grpc 1.81.1 → 1.85.0

data/src/core/tsi/ssl_transport_security.cc

@@ -18,14 +18,18 @@
 
 #include "src/core/tsi/ssl_transport_security.h"
 
+#include <grpc/event_engine/event_engine.h>
 #include <grpc/private_key_signer.h>
 #include <grpc/support/port_platform.h>
 #include <limits.h>
 #include <string.h>
 
 #include <cstddef>
+#include <cstdint>
 #include <cstdlib>
 #include <utility>
+#include <variant>
+#include <vector>
 
 // TODO(jboeuf): refactor inet_ntop into a portability header.
 // Note: for whomever reads this and tries to refactor this, this
@@ -45,7 +49,9 @@
 #include <grpc/support/thd_id.h>
 #include <openssl/bio.h>
 #include <openssl/crypto.h>  // For OPENSSL_free
+#if !defined(OPENSSL_NO_ENGINE)
 #include <openssl/engine.h>
+#endif
 #include <openssl/err.h>
 #include <openssl/ssl.h>
 #include <openssl/tls1.h>
@@ -55,39 +61,41 @@
 #include <memory>
 #include <optional>
 #include <string>
-#include <vector>
 
+#include "src/core/credentials/transport/tls/grpc_tls_certificate_selector.h"
 #include "src/core/credentials/transport/tls/grpc_tls_crl_provider.h"
+#include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
-#include "src/core/lib/event_engine/default_event_engine.h"
+#include "src/core/lib/debug/trace_impl.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/surface/init.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
+#include "src/core/tsi/ssl/session_cache/ssl_session.h"
 #include "src/core/tsi/ssl/session_cache/ssl_session_cache.h"
+#include "src/core/tsi/ssl_telemetry_utils.h"
 #include "src/core/tsi/ssl_transport_security_utils.h"
 #include "src/core/tsi/ssl_types.h"
+#include "src/core/tsi/tls_telemetry.h"
 #include "src/core/tsi/transport_security.h"
 #include "src/core/tsi/transport_security_interface.h"
-#include "src/core/util/env.h"
 #include "src/core/util/grpc_check.h"
 #include "src/core/util/match.h"
+#include "src/core/util/memory.h"
 #include "src/core/util/ref_counted.h"
 #include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/status_helper.h"
 #include "src/core/util/sync.h"
 #include "src/core/util/useful.h"
 #include "absl/base/thread_annotations.h"
 #include "absl/functional/bind_front.h"
 #include "absl/log/log.h"
+#include "absl/status/status.h"
 #include "absl/strings/match.h"
-#include "absl/strings/numbers.h"
 #include "absl/strings/str_cat.h"
+#include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "absl/strings/string_view.h"
-
-// Name of the environment variable controlling OpenSSL cleanup timeout.
-// This variable allows users to specify the timeout (in seconds) for OpenSSL
-// resource cleanup during gRPC shutdown. If not set, a default timeout is used.
-#define GRPC_ARG_OPENSSL_CLEANUP_TIMEOUT_ENV "grpc.openssl_cleanup_timeout"
+#include "absl/time/time.h"
 
 // --- Constants. ---
 
@@ -96,6 +104,12 @@
 #define TSI_SSL_MAX_PROTECTED_FRAME_SIZE_LOWER_BOUND 1024
 #define TSI_SSL_HANDSHAKER_OUTGOING_BUFFER_INITIAL_SIZE 1024
 const size_t kMaxChainLength = 100;
+const char kDefaultBoringSSLKeyExchangeGroups[] =
+    "X25519MLKEM768:X25519:P-256:P-384:P-521";
+[[maybe_unused]] const char kDefaultOpenSSL1_1_1KeyExchangeGroups[] =
+    "X25519:P-256:P-384:P-521";
+[[maybe_unused]] const char kDefaultOpenSSL1_0_2KeyExchangeGroups[] =
+    "P-256:P-384:P-521";
 
 // Putting a macro like this and littering the source file with #if is really
 // bad practice.
@@ -109,8 +123,15 @@ const size_t kMaxChainLength = 100;
 #define TSI_SSL_MAX_PROTECTION_OVERHEAD 100
 
 using TlsSessionKeyLogger = tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger;
-
-using tsi::PrivateKey;
+#if defined(OPENSSL_IS_BORINGSSL)
+using SelectCertificateInfo =
+    grpc_core::CertificateSelector::SelectCertificateInfo;
+using SelectCertificateResult =
+    grpc_core::CertificateSelector::SelectCertificateResult;
+using AsyncCertificateSelectionHandle =
+    grpc_core::CertificateSelector::AsyncCertificateSelectionHandle;
+#endif
+using grpc_core::PrivateKey;
 using tsi::RootCertInfo;
 
 // --- Structure definitions. ---
@@ -169,6 +190,9 @@ struct tsi_ssl_server_handshaker_factory {
   size_t alpn_protocol_list_length;
   grpc_core::RefCountedPtr<TlsSessionKeyLogger> key_logger;
   std::shared_ptr<tsi::RootCertInfo> root_cert_info;
+#if defined(OPENSSL_IS_BORINGSSL)
+  std::shared_ptr<grpc_core::CertificateSelector> certificate_selector;
+#endif  // defined(OPENSSL_IS_BORINGSSL)
 };
 
 // Tracks the arguments for a pending call to tsi_handshaker_next().
@@ -186,9 +210,47 @@ struct HandshakerNextArgs {
   tsi_handshaker_result* handshaker_result = nullptr;
 };
 
+struct tsi_ssl_handshaker_result {
+  tsi_handshaker_result base;
+  SSL* ssl;
+  BIO* network_io;
+  unsigned char* unused_bytes;
+  size_t unused_bytes_size;
+};
+
+struct SslHandshakeResult {
+  tsi_result tsi_handshake_result;
+  int ssl_error = SSL_ERROR_NONE;
+  unsigned long err_code = 0;
+};
+
 struct tsi_ssl_handshaker : public tsi_handshaker,
                             public grpc_core::RefCounted<tsi_ssl_handshaker> {
-  tsi_ssl_handshaker() = default;
+  tsi_ssl_handshaker(
+      const tsi_handshaker_vtable* handshaker_vtable, SSL* ssl, BIO* network_io,
+      tsi_ssl_handshaker_factory* factory_ref,
+      grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope,
+      bool is_client, std::shared_ptr<grpc_core::PrivateKeySigner> signer,
+      std::string target, std::string locality, std::string backend_service)
+      : tsi_handshaker(handshaker_vtable),
+        ssl(ssl),
+        network_io(network_io),
+        result(TSI_HANDSHAKE_IN_PROGRESS),
+        outgoing_bytes_buffer_size(
+            TSI_SSL_HANDSHAKER_OUTGOING_BUFFER_INITIAL_SIZE),
+        outgoing_bytes_buffer(static_cast<unsigned char*>(
+            gpr_zalloc(outgoing_bytes_buffer_size))),
+        factory_ref(factory_ref),
+        collection_scope(std::move(collection_scope)),
+        is_client(is_client),
+        target(std::move(target)),
+        locality(std::move(locality)),
+        backend_service(std::move(backend_service)) {
+#if defined(OPENSSL_IS_BORINGSSL)
+    key_signer = std::move(signer);
+#endif
+  }
+
   ~tsi_ssl_handshaker() override {
     SSL_free(ssl);
     BIO_free(network_io);
@@ -199,9 +261,10 @@ struct tsi_ssl_handshaker : public tsi_handshaker,
   SSL* ssl;
   BIO* network_io;
   tsi_result result;
-  unsigned char* outgoing_bytes_buffer;
   size_t outgoing_bytes_buffer_size;
+  unsigned char* outgoing_bytes_buffer;
   tsi_ssl_handshaker_factory* factory_ref;
+  grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope;
   grpc_core::Mutex mu;
   bool is_shutdown ABSL_GUARDED_BY(mu) = false;
 
@@ -214,8 +277,24 @@ struct tsi_ssl_handshaker : public tsi_handshaker,
     if (handshaker_next_args->error_ptr == nullptr) return;
     *handshaker_next_args->error_ptr = std::move(error);
   }
+  bool is_client = false;
+  std::string target;
+  std::string locality;
+  std::string backend_service;
+  bool metric_recorded ABSL_GUARDED_BY(mu) = false;
+
+  void MaybeRecordTelemetry(const SslHandshakeResult& handshake_result)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(&mu);
+
 #if defined(OPENSSL_IS_BORINGSSL)
-  std::shared_ptr<grpc_core::PrivateKeySigner> key_signer;
+  std::shared_ptr<AsyncCertificateSelectionHandle> cert_selection_handle
+      ABSL_GUARDED_BY(mu);
+  // Will be set if the certificate selector is used and the asynchronous cert
+  // selection is done.
+  std::optional<absl::Status> cert_selection_status ABSL_GUARDED_BY(mu);
+  // This may be from the factory, or from the certificate selection result when
+  // the certificate selector is used.
+  std::shared_ptr<grpc_core::PrivateKeySigner> key_signer ABSL_GUARDED_BY(mu);
   // The signed_bytes are populated when the signature process is completed if
   // the Private Key offload was successful. If there was an error during the
   // signature, the status will be returned.
@@ -226,17 +305,62 @@ struct tsi_ssl_handshaker : public tsi_handshaker,
 #endif
 };
 
+void tsi_ssl_handshaker::MaybeRecordTelemetry(
+    const SslHandshakeResult& handshake_result) {
+  // If there's no collection scope, don't do anything regarding telemetry
+  if (collection_scope == nullptr) return;
+  if (handshake_result.tsi_handshake_result == TSI_INCOMPLETE_DATA ||
+      handshake_result.tsi_handshake_result == TSI_DRAIN_BUFFER) {
+    return;
+  }
+  // The handshaker can return TSI_OK as an intermediate state, only keep going
+  // if a result has been created
+  if (handshake_result.tsi_handshake_result == TSI_OK &&
+      !handshaker_result_created) {
+    return;
+  }
+  if (metric_recorded) return;
+  metric_recorded = true;
+  SSL* active_ssl = ssl;
+  if (active_ssl == nullptr && handshaker_next_args.has_value() &&
+      handshaker_next_args->handshaker_result != nullptr) {
+    auto* res = reinterpret_cast<tsi_ssl_handshaker_result*>(
+        handshaker_next_args->handshaker_result);
+    active_ssl = res->ssl;
+  }
+  absl::string_view resumed = active_ssl == nullptr            ? "unknown"
+                              : SSL_session_reused(active_ssl) ? "true"
+                                                               : "false";
+  grpc_core::TlsTelemetryHandshakeResult result =
+      grpc_core::TlsTelemetryHandshakeResult::kSuccess;
+  if (handshake_result.tsi_handshake_result != TSI_OK) {
+    // If TSI reports non-ok, get more details from the SSL stack
+    long verify_res =
+        active_ssl != nullptr ? SSL_get_verify_result(active_ssl) : X509_V_OK;
+    result = grpc_core::MapSslErrorToTlsTelemetryHandshakeResult(
+        handshake_result.tsi_handshake_result, handshake_result.ssl_error,
+        handshake_result.err_code, verify_res);
+  }
+  absl::string_view status_str =
+      grpc_core::TlsTelemetryHandshakeResultToString(result);
+  if (is_client) {
+    auto storage = grpc_core::TlsClientHandshakeTelemetryDomain::GetStorage(
+        collection_scope, status_str, target, resumed, locality,
+        backend_service);
+    storage->Increment(
+        grpc_core::TlsClientHandshakeTelemetryDomain::kHandshakes);
+  } else {
+    auto storage = grpc_core::TlsServerHandshakeTelemetryDomain::GetStorage(
+        collection_scope, status_str, resumed);
+    storage->Increment(
+        grpc_core::TlsServerHandshakeTelemetryDomain::kHandshakes);
+  }
+}
+
 static std::pair<tsi_result, std::optional<HandshakerNextArgs>>
 ssl_handshaker_next_async(tsi_ssl_handshaker* self)
     ABSL_EXCLUSIVE_LOCKS_REQUIRED(&tsi_ssl_handshaker::mu);
 
