diff -Naurp0 a/p11_child/p11_child_openssl.c b/p11_child/p11_child_openssl.c
--- a/src/p11_child/p11_child_openssl.c	2020-09-06 16:39:47.663132167 +0200
+++ b/src/p11_child/p11_child_openssl.c	2020-09-06 16:39:51.887060887 +0200
@@ -33,0 +34 @@
+#include <limits.h>
diff -Naurp0 a/util/crypto/libcrypto/crypto_hmac_sha1.c b/util/crypto/libcrypto/crypto_hmac_sha1.c
--- a/src/util/crypto/libcrypto/crypto_hmac_sha1.c	2020-09-06 16:39:47.705131458 +0200
+++ b/src/util/crypto/libcrypto/crypto_hmac_sha1.c	2020-09-06 16:39:51.870061174 +0200
@@ -19,0 +20 @@
+#include <limits.h>
--- a/src/lib/certmap/sss_cert_content_crypto.c	2020-10-12 12:16:19.000000000 +0200
+++ b/src/lib/certmap/sss_cert_content_crypto.c	2020-10-12 12:16:19.000000000 +0200
@@ -771,8 +771,13 @@
         ret = EIO;
         goto done;
     }
+#ifdef LIBRESSL_VERSION_NUMBER
+    if (cert->ex_flags & EXFLAG_KUSAGE) {
+        cont->key_usage = cert->ex_kusage;
+#else
     if ((X509_get_extension_flags(cert) & EXFLAG_KUSAGE)) {
         cont->key_usage = X509_get_key_usage(cert);
+#endif
     } else {
         /* According to X.509 https://www.itu.int/rec/T-REC-X.509-201610-I
          * section 13.3.2 "Certificate match" "keyUsage matches if all of the