap.html for
  details.
 
--- a/src/node_crypto.cc	
+++ a/src/node_crypto.cc	
@@ -465,6 +465,12 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
                                  SSL_SESS_CACHE_NO_AUTO_CLEAR);
 
   SSL_CTX_set_min_proto_version(sc->ctx_.get(), min_version);
+
+  if (max_version == 0) {
+    // Selecting some secureProtocol methods allows the TLS version to be "any
+    // supported", but we don't support TLSv1.3, even if OpenSSL does.
+    max_version = TLS1_2_VERSION;
+  }
   SSL_CTX_set_max_proto_version(sc->ctx_.get(), max_version);
   // OpenSSL 1.1.0 changed the ticket key size, but the OpenSSL 1.0.x size was
   // exposed in the public API. To retain compatibility, install a callback
@@ -888,7 +894,24 @@ void SecureContext::SetCiphers(const FunctionCallbackInfo<Value>& args) {
 
   THROW_AND_RETURN_IF_NOT_STRING(env, args[0], "Ciphers");
 
+  // Note: set_ciphersuites() is for TLSv1.3 and was introduced in openssl
+  // 1.1.1, set_cipher_list() is for TLSv1.2 and earlier.
+  //
+  // In openssl 1.1.0, set_cipher_list() would error if it resulted in no
+  // TLSv1.2 (and earlier) cipher suites, and there is no TLSv1.3 support.
+  //
+  // In openssl 1.1.1, set_cipher_list() will not error if it results in no
+  // TLSv1.2 cipher suites if there are any TLSv1.3 cipher suites, which there
+  // are by default. There will be an error later, during the handshake, but
+  // that results in an async error event, rather than a sync error thrown,
+  // which is a semver-major change for the tls API.
+  //
+  // Since we don't currently support TLSv1.3, work around this by removing the
+  // TLSv1.3 cipher suites, so we get backwards compatible synchronous errors.
   const node::Utf8Value ciphers(args.GetIsolate(), args[0]);
+#ifdef TLS1_3_VERSION
+  SSL_CTX_set_ciphersuites(sc->ctx_.get(), "");
+#endif
   SSL_CTX_set_cipher_list(sc->ctx_.get(), *ciphers);
 }
 
--- a/src/tls_wrap.cc	
+++ a/src/tls_wrap.cc	
@@ -227,7 +227,10 @@ void TLSWrap::SSLInfoCallback(const SSL* ssl_, int where, int ret) {
     }
   }
 
-  if (where & SSL_CB_HANDSHAKE_DONE) {
+  // SSL_CB_HANDSHAKE_START and SSL_CB_HANDSHAKE_DONE are called
+  // sending HelloRequest in OpenSSL-1.1.1.
+  // We need to check whether this is in a renegotiation state or not.
+  if (where & SSL_CB_HANDSHAKE_DONE && !SSL_renegotiate_pending(ssl)) {
     c->established_ = true;
     Local<Value> callback = object->Get(env->onhandshakedone_string());
     if (callback->IsFunction()) {