-struct tsi_ssl_handshaker_result {
-  tsi_handshaker_result base;
-  SSL* ssl;
-  BIO* network_io;
-  unsigned char* unused_bytes;
-  size_t unused_bytes_size;
-};
 struct tsi_ssl_frame_protector {
   tsi_frame_protector base;
   SSL* ssl;
@@ -367,6 +491,73 @@ int ServerHandshakerFactoryAlpnCallback(SSL* /*ssl*/, const unsigned char** out,
                                            factory->alpn_protocol_list_length);
 }
 #endif  // TSI_OPENSSL_ALPN_SUPPORT
+
+// Populates the key exchange groups.
+// Prefers the key exchange groups (input argument) configured by the user,
+// otherwise uses the following defaults:
+//   - BoringSSL: {X25519MLKEM768, X25519, P-256, P-384, P-521}
+//   - OpenSSL < 3.0: {X25519, P-256, P-384, P-521}
+//   - OpenSSL >= 3: OpenSSL Defaults (prefers X25519MLKEM768 in OpenSSL 3.5+)
+tsi_result SetKeyExchangeGroups(
+    SSL_CTX* context,
+    const std::vector<grpc_tls_key_exchange_group>& key_exchange_groups) {
+  // Explicitly set the key exchange groups based on user-provided preferences.
+  if (!key_exchange_groups.empty()) {
+    std::vector<absl::string_view> group_names;
+    group_names.reserve(key_exchange_groups.size());
+    for (const auto& group : key_exchange_groups) {
+      auto group_name = tsi::ConvertKeyExchangeGroupToString(group);
+      if (!group_name.ok()) {
+        LOG(ERROR) << "Could not convert key exchange group to string: "
+                   << group;
+        return TSI_INVALID_ARGUMENT;
+      }
+      group_names.push_back(*group_name);
+    }
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+    std::string group_list_str = absl::StrJoin(group_names, ":");
+    if (!SSL_CTX_set1_groups_list(context, group_list_str.c_str())) {
+      LOG(ERROR) << "Could not set key exchange groups: " << group_list_str;
+      return TSI_INTERNAL_ERROR;
+    }
+    SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
+#else
+
+    LOG(ERROR) << "Setting TLS key exchange groups is not supported when "
+                  "building against OpenSSL versions < 1.1.1.";
+    return TSI_FAILED_PRECONDITION;
+#endif  // OPENSSL_VERSION_NUMBER >= 0x10100000
+  } else {
+// Use defaults
+#if defined(OPENSSL_IS_BORINGSSL)
+    if (!SSL_CTX_set1_groups_list(context,
+                                  kDefaultBoringSSLKeyExchangeGroups)) {
+      LOG(ERROR) << "Could not set default key exchange groups for BoringSSL.";
+      return TSI_INTERNAL_ERROR;
+    }
+#elif OPENSSL_VERSION_NUMBER < 0x30000000L && \
+    OPENSSL_VERSION_NUMBER >= 0x10101000L
+    if (!SSL_CTX_set1_groups_list(context,
+                                  kDefaultOpenSSL1_1_1KeyExchangeGroups)) {
+      LOG(ERROR)
+          << "Could not set default key exchange groups for OpenSSL 1.1.1.";
+      return TSI_INTERNAL_ERROR;
+    }
+#elif OPENSSL_VERSION_NUMBER < 0x10101000L
+    if (!SSL_CTX_set1_curves_list(context,
+                                  kDefaultOpenSSL1_0_2KeyExchangeGroups)) {
+      LOG(ERROR)
+          << "Could not set default key exchange groups for OpenSSL 1.0.2.";
+      return TSI_INTERNAL_ERROR;
+    }
+    if (!SSL_CTX_set_ecdh_auto(context, /*onoff=*/1)) {
+      LOG(ERROR) << "Could not set ecdh auto for OpenSSL 1.0.2.";
+      return TSI_INTERNAL_ERROR;
+    }
+#endif
+  }
+  return TSI_OK;
+}
 }  // namespace
 
 static gpr_once g_init_openssl_once = GPR_ONCE_INIT;
@@ -393,7 +584,7 @@ void TlsOffloadSignDoneCallback(
   std::optional<HandshakerNextArgs> next_args;
   tsi_result result = TSI_INTERNAL_ERROR;
   {
-    grpc_core::MutexLock lock(&handshaker->mu);
+    grpc_core::MutexLock lock(handshaker->mu);
     if (handshaker->is_shutdown) return;
     handshaker->signed_bytes = std::move(signed_data);
     handshaker->signing_handle.reset();
@@ -446,7 +637,7 @@ enum ssl_private_key_result_t TlsPrivateKeySignWrapper(
     return ssl_private_key_failure;
   }
   if (handshaker->is_shutdown) {
-    handshaker->MaybeSetError("Handshaker is shuting down");
+    handshaker->MaybeSetError("Handshaker is shutting down");
     return ssl_private_key_failure;
   }
   // Create the completion callback by binding the current context.
@@ -487,13 +678,231 @@ const SSL_PRIVATE_KEY_METHOD TlsOffloadPrivateKeyMethod = {
     TlsPrivateKeySignWrapper,
     nullptr,  // decrypt not implemented for this use case
     TlsPrivateKeyOffloadComplete};
+
+SelectCertificateInfo PrepareSelectCertificateInfo(
+    const SSL_CLIENT_HELLO* client_hello) {
+  SelectCertificateInfo select_cert_info;
+  const char* sni =
+      SSL_get_servername(client_hello->ssl, TLSEXT_NAMETYPE_host_name);
+  if (sni != nullptr) {
+    select_cert_info.sni = sni;
+  } else {
+    VLOG(2) << "Client did not provide SNI for cert selection.";
+  }
+  size_t capabilities_len = 0;
+  uint8_t* buffer;
+  bssl::ScopedCBB cbb;
+  if (CBB_init(cbb.get(), 128) &&
+      SSL_serialize_capabilities(client_hello->ssl, cbb.get()) &&
+      CBB_finish(cbb.get(), &buffer, &capabilities_len)) {
+    select_cert_info.handshake_hints_info.ssl_capabilities =
+        std::string(reinterpret_cast<const char*>(buffer), capabilities_len);
+    OPENSSL_free(buffer);
+  } else {
+    VLOG(2) << "Failed to generate SSL capabilities";
+  }
+  select_cert_info.handshake_hints_info.client_hello =
+      std::string(reinterpret_cast<const char*>(client_hello->client_hello),
+                  client_hello->client_hello_len);
+  return select_cert_info;
+}
+
+absl::Status ProcessSelectCertResultForHandshakeHints(
+    tsi_ssl_handshaker* handshaker, const SelectCertificateResult& result) {
+  // If no handshake hints are provided, return early. This doesn't mean the
+  // handshake will fail. The private key operation will happen later.
+  if (result.handshake_hints_result.handshake_hints.empty()) {
+    return absl::OkStatus();
+  }
+  if (!SSL_set_min_proto_version(
+          handshaker->ssl, result.handshake_hints_result.min_tls_version)) {
+    return absl::InvalidArgumentError("Failed to set min TLS version.");
+  }
+  if (!SSL_set_max_proto_version(
+          handshaker->ssl, result.handshake_hints_result.max_tls_version)) {
+    return absl::InvalidArgumentError("Failed to set max TLS version.");
+  }
+  if (!result.handshake_hints_result.cipher_list.empty() &&
+      !SSL_set_strict_cipher_list(
+          handshaker->ssl, result.handshake_hints_result.cipher_list.c_str())) {
+    return absl::InvalidArgumentError("Failed to set cipher list.");
+  }
+  if (!result.handshake_hints_result.key_exchange_groups.empty() &&
+      !SSL_set1_group_ids(
+          handshaker->ssl,
+          result.handshake_hints_result.key_exchange_groups.data(),
+          result.handshake_hints_result.key_exchange_groups.size())) {
+    return absl::InvalidArgumentError("Failed to set key exchange groups.");
+  }
+  // No session resumption.
+  SSL_set_options(handshaker->ssl,
+                  SSL_OP_CIPHER_SERVER_PREFERENCE | SSL_OP_NO_TICKET);
+  if (!SSL_set_handshake_hints(
+          handshaker->ssl,
+          reinterpret_cast<const uint8_t*>(
+              result.handshake_hints_result.handshake_hints.data()),
+          result.handshake_hints_result.handshake_hints.size())) {
+    return absl::InternalError("Failed to set handshake hints.");
+  }
+  return absl::OkStatus();
+}
+
+absl::Status ProcessSelectCertificateResult(tsi_ssl_handshaker* handshaker,
+                                            SelectCertificateResult result)
+    ABSL_EXCLUSIVE_LOCKS_REQUIRED(&tsi_ssl_handshaker::mu) {
+  if (result.certificate_chain.empty()) {
+    return absl::InvalidArgumentError("The cert chain is empty.");
+  }
+  std::vector<CRYPTO_BUFFER*> cert_chain;
+  cert_chain.reserve(result.certificate_chain.size());
+  for (auto& raw_cert : result.certificate_chain) {
+    cert_chain.push_back(raw_cert.get());
+  }
+  absl::Status pkey_status = grpc_core::MatchMutable(
+      &result.private_key,
+      [&](bssl::UniquePtr<EVP_PKEY>* key) {
+        VLOG(2) << "Select cert result returned a static private key.";
+        if (!SSL_set_chain_and_key(handshaker->ssl, cert_chain.data(),
+                                   cert_chain.size(), key->get(),
+                                   /*privkey_method=*/nullptr)) {
+          return absl::InternalError(
+              absl::StrFormat("Failed to set chain and key: %s",
+                              tsi::SslErrorString(SSL_get_error(
+                                  handshaker->ssl, /*ret_code=*/0))));
+        }
+        return absl::OkStatus();
+      },
+      [&](std::shared_ptr<grpc_core::PrivateKeySigner>* signer)
+          ABSL_NO_THREAD_SAFETY_ANALYSIS {
+            VLOG(2) << "Select cert result returned a private key signer.";
+            handshaker->key_signer = std::move(*signer);
+            if (!SSL_set_chain_and_key(
+                    handshaker->ssl, cert_chain.data(), cert_chain.size(),
+                    /*privkey=*/nullptr, &TlsOffloadPrivateKeyMethod)) {
+              return absl::InternalError(
+                  absl::StrFormat("Failed to set chain and key: %s",
+                                  tsi::SslErrorString(SSL_get_error(
+                                      handshaker->ssl, /*ret_code=*/0))));
+            }
+            return absl::OkStatus();
+          });
+  GRPC_RETURN_IF_ERROR(pkey_status);
+  return ProcessSelectCertResultForHandshakeHints(handshaker, result);
+}
+
+// Invoked by the cert selector when it runs asynchronously.
+void OnSelectCertificateDone(
+    grpc_core::RefCountedPtr<tsi_ssl_handshaker> handshaker,
+    absl::StatusOr<SelectCertificateResult> result) {
+  grpc_core::ExecCtx exec_ctx;
+  tsi_result next_result;
+  std::optional<HandshakerNextArgs> next_args;
+  {
+    grpc_core::MutexLock lock(handshaker->mu);
+    if (handshaker->is_shutdown) return;
+    if (!result.ok()) {
+      VLOG(2) << "SelectCertificate failed " << result.status();
+      handshaker->cert_selection_status = std::move(result).status();
+    } else {
+      handshaker->cert_selection_status =
+          ProcessSelectCertificateResult(handshaker.get(), *std::move(result));
+    }
+    handshaker->cert_selection_handle.reset();
+    auto async_result = ssl_handshaker_next_async(handshaker.get());
+    next_result = async_result.first;
+    next_args = std::move(async_result.second);
+  }
+  // If result is not TSI_ASYNC and there are args, we are ready to flush.
+  if (next_result != TSI_ASYNC && next_args.has_value() &&
+      next_args->cb != nullptr) {
+    next_args->cb(next_result, next_args->user_data, next_args->bytes_to_send,
+                  next_args->bytes_to_send_size, next_args->handshaker_result);
+  }
+}
+
+grpc_core::CertificateSelector* GetCertificateSelector(
+    tsi_ssl_handshaker* handshaker) {
+  if (handshaker->is_client) {
+    return nullptr;
+  }
+  return reinterpret_cast<tsi_ssl_server_handshaker_factory*>(
+             handshaker->factory_ref)
+      ->certificate_selector.get();
+}
+
+// Invoked by BoringSSL to get the result of cert selection.
+ssl_select_cert_result_t SelectCertificateCallback(
+    const SSL_CLIENT_HELLO* client_hello)
+    ABSL_EXCLUSIVE_LOCKS_REQUIRED(&tsi_ssl_handshaker::mu) {
+  tsi_ssl_handshaker* handshaker = GetHandshaker(client_hello->ssl);
+  // Sanity check. Should never happen.
+  if (handshaker == nullptr || client_hello == nullptr) {
+    handshaker->MaybeSetError(
+        "SelectCertificateCallback failed because handshaker or client_hello "
+        "is nullptr; this should never happen.");
+    return ssl_select_cert_error;
+  }
+  grpc_core::CertificateSelector* cert_selector =
+      GetCertificateSelector(handshaker);
+  if (cert_selector == nullptr) {
+    handshaker->MaybeSetError(
+        "SelectCertificateCallback failed because certificate selector "
+        "is nullptr; this should never happen.");
+    return ssl_select_cert_error;
+  }
+  // The async cert selection is finished.
+  if (handshaker->cert_selection_status.has_value()) {
+    if (!handshaker->cert_selection_status->ok()) {
+      VLOG(2) << "Async cert selection failed: "
+              << *handshaker->cert_selection_status;
+      handshaker->MaybeSetError(handshaker->cert_selection_status->ToString());
+      return ssl_select_cert_error;
+    }
+    // The cert selection is done.
+    return ssl_select_cert_success;
+  }
+  // The callback holds a ref to the handshaker to ensure it's not destroyed
+  // when the callback is invoked asynchronously.
+  std::variant<absl::StatusOr<SelectCertificateResult>,
+               std::shared_ptr<AsyncCertificateSelectionHandle>>
+      result = cert_selector->SelectCertificate(
+          PrepareSelectCertificateInfo(client_hello),
+          absl::bind_front(OnSelectCertificateDone, handshaker->Ref()));
+  // The outer function guarantees the mutex lock, and we have to disable the
+  // absl thread safety analysis because the use of MatchMutable.
+  return grpc_core::MatchMutable(
+      &result,
+      [&](absl::StatusOr<SelectCertificateResult>* select_cert_result)
+          ABSL_NO_THREAD_SAFETY_ANALYSIS {
+            if (!select_cert_result->ok()) {
+              VLOG(2) << "Sync select cert failed: "
+                      << select_cert_result->status();
+              handshaker->MaybeSetError(
+                  select_cert_result->status().ToString());
+              return ssl_select_cert_error;
+            }
+            absl::Status status = ProcessSelectCertificateResult(
+                handshaker, *std::move(*select_cert_result));
+            if (!status.ok()) {
+              LOG(INFO) << "Sync select cert failed: " << status;
+              handshaker->MaybeSetError(status.ToString());
+              return ssl_select_cert_error;
+            }
+            return ssl_select_cert_success;
+          },
+      [&](std::shared_ptr<AsyncCertificateSelectionHandle>* async_handle)
+          ABSL_NO_THREAD_SAFETY_ANALYSIS {
+            handshaker->cert_selection_handle = std::move(*async_handle);
+            return ssl_select_cert_retry;
+          });
+}
 #endif  // defined(OPENSSL_IS_BORINGSSL)
 
 #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ENGINE)
 static const char kSslEnginePrefix[] = "engine:";
 #endif
 
-#if OPENSSL_VERSION_NUMBER < 0x10100000
+#if OPENSSL_VERSION_NUMBER < 0x10101000L
 static gpr_mu* g_openssl_mutexes = nullptr;
 static void openssl_locking_cb(int mode, int type, const char* file,
                                int line) GRPC_UNUSED;
@@ -519,39 +928,14 @@ static void verified_root_cert_free(void* /*parent*/, void* ptr,
 }
 
 static void init_openssl(void) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000
-  OPENSSL_init_ssl(0, nullptr);
-  // Ensure OPENSSL global clean up happens after gRPC shutdown completes.
-  // OPENSSL registers an exit handler to clean up global objects, which
-  // otherwise may happen before gRPC removes all references to OPENSSL. Below
-  // exit handler is guaranteed to run after OPENSSL's.
-  std::atexit([]() {
-    // Retrieve the OpenSSL cleanup timeout from the environment variable.
-    // This allows users to override the default cleanup timeout for OpenSSL
-    // resource deallocation during gRPC shutdown.
-    std::optional<std::string> env =
-        grpc_core::GetEnv(GRPC_ARG_OPENSSL_CLEANUP_TIMEOUT_ENV);
-    int timeout_sec = 2;
-    if (env.has_value()) {
-      int parsed_timeout_sec = 0;
-      if (absl::SimpleAtoi(*env, &parsed_timeout_sec)) {
-        timeout_sec = parsed_timeout_sec;
-      } else {
-        GRPC_TRACE_LOG(tsi, ERROR)
-            << "Invalid value [" << (*env) << "] for "
-            << GRPC_ARG_OPENSSL_CLEANUP_TIMEOUT_ENV
-            << " environment variable. Using default value of 2 seconds.";
-      }
-    }
-
-    grpc_wait_for_shutdown_with_timeout(absl::Seconds(timeout_sec));
-  });
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+  OPENSSL_init_ssl(OPENSSL_INIT_NO_ATEXIT, nullptr);
 #else
   SSL_library_init();
   SSL_load_error_strings();
   OpenSSL_add_all_algorithms();
 #endif
-#if OPENSSL_VERSION_NUMBER < 0x10100000
+#if OPENSSL_VERSION_NUMBER < 0x10101000L
   if (!CRYPTO_get_locking_callback()) {
     int num_locks = CRYPTO_num_locks();
     GRPC_CHECK_GT(num_locks, 0);
@@ -639,9 +1023,7 @@ static int looks_like_ip_address(absl::string_view name) {
 static tsi_result ssl_get_x509_common_name(X509* cert, unsigned char** utf8,
                                            size_t* utf8_size) {
   int common_name_index = -1;
-  X509_NAME_ENTRY* common_name_entry = nullptr;
-  ASN1_STRING* common_name_asn1 = nullptr;
-  X509_NAME* subject_name = X509_get_subject_name(cert);
+  auto* subject_name = X509_get_subject_name(cert);
   int utf8_returned_size = 0;
   if (subject_name == nullptr) {
     VLOG(2) << "Could not get subject name from certificate.";
@@ -653,12 +1035,13 @@ static tsi_result ssl_get_x509_common_name(X509* cert, unsigned char** utf8,
     VLOG(2) << "Could not get common name of subject from certificate.";
     return TSI_NOT_FOUND;
   }
-  common_name_entry = X509_NAME_get_entry(subject_name, common_name_index);
+  auto* common_name_entry =
+      X509_NAME_get_entry(subject_name, common_name_index);
   if (common_name_entry == nullptr) {
     LOG(ERROR) << "Could not get common name entry from certificate.";
     return TSI_INTERNAL_ERROR;
   }
-  common_name_asn1 = X509_NAME_ENTRY_get_data(common_name_entry);
+  auto* common_name_asn1 = X509_NAME_ENTRY_get_data(common_name_entry);
   if (common_name_asn1 == nullptr) {
     LOG(ERROR) << "Could not get common name entry asn1 from certificate.";
     return TSI_INTERNAL_ERROR;
@@ -699,7 +1082,7 @@ static tsi_result peer_property_from_x509_common_name(
 static tsi_result peer_property_from_x509_subject(X509* cert,
                                                   tsi_peer_property* property,
                                                   bool is_verified_root_cert) {
-  X509_NAME* subject_name = X509_get_subject_name(cert);
+  auto* subject_name = X509_get_subject_name(cert);
   if (subject_name == nullptr) {
     GRPC_TRACE_LOG(tsi, INFO) << "Could not get subject name from certificate.";
     return TSI_NOT_FOUND;
@@ -795,17 +1178,30 @@ static tsi_result add_subject_alt_names_properties_to_peer(
       char ntop_buf[INET6_ADDRSTRLEN];
       int af;
 
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+      if (ASN1_STRING_length(subject_alt_name->d.iPAddress) == 4) {
+        af = AF_INET;
+      } else if (ASN1_STRING_length(subject_alt_name->d.iPAddress) == 16) {
+        af = AF_INET6;
+#else
       if (subject_alt_name->d.iPAddress->length == 4) {
         af = AF_INET;
       } else if (subject_alt_name->d.iPAddress->length == 16) {
         af = AF_INET6;
+#endif
       } else {
         LOG(ERROR) << "SAN IP Address contained invalid IP";
         result = TSI_INTERNAL_ERROR;
         break;
       }
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+      const char* name =
+          inet_ntop(af, ASN1_STRING_get0_data(subject_alt_name->d.iPAddress),
+                    ntop_buf, INET6_ADDRSTRLEN);
+#else
       const char* name = inet_ntop(af, subject_alt_name->d.iPAddress->data,
                                    ntop_buf, INET6_ADDRSTRLEN);
+#endif
       if (name == nullptr) {
         LOG(ERROR) << "Could not get IP string from asn1 octet.";
         result = TSI_INTERNAL_ERROR;
@@ -894,9 +1290,11 @@ static tsi_result peer_from_x509(X509* cert, int include_certificate_type,
   if (subject_alt_names != nullptr) {
     sk_GENERAL_NAME_pop_free(subject_alt_names, GENERAL_NAME_free);
   }
-  if (result != TSI_OK) tsi_peer_destruct(peer);
-
-  GRPC_CHECK((int)peer->property_count == current_insert_index);
+  if (result != TSI_OK) {
+    tsi_peer_destruct(peer);
+  } else {
+    GRPC_CHECK((int)peer->property_count == current_insert_index);
+  }
   return result;
 }
 
@@ -1088,13 +1486,13 @@ static tsi_result x509_store_load_certs(X509_STORE* cert_store,
       break;  // We're at the end of stream.
     }
     if (root_names != nullptr) {
-      root_name = X509_get_subject_name(root);
-      if (root_name == nullptr) {
+      auto* root_subject = X509_get_subject_name(root);
+      if (root_subject == nullptr) {
         LOG(ERROR) << "Could not get name from root certificate.";
         result = TSI_INVALID_ARGUMENT;
         break;
       }
-      root_name = X509_NAME_dup(root_name);
+      root_name = X509_NAME_dup(const_cast<X509_NAME*>(root_subject));
       if (root_name == nullptr) {
         result = TSI_OUT_OF_RESOURCES;
         break;
@@ -1147,22 +1545,22 @@ static tsi_result ssl_ctx_load_verification_certs(SSL_CTX* context,
 // Populates the SSL context with a private key and a cert chain, and sets the
 // cipher list and the ephemeral ECDH key.
 static tsi_result populate_ssl_context(
-    SSL_CTX* context, const tsi_ssl_pem_key_cert_pair* key_cert_pair,
+    SSL_CTX* context, const grpc_core::PemKeyCertPair* key_cert_pair,
     const char* cipher_list,
     const std::vector<grpc_tls_key_exchange_group>& key_exchange_groups) {
   tsi_result result = TSI_OK;
   if (key_cert_pair != nullptr) {
-    if (!key_cert_pair->cert_chain.empty()) {
+    if (!key_cert_pair->cert_chain().empty()) {
       result = ssl_ctx_use_certificate_chain(
-          context, key_cert_pair->cert_chain.c_str(),
-          key_cert_pair->cert_chain.length());
+          context, key_cert_pair->cert_chain().c_str(),
+          key_cert_pair->cert_chain().length());
       if (result != TSI_OK) {
         LOG(ERROR) << "Invalid cert chain file.";
         return result;
       }
     }
     result = grpc_core::Match(
-        key_cert_pair->private_key,
+        key_cert_pair->private_key(),
         [&](const std::string& pem_root_certs) {
           tsi_result result = TSI_OK;
           result = ssl_ctx_use_private_key(context, pem_root_certs.data(),
@@ -1193,40 +1591,9 @@ static tsi_result populate_ssl_context(
     LOG(ERROR) << "Invalid cipher list: " << cipher_list;
     return TSI_INVALID_ARGUMENT;
   }
-  if (!key_exchange_groups.empty()) {
-    std::vector<absl::string_view> group_names;
-    group_names.reserve(key_exchange_groups.size());
-    for (const auto& group : key_exchange_groups) {
-      auto group_name = tsi::ConvertKeyExchangeGroupToString(group);
-      if (!group_name.ok()) {
-        LOG(ERROR) << "Could not convert key exchange group to string.";
-        return TSI_INVALID_ARGUMENT;
-      }
-      group_names.push_back(*group_name);
-    }
-#if OPENSSL_VERSION_NUMBER >= 0x10101000L
-    std::string group_list_str = absl::StrJoin(group_names, ":");
-    if (!SSL_CTX_set1_groups_list(context, group_list_str.c_str())) {
-      LOG(ERROR) << "Could not set key exchange groups: " << group_list_str;
-      return TSI_INTERNAL_ERROR;
-    }
-    SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
-#else
-    LOG(ERROR) << "SSL_CTX_set1_groups is not supported in OpenSSL < 1.1.1 "
-                  "version.";
-    return TSI_FAILED_PRECONDITION;
-#endif  // OPENSSL_VERSION_NUMBER >= 0x10100000
-  } else {
-#if OPENSSL_VERSION_NUMBER < 0x30000000L
-    EC_KEY* ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
-    if (!SSL_CTX_set_tmp_ecdh(context, ecdh)) {
-      LOG(ERROR) << "Could not set ephemeral ECDH key.";
-      EC_KEY_free(ecdh);
-      return TSI_INTERNAL_ERROR;
-    }
-    SSL_CTX_set_options(context, SSL_OP_SINGLE_ECDH_USE);
-    EC_KEY_free(ecdh);
-#endif
+  result = SetKeyExchangeGroups(context, key_exchange_groups);
+  if (result != TSI_OK) {
+    return result;
   }
   return TSI_OK;
 }
@@ -1713,8 +2080,8 @@ static tsi_result tsi_set_min_and_max_tls_versions(
 // --- tsi_ssl_root_certs_store methods implementation. ---
 
 tsi_ssl_root_certs_store* tsi_ssl_root_certs_store_create(
-    const char* pem_roots) {
-  if (pem_roots == nullptr) {
+    absl::string_view pem_roots) {
+  if (pem_roots.empty()) {
     LOG(ERROR) << "The root certificates are empty.";
     return nullptr;
   }
@@ -1730,8 +2097,8 @@ tsi_ssl_root_certs_store* tsi_ssl_root_certs_store_create(
     gpr_free(root_store);
     return nullptr;
   }
-  tsi_result result = x509_store_load_certs(root_store->store, pem_roots,
-                                            strlen(pem_roots), nullptr);
+  tsi_result result = x509_store_load_certs(root_store->store, pem_roots.data(),
+                                            pem_roots.size(), nullptr);
   if (result != TSI_OK) {
     LOG(ERROR) << "Could not load root certificates.";
     X509_STORE_free(root_store->store);
@@ -1925,6 +2292,9 @@ static tsi_result ssl_handshaker_result_extract_peer(
   // the peer's certificate is not present in the stack
   STACK_OF(X509)* peer_chain = SSL_get_peer_cert_chain(impl->ssl);
 
+  const char* server_name =
+      SSL_get_servername(impl->ssl, TLSEXT_NAMETYPE_host_name);
+  const char* tls_version = SSL_get_version(impl->ssl);
   X509* verified_root_cert = static_cast<X509*>(
       SSL_get_ex_data(impl->ssl, g_ssl_ex_verified_root_cert_index));
   // 1 is for session reused property.
@@ -1932,6 +2302,14 @@ static tsi_result ssl_handshaker_result_extract_peer(
   if (alpn_selected != nullptr) new_property_count++;
   if (peer_chain != nullptr) new_property_count++;
   if (verified_root_cert != nullptr) new_property_count++;
+  if (server_name != nullptr) new_property_count++;
+  if (tls_version != nullptr) new_property_count++;
+#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x30000000L
+  int nid = SSL_get_negotiated_group(impl->ssl);
+  const char* negotiated_group_name =
+      (nid != NID_undef && nid != 0) ? OBJ_nid2sn(nid) : nullptr;
+  if (negotiated_group_name != nullptr) new_property_count++;
+#endif
   tsi_peer_property* new_properties = static_cast<tsi_peer_property*>(
       gpr_zalloc(sizeof(*new_properties) * new_property_count));
   for (size_t i = 0; i < peer->property_count; i++) {
@@ -1968,6 +2346,20 @@ static tsi_result ssl_handshaker_result_extract_peer(
   if (result != TSI_OK) return result;
   peer->property_count++;
 
+  if (server_name != nullptr) {
+    result = tsi_construct_string_peer_property_from_cstring(
+        TSI_SSL_REQUESTED_SERVER_NAME_PEER_PROPERTY, server_name,
+        &peer->properties[peer->property_count]);
+    if (result != TSI_OK) return result;
+    peer->property_count++;
+  }
+  if (tls_version != nullptr) {
+    result = tsi_construct_string_peer_property_from_cstring(
+        TSI_SSL_TLS_VERSION_PEER_PROPERTY, tls_version,
+        &peer->properties[peer->property_count]);
+    if (result != TSI_OK) return result;
+    peer->property_count++;
+  }
   if (verified_root_cert != nullptr) {
     result = peer_property_from_x509_subject(
         verified_root_cert, &peer->properties[peer->property_count], true);
@@ -1978,6 +2370,16 @@ static tsi_result ssl_handshaker_result_extract_peer(
     peer->property_count++;
   }
 
+#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER >= 0x30000000L
+  if (negotiated_group_name != nullptr) {
+    result = tsi_construct_string_peer_property_from_cstring(
+        TSI_SSL_NEGOTIATED_KEY_EXCHANGE_GROUP, negotiated_group_name,
+        &peer->properties[peer->property_count]);
+    if (result != TSI_OK) return result;
+    peer->property_count++;
+  }
+#endif
+
   return result;
 }
 
@@ -2120,11 +2522,11 @@ static tsi_result ssl_handshaker_get_result(tsi_ssl_handshaker* impl) {
   return impl->result;
 }
 
-static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl)
+static SslHandshakeResult ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl)
     ABSL_EXCLUSIVE_LOCKS_REQUIRED(&tsi_ssl_handshaker::mu) {
   if (ssl_handshaker_get_result(impl) != TSI_HANDSHAKE_IN_PROGRESS) {
     impl->result = TSI_OK;
-    return impl->result;
+    return {impl->result, SSL_ERROR_NONE, 0};
   } else {
     ERR_clear_error();
     // Get ready to get some bytes from SSL.
@@ -2134,21 +2536,24 @@ static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl)
       case SSL_ERROR_WANT_READ:
         if (BIO_pending(impl->network_io) == 0) {
           // We need more data.
-          return TSI_INCOMPLETE_DATA;
+          return {TSI_INCOMPLETE_DATA, SSL_ERROR_NONE, 0};
         } else {
-          return TSI_OK;
+          return {TSI_OK, SSL_ERROR_NONE, 0};
         }
       case SSL_ERROR_NONE:
-        return TSI_OK;
+        return {TSI_OK, SSL_ERROR_NONE, 0};
       case SSL_ERROR_WANT_WRITE:
-        return TSI_DRAIN_BUFFER;
+        return {TSI_DRAIN_BUFFER, SSL_ERROR_NONE, 0};
 #if defined(OPENSSL_IS_BORINGSSL)
       case SSL_ERROR_WANT_PRIVATE_KEY_OPERATION:
-        return TSI_ASYNC;
+        return {TSI_ASYNC, SSL_ERROR_NONE, 0};
+      case SSL_ERROR_PENDING_CERTIFICATE:
+        return {TSI_ASYNC, SSL_ERROR_NONE, 0};
 #endif
       default: {
         char err_str[256];
-        ERR_error_string_n(ERR_get_error(), err_str, sizeof(err_str));
+        unsigned long err_code = ERR_get_error();
+        ERR_error_string_n(err_code, err_str, sizeof(err_str));
         long verify_result = SSL_get_verify_result(impl->ssl);
         std::string verify_result_str;
         if (verify_result != X509_V_OK) {
@@ -2167,19 +2572,19 @@ static tsi_result ssl_handshaker_do_handshake(tsi_ssl_handshaker* impl)
                                          err_str, verify_result_str,
                                          signer_error));
         impl->result = TSI_PROTOCOL_FAILURE;
-        return impl->result;
+        return {impl->result, ssl_result, err_code};
       }
     }
   }
 }
 
-static tsi_result ssl_handshaker_process_bytes_from_peer(
+static SslHandshakeResult ssl_handshaker_process_bytes_from_peer(
     tsi_ssl_handshaker* impl, const unsigned char* bytes, size_t* bytes_size)
     ABSL_EXCLUSIVE_LOCKS_REQUIRED(&tsi_ssl_handshaker::mu) {
   int bytes_written_into_ssl_size = 0;
   if (bytes == nullptr || bytes_size == nullptr || *bytes_size > INT_MAX) {
     impl->MaybeSetError("invalid argument");
-    return TSI_INVALID_ARGUMENT;
+    return {TSI_INVALID_ARGUMENT, SSL_ERROR_NONE, 0};
   }
   GRPC_CHECK_LE(*bytes_size, static_cast<size_t>(INT_MAX));
   bytes_written_into_ssl_size =
@@ -2188,7 +2593,7 @@ static tsi_result ssl_handshaker_process_bytes_from_peer(
     LOG(ERROR) << "Could not write to memory BIO.";
     impl->MaybeSetError("could not write to memory BIO");
     impl->result = TSI_INTERNAL_ERROR;
-    return impl->result;
+    return {impl->result, SSL_ERROR_NONE, 0};
   }
   *bytes_size = static_cast<size_t>(bytes_written_into_ssl_size);
   return ssl_handshaker_do_handshake(impl);
@@ -2257,10 +2662,10 @@ static tsi_result ssl_handshaker_write_output_buffer(tsi_ssl_handshaker* impl,
   return status;
 }
 
-static tsi_result ssl_handshaker_next_impl(tsi_ssl_handshaker* self)
+static SslHandshakeResult ssl_handshaker_next_impl(tsi_ssl_handshaker* self)
     ABSL_EXCLUSIVE_LOCKS_REQUIRED(&tsi_ssl_handshaker::mu) {
   // If there are received bytes, process them first.
-  tsi_result status = TSI_OK;
+  SslHandshakeResult handshake_result = {TSI_OK, SSL_ERROR_NONE, 0};
   size_t bytes_written = 0;
   if (!self->handshaker_next_args->received_bytes.empty()) {
     size_t received_bytes_size =
@@ -2271,23 +2676,25 @@ static tsi_result ssl_handshaker_next_impl(tsi_ssl_handshaker* self)
     size_t remaining_bytes_to_write_to_openssl_size = received_bytes_size;
     size_t number_bio_write_attempts = 0;
     while (remaining_bytes_to_write_to_openssl_size > 0 &&
-           (status == TSI_OK || status == TSI_INCOMPLETE_DATA) &&
+           (handshake_result.tsi_handshake_result == TSI_OK ||
+            handshake_result.tsi_handshake_result == TSI_INCOMPLETE_DATA) &&
            number_bio_write_attempts < TSI_SSL_MAX_BIO_WRITE_ATTEMPTS) {
       ++number_bio_write_attempts;
       // Try to write all of the remaining bytes to the BIO.
       size_t bytes_written_to_openssl =
           remaining_bytes_to_write_to_openssl_size;
-      status = ssl_handshaker_process_bytes_from_peer(
+      handshake_result = ssl_handshaker_process_bytes_from_peer(
           self, remaining_bytes_to_write_to_openssl, &bytes_written_to_openssl);
       // As long as the BIO is full, drive the SSL handshake to consume bytes
       // from the BIO. If the SSL handshake returns any bytes, write them to
       // the peer.
-      while (status == TSI_DRAIN_BUFFER) {
-        status = ssl_handshaker_write_output_buffer(self, &bytes_written);
+      while (handshake_result.tsi_handshake_result == TSI_DRAIN_BUFFER) {
+        tsi_result status =
+            ssl_handshaker_write_output_buffer(self, &bytes_written);
         if (status != TSI_OK) {
-          return status;
+          return {status, SSL_ERROR_NONE, 0};
         }
-        status = ssl_handshaker_do_handshake(self);
+        handshake_result = ssl_handshaker_do_handshake(self);
       }
       // Move the pointer to the first byte not yet successfully written to
       // the BIO.
@@ -2306,21 +2713,22 @@ static tsi_result ssl_handshaker_next_impl(tsi_ssl_handshaker* self)
       self->handshaker_next_args->received_bytes.clear();
     }
 #if defined(OPENSSL_IS_BORINGSSL)
-  } else if (self->key_signer != nullptr) {
-    // During the PrivateKeyOffload signature, an empty call to
-    // ssl_handshaker_do_handshake needs to be forced  after the async offload
-    // has completed.
-    status = ssl_handshaker_do_handshake(self);
+  } else if (self->key_signer != nullptr ||
+             GetCertificateSelector(self) != nullptr) {
+    // After an asynchronous certificate selection offload or private key
+    // offload, another call to ssl_handshaker_do_handshake needs to be
+    // triggered to continue the SSL handshake.
+    handshake_result = ssl_handshaker_do_handshake(self);
 #endif
   }
 
-  if (status != TSI_OK) {
-    return status;
+  if (handshake_result.tsi_handshake_result != TSI_OK) {
+    return handshake_result;
   }
   // Get bytes to send to the peer, if available.
-  status = ssl_handshaker_write_output_buffer(self, &bytes_written);
+  tsi_result status = ssl_handshaker_write_output_buffer(self, &bytes_written);
   if (status != TSI_OK) {
-    return status;
+    return {status, SSL_ERROR_NONE, 0};
   }
   self->handshaker_next_args->bytes_to_send = self->outgoing_bytes_buffer;
   self->handshaker_next_args->bytes_to_send_size = bytes_written;
@@ -2336,14 +2744,14 @@ static tsi_result ssl_handshaker_next_impl(tsi_ssl_handshaker* self)
     size_t unused_bytes_size = 0;
     status = ssl_bytes_remaining(self, &unused_bytes, &unused_bytes_size);
     if (status != TSI_OK) {
-      return status;
+      return {status, SSL_ERROR_NONE, 0};
     }
     if (unused_bytes_size >
         self->handshaker_next_args->original_received_bytes_size) {
       LOG(ERROR) << "More unused bytes than received bytes.";
       gpr_free(unused_bytes);
       self->MaybeSetError("More unused bytes than received bytes.");
-      return TSI_INTERNAL_ERROR;
+      return {TSI_INTERNAL_ERROR, SSL_ERROR_NONE, 0};
     }
     status =
         ssl_handshaker_result_create(self, unused_bytes, unused_bytes_size);
@@ -2364,8 +2772,9 @@ static tsi_result ssl_handshaker_next_impl(tsi_ssl_handshaker* self)
         }
       }
     }
+    return {status, SSL_ERROR_NONE, 0};
   }
-  return status;
+  return {status, SSL_ERROR_NONE, 0};
 }
 
 // Wrapper for ssl_handshaker_next_impl() when called from an async callback.
@@ -2376,13 +2785,14 @@ ssl_handshaker_next_async(tsi_ssl_handshaker* self)
   if (self->is_shutdown || !self->handshaker_next_args.has_value()) {
     return {TSI_HANDSHAKE_SHUTDOWN, std::nullopt};
   }
-  tsi_result result = ssl_handshaker_next_impl(self);
-  if (result != TSI_ASYNC) {
+  SslHandshakeResult handshake_result = ssl_handshaker_next_impl(self);
+  if (handshake_result.tsi_handshake_result != TSI_ASYNC) {
+    self->MaybeRecordTelemetry(handshake_result);
     // We now have a result to return to the caller via the callback.
     std::optional<HandshakerNextArgs> args =
         std::move(self->handshaker_next_args);
     self->handshaker_next_args.reset();
-    return {result, std::move(args)};
+    return {handshake_result.tsi_handshake_result, std::move(args)};
   }
   return {TSI_ASYNC, std::nullopt};
 }
@@ -2401,7 +2811,7 @@ static tsi_result ssl_handshaker_next(
     return TSI_INVALID_ARGUMENT;
   }
   tsi_ssl_handshaker* impl = static_cast<tsi_ssl_handshaker*>(self);
-  grpc_core::MutexLock lock(&impl->mu);
+  grpc_core::MutexLock lock(impl->mu);
   if (impl->is_shutdown) {
     if (error != nullptr) *error = "Handshaker shutdown";
     return TSI_HANDSHAKE_SHUTDOWN;
@@ -2418,37 +2828,64 @@ static tsi_result ssl_handshaker_next(
   impl->handshaker_next_args->user_data = user_data;
   impl->handshaker_next_args->error_ptr = error;
   // Now do the actual work.
-  tsi_result result = ssl_handshaker_next_impl(impl);
+  SslHandshakeResult handshake_result = ssl_handshaker_next_impl(impl);
   // If returning synchronously, propagate output and clear args.
-  if (result != TSI_ASYNC) {
+  if (handshake_result.tsi_handshake_result != TSI_ASYNC) {
     *bytes_to_send = impl->handshaker_next_args->bytes_to_send;
     *bytes_to_send_size = impl->handshaker_next_args->bytes_to_send_size;
     *handshaker_result = impl->handshaker_next_args->handshaker_result;
+    impl->MaybeRecordTelemetry(handshake_result);
     impl->handshaker_next_args.reset();
   }
-  return result;
+  return handshake_result.tsi_handshake_result;
 }
 
-static void ssl_handshaker_shutdown(tsi_handshaker* self) {
-#if defined(OPENSSL_IS_BORINGSSL)
+static void ssl_handshaker_shutdown(tsi_handshaker* self, bool peer_closed) {
   tsi_ssl_handshaker* impl = static_cast<tsi_ssl_handshaker*>(self);
+#if defined(OPENSSL_IS_BORINGSSL)
+  std::shared_ptr<grpc_core::PrivateKeySigner> key_signer;
   std::shared_ptr<grpc_core::PrivateKeySigner::AsyncSigningHandle>
       signing_handle;
+  std::shared_ptr<AsyncCertificateSelectionHandle> cert_selection_handle;
   std::optional<HandshakerNextArgs> next_args;
+#endif  // defined(OPENSSL_IS_BORINGSSL)
   {
-    grpc_core::MutexLock lock(&impl->mu);
+    grpc_core::MutexLock lock(impl->mu);
+    // Should never happen, if so something is very wrong
     if (impl->ssl == nullptr) return;
     impl->is_shutdown = true;
+    impl->MaybeRecordTelemetry({
+        /*tsi_result=*/peer_closed ? TSI_CLOSE_NOTIFY : TSI_HANDSHAKE_SHUTDOWN,
+        /*ssl_error=*/SSL_ERROR_NONE,
+        /*err_code=*/0,
+    });
+#if defined(OPENSSL_IS_BORINGSSL)
     if (impl->key_signer != nullptr && impl->signing_handle != nullptr) {
+      key_signer = std::move(impl->key_signer);
       signing_handle = std::move(impl->signing_handle);
     }
+    if (GetCertificateSelector(impl) != nullptr &&
+        impl->cert_selection_handle != nullptr) {
+      cert_selection_handle = std::move(impl->cert_selection_handle);
+    }
     if (impl->handshaker_next_args.has_value()) {
       next_args = std::move(*impl->handshaker_next_args);
       impl->handshaker_next_args.reset();
     }
   }
-  if (signing_handle != nullptr) {
-    impl->key_signer->Cancel(signing_handle);
+  // We must not invoke these Cancel functions while holding the mutex because
+  // this could lead to a deadlock due to mutexes being acquired in reverse
+  // order in different threads. In one thread, the key signer or cert selector
+  // plugin may be holding its own mutex while it invokes the on_complete
+  // callback, which will then acquire the mutex here.  So we can't also be
+  // holding the mutex here while calling the plugin's Cancel method, which may
+  // need to acquire its own mutex.
+  if (key_signer != nullptr) {
+    key_signer->Cancel(signing_handle);
+  }
+  if (cert_selection_handle != nullptr) {
+    reinterpret_cast<tsi_ssl_server_handshaker_factory*>(impl->factory_ref)
+        ->certificate_selector->Cancel(cert_selection_handle);
   }
   if (next_args.has_value()) {
     grpc_event_engine::experimental::GetDefaultEventEngine()->Run(
@@ -2461,8 +2898,8 @@ static void ssl_handshaker_shutdown(tsi_handshaker* self) {
                     args.handshaker_result);
           }
         });
-  }
 #endif  // defined(OPENSSL_IS_BORINGSSL)
+  }
 }
 
 static const tsi_handshaker_vtable handshaker_vtable = {
@@ -2492,15 +2929,17 @@ static void tsi_ssl_handshaker_resume_session(
 }
 
 static tsi_result create_tsi_ssl_handshaker(
-    SSL_CTX* ctx, int is_client, const char* server_name_indication,
+    SSL_CTX* ctx, bool is_client, const char* server_name_indication,
     size_t network_bio_buf_size, size_t ssl_bio_buf_size,
     std::optional<std::string> alpn_preferred_protocol_raw_list,
     std::shared_ptr<grpc_core::PrivateKeySigner> key_signer,
-    tsi_ssl_handshaker_factory* factory, tsi_handshaker** handshaker) {
+    tsi_ssl_handshaker_factory* factory,
+    grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope,
+    std::string target, std::string locality, std::string backend_service,
+    tsi_handshaker** handshaker) {
   SSL* ssl = SSL_new(ctx);
   BIO* network_io = nullptr;
   BIO* ssl_io = nullptr;
-  tsi_ssl_handshaker* impl = nullptr;
   *handshaker = nullptr;
   if (ctx == nullptr) {
     LOG(ERROR) << "SSL Context is null. Should never happen.";
@@ -2590,20 +3029,11 @@ static tsi_result create_tsi_ssl_handshaker(
     SSL_set_accept_state(ssl);
   }
 
-  impl = new tsi_ssl_handshaker();
-  impl->ssl = ssl;
-  impl->network_io = network_io;
-  impl->result = TSI_HANDSHAKE_IN_PROGRESS;
-  impl->outgoing_bytes_buffer_size =
-      TSI_SSL_HANDSHAKER_OUTGOING_BUFFER_INITIAL_SIZE;
-  impl->outgoing_bytes_buffer =
-      static_cast<unsigned char*>(gpr_zalloc(impl->outgoing_bytes_buffer_size));
-  impl->vtable = &handshaker_vtable;
-  impl->factory_ref = tsi_ssl_handshaker_factory_ref(factory);
-#if defined(OPENSSL_IS_BORINGSSL)
-  impl->key_signer = std::move(key_signer);
-#endif
-
+  tsi_ssl_handshaker* impl = new tsi_ssl_handshaker(
+      &handshaker_vtable, ssl, network_io,
+      tsi_ssl_handshaker_factory_ref(factory), std::move(collection_scope),
+      is_client, std::move(key_signer), std::move(target), std::move(locality),
+      std::move(backend_service));
   *handshaker = impl;
 
   if (!SSL_set_ex_data(ssl, g_ssl_ex_handshaker_index, impl)) {
@@ -2648,20 +3078,21 @@ tsi_result tsi_ssl_client_handshaker_factory_create_handshaker(
     const char* server_name_indication, size_t network_bio_buf_size,
     size_t ssl_bio_buf_size,
     std::optional<std::string> alpn_preferred_protocol_list,
+    grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope,
+    std::string target, std::string locality, std::string backend_service,
     tsi_handshaker** handshaker) {
   GRPC_TRACE_LOG(tsi, INFO)
       << "Creating SSL handshaker with SNI " << server_name_indication;
+  std::shared_ptr<grpc_core::PrivateKeySigner> key_signer;
 #if defined(OPENSSL_IS_BORINGSSL)
-  return create_tsi_ssl_handshaker(
-      factory->ssl_context, 1, server_name_indication, network_bio_buf_size,
-      ssl_bio_buf_size, alpn_preferred_protocol_list, factory->key_signer,
-      &factory->base, handshaker);
-#else
-  return create_tsi_ssl_handshaker(
-      factory->ssl_context, 1, server_name_indication, network_bio_buf_size,
-      ssl_bio_buf_size, alpn_preferred_protocol_list, /*key_signer=*/nullptr,
-      &factory->base, handshaker);
+  key_signer = factory->key_signer;
 #endif
+  return create_tsi_ssl_handshaker(
+      factory->ssl_context, /*is_client=*/true, server_name_indication,
+      network_bio_buf_size, ssl_bio_buf_size, alpn_preferred_protocol_list,
+      std::move(key_signer), &factory->base, std::move(collection_scope),
+      std::move(target), std::move(locality), std::move(backend_service),
+      handshaker);
 }
 
 void tsi_ssl_client_handshaker_factory_unref(
@@ -2701,23 +3132,24 @@ static int client_handshaker_factory_npn_callback(
 
 tsi_result tsi_ssl_server_handshaker_factory_create_handshaker(
     tsi_ssl_server_handshaker_factory* factory, size_t network_bio_buf_size,
-    size_t ssl_bio_buf_size, tsi_handshaker** handshaker) {
+    size_t ssl_bio_buf_size,
+    grpc_core::RefCountedPtr<grpc_core::CollectionScope> collection_scope,
+    tsi_handshaker** handshaker) {
   if (factory->ssl_contexts.empty()) return TSI_INVALID_ARGUMENT;
-#if defined(OPENSSL_IS_BORINGSSL)
   // Create the handshaker with the first context. We will switch if needed
   // because of SNI in ssl_server_handshaker_factory_servername_callback.
   // Likewise, we pass the private key signer corresponding to the first
   // context.
-  return create_tsi_ssl_handshaker(
-      factory->ssl_contexts[0].ssl_ctx, 0, nullptr, network_bio_buf_size,
-      ssl_bio_buf_size, std::nullopt, factory->ssl_contexts[0].key_signer,
-      &factory->base, handshaker);
-#else
-  return create_tsi_ssl_handshaker(factory->ssl_contexts[0].ssl_ctx, 0, nullptr,
-                                   network_bio_buf_size, ssl_bio_buf_size,
-                                   std::nullopt, /*key_signer=*/nullptr,
-                                   &factory->base, handshaker);
+  std::shared_ptr<grpc_core::PrivateKeySigner> key_signer;
+#if defined(OPENSSL_IS_BORINGSSL)
+  key_signer = factory->ssl_contexts[0].key_signer;
 #endif
+  return create_tsi_ssl_handshaker(
+      factory->ssl_contexts[0].ssl_ctx, /*is_client=*/false,
+      /*server_name_indication=*/nullptr, network_bio_buf_size,
+      ssl_bio_buf_size, std::nullopt, std::move(key_signer), &factory->base,
+      std::move(collection_scope), /*target=*/"",
+      /*locality=*/"", /*backend_service=*/"", handshaker);
 }
 
 void tsi_ssl_server_handshaker_factory_unref(
@@ -2777,13 +3209,20 @@ static int does_entry_match_name(absl::string_view entry,
 
 static int ssl_server_handshaker_factory_servername_callback(SSL* ssl,
                                                              int* /*ap*/,
-                                                             void* arg) {
+                                                             void* arg)
+    ABSL_EXCLUSIVE_LOCKS_REQUIRED(&tsi_ssl_handshaker::mu) {
   tsi_ssl_server_handshaker_factory* impl =
       static_cast<tsi_ssl_server_handshaker_factory*>(arg);
   const char* servername = SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
   if (servername == nullptr || strlen(servername) == 0) {
     return SSL_TLSEXT_ERR_NOACK;
   }
+#if defined(OPENSSL_IS_BORINGSSL)
+  // The cert selector will handle SNI.
+  if (impl->certificate_selector != nullptr) {
+    return SSL_TLSEXT_ERR_OK;
+  }
+#endif
 
   for (const auto& ssl_context : impl->ssl_contexts) {
     if (tsi_ssl_peer_matches_name(&ssl_context.x509_subject_name, servername)) {
@@ -2852,7 +3291,7 @@ static tsi_ssl_handshaker_factory_vtable client_handshaker_factory_vtable = {
     tsi_ssl_client_handshaker_factory_destroy};
 
 tsi_result tsi_create_ssl_client_handshaker_factory(
-    const tsi_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    const grpc_core::PemKeyCertPair* pem_key_cert_pair,
     const char* pem_root_certs, const char* cipher_suites,
     const char** alpn_protocols, uint16_t num_alpn_protocols,
     tsi_ssl_client_handshaker_factory** factory) {
@@ -2945,7 +3384,7 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
 #if defined(OPENSSL_IS_BORINGSSL)
     if (options->pem_key_cert_pair != nullptr) {
       grpc_core::Match(
-          options->pem_key_cert_pair->private_key, [](const std::string&) {},
+          options->pem_key_cert_pair->private_key(), [](const std::string&) {},
           [&](const std::shared_ptr<grpc_core::PrivateKeySigner>& key_signer) {
             // The Handshaker Factory will own a shared copy of the reference
             // passed through the options.
@@ -2961,9 +3400,9 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
       SSL_CTX_set_cert_store(ssl_context, options->root_store->store);
     }
 #endif
-    if (OPENSSL_VERSION_NUMBER < 0x10100000 ||
-        (options->root_store == nullptr &&
-         options->root_cert_info != nullptr)) {
+    if (options->root_cert_info != nullptr &&
+        (OPENSSL_VERSION_NUMBER < 0x10100000 ||
+         options->root_store == nullptr)) {
       Match(
           *options->root_cert_info,
           [&](const std::string& pem_root_certs) {
@@ -3056,25 +3495,25 @@ static tsi_ssl_handshaker_factory_vtable server_handshaker_factory_vtable = {
     tsi_ssl_server_handshaker_factory_destroy};
 
 tsi_result tsi_create_ssl_server_handshaker_factory(
-    std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs,
+    grpc_core::KeyCertPairsOrSelector key_cert_pairs_or_selector,
     const char* pem_client_root_certs, int force_client_auth,
     const char* cipher_suites, const char** alpn_protocols,
     uint16_t num_alpn_protocols, tsi_ssl_server_handshaker_factory** factory) {
   return tsi_create_ssl_server_handshaker_factory_ex(
-      pem_key_cert_pairs, pem_client_root_certs,
+      std::move(key_cert_pairs_or_selector), pem_client_root_certs,
       force_client_auth ? TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY
                         : TSI_DONT_REQUEST_CLIENT_CERTIFICATE,
       cipher_suites, alpn_protocols, num_alpn_protocols, factory);
 }
 
 tsi_result tsi_create_ssl_server_handshaker_factory_ex(
-    std::vector<tsi_ssl_pem_key_cert_pair> pem_key_cert_pairs,
+    grpc_core::KeyCertPairsOrSelector key_cert_pairs_or_selector,
     const char* pem_client_root_certs,
     tsi_client_certificate_request_type client_certificate_request,
     const char* cipher_suites, const char** alpn_protocols,
     uint16_t num_alpn_protocols, tsi_ssl_server_handshaker_factory** factory) {
   tsi_ssl_server_handshaker_options options;
-  options.pem_key_cert_pairs = std::move(pem_key_cert_pairs);
+  options.key_cert_pairs_or_selector = std::move(key_cert_pairs_or_selector);
   if (pem_client_root_certs != nullptr) {
     options.root_cert_info =
         std::make_shared<tsi::RootCertInfo>(pem_client_root_certs);
@@ -3087,219 +3526,249 @@ tsi_result tsi_create_ssl_server_handshaker_factory_ex(
                                                                factory);
 }
 
-tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
+tsi_result tsi_configure_server_ssl_context(
     const tsi_ssl_server_handshaker_options* options,
-    tsi_ssl_server_handshaker_factory** factory) {
-  tsi_ssl_server_handshaker_factory* impl = nullptr;
-  tsi_result result = TSI_OK;
-  size_t i = 0;
+    const grpc_core::PemKeyCertPair* pem_key_cert_pair,
+    tsi_ssl_server_handshaker_factory* impl, SslContext& ssl_context) {
+#if OPENSSL_VERSION_NUMBER >= 0x10100000
+  ssl_context.ssl_ctx = SSL_CTX_new(TLS_method());
+#else
+  ssl_context.ssl_ctx = SSL_CTX_new(TLSv1_2_method());
+#endif
+#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
+  SSL_CTX_set_options(ssl_context.ssl_ctx, SSL_OP_NO_RENEGOTIATION);
+#endif
+  if (ssl_context.ssl_ctx == nullptr) {
+    tsi::LogSslErrorStack();
+    LOG(ERROR) << "Could not create ssl context.";
+    return TSI_OUT_OF_RESOURCES;
+  }
 
-  gpr_once_init(&g_init_openssl_once, init_openssl);
+  tsi_result result = tsi_set_min_and_max_tls_versions(
+      ssl_context.ssl_ctx, options->min_tls_version, options->max_tls_version);
+  if (result != TSI_OK) return result;
 
-  if (factory == nullptr) return TSI_INVALID_ARGUMENT;
-  *factory = nullptr;
-  if (options->pem_key_cert_pairs.empty()) {
-    return TSI_INVALID_ARGUMENT;
+  result = populate_ssl_context(ssl_context.ssl_ctx, pem_key_cert_pair,
+                                options->cipher_suites,
+                                options->key_exchange_groups);
+#if defined(OPENSSL_IS_BORINGSSL)
+  if (pem_key_cert_pair != nullptr) {
+    grpc_core::Match(
+        pem_key_cert_pair->private_key(), [](const std::string&) {},
+        [&](const std::shared_ptr<grpc_core::PrivateKeySigner>& key_signer) {
+          ssl_context.key_signer = key_signer;
+        });
   }
+#endif
+  if (result != TSI_OK) return result;
 
-  impl = new tsi_ssl_server_handshaker_factory();
-  tsi_ssl_handshaker_factory_init(&impl->base);
-  impl->base.vtable = &server_handshaker_factory_vtable;
+  // TODO(elessar): Provide ability to disable session ticket keys.
 
-  if (options->root_cert_info != nullptr) {
-    impl->root_cert_info = options->root_cert_info;
+  // Allow client cache sessions (it's needed for OpenSSL only).
+  int set_sid_ctx_result =
+      SSL_CTX_set_session_id_context(ssl_context.ssl_ctx, kSslSessionIdContext,
+                                     GPR_ARRAY_SIZE(kSslSessionIdContext));
+  if (set_sid_ctx_result == 0) {
+    LOG(ERROR) << "Failed to set session id context.";
+    return TSI_INTERNAL_ERROR;
   }
 
-  if (options->num_alpn_protocols > 0) {
-    result = BuildAlpnProtocolNameList(
-        options->alpn_protocols, options->num_alpn_protocols,
-        &impl->alpn_protocol_list, &impl->alpn_protocol_list_length);
+  if (options->session_ticket_key != nullptr) {
+    if (SSL_CTX_set_tlsext_ticket_keys(
+            ssl_context.ssl_ctx, const_cast<char*>(options->session_ticket_key),
+            options->session_ticket_key_size) == 0) {
+      LOG(ERROR) << "Invalid STEK size.";
+      return TSI_INVALID_ARGUMENT;
+    }
+  }
+  if (options->root_cert_info != nullptr) {
+    grpc_core::Match(
+        *options->root_cert_info,
+        [&](const std::string& pem_root_certs) {
+          STACK_OF(X509_NAME)* root_names = nullptr;
+          result = ssl_ctx_load_verification_certs(
+              ssl_context.ssl_ctx, pem_root_certs.c_str(),
+              pem_root_certs.size(), nullptr);
+          if (result != TSI_OK) {
+            LOG(ERROR) << "Invalid verification certs.";
+          }
+          if (options->send_client_ca_list) {
+            SSL_CTX_set_client_CA_list(ssl_context.ssl_ctx, root_names);
+          }
+        },
+        [&](const grpc_core::SpiffeBundleMap& spiffe_bundle_map) {
+          X509_STORE* cert_store = SSL_CTX_get_cert_store(ssl_context.ssl_ctx);
+          X509_STORE_set_flags(cert_store, X509_V_FLAG_PARTIAL_CHAIN |
+                                               X509_V_FLAG_TRUSTED_FIRST);
+          const void* p = &spiffe_bundle_map;
+          void* map = const_cast<void*>(p);
+          SSL_CTX_set_ex_data(ssl_context.ssl_ctx,
+                              g_ssl_ctx_ex_spiffe_bundle_map_index, map);
+        });
     if (result != TSI_OK) {
-      tsi_ssl_handshaker_factory_unref(&impl->base);
       return result;
     }
   }
-
-  if (options->key_logger != nullptr) {
-    impl->key_logger = options->key_logger->Ref();
+  switch (options->client_certificate_request) {
+    case TSI_DONT_REQUEST_CLIENT_CERTIFICATE:
+      SSL_CTX_set_verify(ssl_context.ssl_ctx, SSL_VERIFY_NONE, nullptr);
+      break;
+    case TSI_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
+      SSL_CTX_set_verify(ssl_context.ssl_ctx, SSL_VERIFY_PEER, nullptr);
+      SSL_CTX_set_cert_verify_callback(ssl_context.ssl_ctx, NullVerifyCallback,
+                                       nullptr);
+      break;
+    case TSI_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY:
+      SSL_CTX_set_verify(ssl_context.ssl_ctx, SSL_VERIFY_PEER, nullptr);
+      SSL_CTX_set_cert_verify_callback(ssl_context.ssl_ctx,
+                                       CustomVerificationFunction, nullptr);
+      break;
+    case TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
+      SSL_CTX_set_verify(ssl_context.ssl_ctx,
+                         SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
+                         nullptr);
+      SSL_CTX_set_cert_verify_callback(ssl_context.ssl_ctx, NullVerifyCallback,
+                                       nullptr);
+      break;
+    case TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY:
+      SSL_CTX_set_verify(ssl_context.ssl_ctx,
+                         SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
+                         nullptr);
+      SSL_CTX_set_cert_verify_callback(ssl_context.ssl_ctx,
+                                       CustomVerificationFunction, nullptr);
+      break;
   }
 
-  impl->ssl_contexts.reserve(options->pem_key_cert_pairs.size());
-  for (i = 0; i < options->pem_key_cert_pairs.size(); i++) {
-    SslContext& ssl_context = impl->ssl_contexts.emplace_back();
-    do {
-#if OPENSSL_VERSION_NUMBER >= 0x10100000
-      ssl_context.ssl_ctx = SSL_CTX_new(TLS_method());
-#else
-      ssl_context.ssl_ctx = SSL_CTX_new(TLSv1_2_method());
+#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
+  if (options->crl_provider != nullptr) {
+    SSL_CTX_set_ex_data(ssl_context.ssl_ctx, g_ssl_ctx_ex_crl_provider_index,
+                        options->crl_provider.get());
+  } else if (options->crl_directory != nullptr &&
+             strcmp(options->crl_directory, "") != 0) {
+    X509_STORE* cert_store = SSL_CTX_get_cert_store(ssl_context.ssl_ctx);
+    X509_STORE_set_verify_cb(cert_store, verify_cb);
+    if (!X509_STORE_load_locations(cert_store, nullptr,
+                                   options->crl_directory)) {
+      LOG(ERROR) << "Failed to load CRL File from directory.";
+    } else {
+      X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
+      X509_VERIFY_PARAM_set_flags(
+          param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
+    }
+  }
 #endif
+
+  if (pem_key_cert_pair != nullptr) {
+    result = tsi_ssl_extract_x509_subject_names_from_pem_cert(
+        pem_key_cert_pair->cert_chain().c_str(),
+        &ssl_context.x509_subject_name);
+    if (result != TSI_OK) return result;
+  }
+  // Always configure the callback because responding to SNI is required for
+  // ClientHello in TLS 1.3, and we need to respond to that.
+  SSL_CTX_set_tlsext_servername_callback(
+      ssl_context.ssl_ctx, ssl_server_handshaker_factory_servername_callback);
+  SSL_CTX_set_tlsext_servername_arg(ssl_context.ssl_ctx, impl);
+#if TSI_OPENSSL_ALPN_SUPPORT
+  SSL_CTX_set_alpn_select_cb(ssl_context.ssl_ctx,
+                             ServerHandshakerFactoryAlpnCallback, impl);
+#endif  // TSI_OPENSSL_ALPN_SUPPORT
+  SSL_CTX_set_next_protos_advertised_cb(
+      ssl_context.ssl_ctx, server_handshaker_factory_npn_advertised_callback,
+      impl);
+
 #if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
-      SSL_CTX_set_options(ssl_context.ssl_ctx, SSL_OP_NO_RENEGOTIATION);
+  // Register factory at index
+  if (options->key_logger != nullptr) {
+    // Need to set factory at g_ssl_ctx_ex_factory_index
+    SSL_CTX_set_ex_data(ssl_context.ssl_ctx, g_ssl_ctx_ex_factory_index, impl);
+    // SSL_CTX_set_keylog_callback is set here to register callback
+    // when ssl/tls handshakes complete.
+    SSL_CTX_set_keylog_callback(
+        ssl_context.ssl_ctx,
+        ssl_keylogging_callback<tsi_ssl_server_handshaker_factory>);
+  }
 #endif
-      if (ssl_context.ssl_ctx == nullptr) {
-        tsi::LogSslErrorStack();
-        LOG(ERROR) << "Could not create ssl context.";
-        result = TSI_OUT_OF_RESOURCES;
-        break;
-      }
 
-      result = tsi_set_min_and_max_tls_versions(ssl_context.ssl_ctx,
-                                                options->min_tls_version,
-                                                options->max_tls_version);
-      if (result != TSI_OK) return result;
+  return result;
+}
 
-      result = populate_ssl_context(
-          ssl_context.ssl_ctx, &options->pem_key_cert_pairs[i],
-          options->cipher_suites, options->key_exchange_groups);
-      if (result != TSI_OK) break;
+tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
+    const tsi_ssl_server_handshaker_options* options,
+    tsi_ssl_server_handshaker_factory** factory) {
+  tsi_ssl_server_handshaker_factory* impl = nullptr;
 
-#if defined(OPENSSL_IS_BORINGSSL)
-      grpc_core::Match(
-          options->pem_key_cert_pairs[i].private_key, [](const std::string&) {},
-          [&](const std::shared_ptr<grpc_core::PrivateKeySigner>& key_signer) {
-            ssl_context.key_signer = key_signer;
-          });
-#endif
+  gpr_once_init(&g_init_openssl_once, init_openssl);
 
-      // TODO(elessar): Provide ability to disable session ticket keys.
+  if (factory == nullptr) return TSI_INVALID_ARGUMENT;
+  *factory = nullptr;
 
-      // Allow client cache sessions (it's needed for OpenSSL only).
-      int set_sid_ctx_result = SSL_CTX_set_session_id_context(
-          ssl_context.ssl_ctx, kSslSessionIdContext,
-          GPR_ARRAY_SIZE(kSslSessionIdContext));
-      if (set_sid_ctx_result == 0) {
-        LOG(ERROR) << "Failed to set session id context.";
-        result = TSI_INTERNAL_ERROR;
-        break;
-      }
+  impl = new tsi_ssl_server_handshaker_factory();
+  tsi_ssl_handshaker_factory_init(&impl->base);
+  impl->base.vtable = &server_handshaker_factory_vtable;
 
-      if (options->session_ticket_key != nullptr) {
-        if (SSL_CTX_set_tlsext_ticket_keys(
-                ssl_context.ssl_ctx,
-                const_cast<char*>(options->session_ticket_key),
-                options->session_ticket_key_size) == 0) {
-          LOG(ERROR) << "Invalid STEK size.";
-          result = TSI_INVALID_ARGUMENT;
-          break;
+  tsi_result result = grpc_core::Match(
+      options->key_cert_pairs_or_selector,
+      [&](const grpc_core::PemKeyCertPairList& pem_key_cert_pairs) {
+        if (pem_key_cert_pairs.empty()) {
+          return TSI_INVALID_ARGUMENT;
         }
-      }
-      if (options->root_cert_info != nullptr) {
-        Match(
-            *options->root_cert_info,
-            [&](const std::string& pem_root_certs) {
-              STACK_OF(X509_NAME)* root_names = nullptr;
-              result = ssl_ctx_load_verification_certs(
-                  ssl_context.ssl_ctx, pem_root_certs.c_str(),
-                  pem_root_certs.size(), nullptr);
-              if (result != TSI_OK) {
-                LOG(ERROR) << "Invalid verification certs.";
-              }
-              if (options->send_client_ca_list) {
-                SSL_CTX_set_client_CA_list(ssl_context.ssl_ctx, root_names);
-              }
-            },
-            [&](const grpc_core::SpiffeBundleMap& spiffe_bundle_map) {
-              X509_STORE* cert_store =
-                  SSL_CTX_get_cert_store(ssl_context.ssl_ctx);
-              X509_STORE_set_flags(cert_store, X509_V_FLAG_PARTIAL_CHAIN |
-                                                   X509_V_FLAG_TRUSTED_FIRST);
-              const void* p = &spiffe_bundle_map;
-              void* map = const_cast<void*>(p);
-              SSL_CTX_set_ex_data(ssl_context.ssl_ctx,
-                                  g_ssl_ctx_ex_spiffe_bundle_map_index, map);
-            });
-        if (result != TSI_OK) {
-          break;
+        impl->ssl_contexts.reserve(pem_key_cert_pairs.size());
+        for (size_t i = 0; i < pem_key_cert_pairs.size(); ++i) {
+          SslContext& ssl_context = impl->ssl_contexts.emplace_back();
+          tsi_result result = tsi_configure_server_ssl_context(
+              options, &pem_key_cert_pairs[i], impl, ssl_context);
+          if (result != TSI_OK) {
+            return result;
+          }
         }
-      }
-      switch (options->client_certificate_request) {
-        case TSI_DONT_REQUEST_CLIENT_CERTIFICATE:
-          SSL_CTX_set_verify(ssl_context.ssl_ctx, SSL_VERIFY_NONE, nullptr);
-          break;
-        case TSI_REQUEST_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
-          SSL_CTX_set_verify(ssl_context.ssl_ctx, SSL_VERIFY_PEER, nullptr);
-          SSL_CTX_set_cert_verify_callback(ssl_context.ssl_ctx,
-                                           NullVerifyCallback, nullptr);
-          break;
-        case TSI_REQUEST_CLIENT_CERTIFICATE_AND_VERIFY:
-          SSL_CTX_set_verify(ssl_context.ssl_ctx, SSL_VERIFY_PEER, nullptr);
-          SSL_CTX_set_cert_verify_callback(ssl_context.ssl_ctx,
-                                           CustomVerificationFunction, nullptr);
-          break;
-        case TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_BUT_DONT_VERIFY:
-          SSL_CTX_set_verify(ssl_context.ssl_ctx,
-                             SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
-                             nullptr);
-          SSL_CTX_set_cert_verify_callback(ssl_context.ssl_ctx,
-                                           NullVerifyCallback, nullptr);
-          break;
-        case TSI_REQUEST_AND_REQUIRE_CLIENT_CERTIFICATE_AND_VERIFY:
-          SSL_CTX_set_verify(ssl_context.ssl_ctx,
-                             SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT,
-                             nullptr);
-          SSL_CTX_set_cert_verify_callback(ssl_context.ssl_ctx,
-                                           CustomVerificationFunction, nullptr);
-          break;
-      }
-
-#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(LIBRESSL_VERSION_NUMBER)
-      if (options->crl_provider != nullptr) {
-        SSL_CTX_set_ex_data(ssl_context.ssl_ctx,
-                            g_ssl_ctx_ex_crl_provider_index,
-                            options->crl_provider.get());
-      } else if (options->crl_directory != nullptr &&
-                 strcmp(options->crl_directory, "") != 0) {
-        X509_STORE* cert_store = SSL_CTX_get_cert_store(ssl_context.ssl_ctx);
-        X509_STORE_set_verify_cb(cert_store, verify_cb);
-        if (!X509_STORE_load_locations(cert_store, nullptr,
-                                       options->crl_directory)) {
-          LOG(ERROR) << "Failed to load CRL File from directory.";
-        } else {
-          X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
-          X509_VERIFY_PARAM_set_flags(
-              param, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
+        return TSI_OK;
+      },
+      [&](const std::shared_ptr<grpc_core::CertificateSelector>&
+              cert_selector) {
+#if defined(OPENSSL_IS_BORINGSSL)
+        if (cert_selector == nullptr) {
+          return TSI_INVALID_ARGUMENT;
         }
-      }
+        SslContext& ssl_context = impl->ssl_contexts.emplace_back();
+        tsi_result result = tsi_configure_server_ssl_context(
+            options, /*pem_key_cert_pair=*/nullptr, impl, ssl_context);
+        if (result != TSI_OK) {
+          return result;
+        }
+        impl->certificate_selector = cert_selector;
+        SSL_CTX_set_select_certificate_cb(ssl_context.ssl_ctx,
+                                          SelectCertificateCallback);
+        return TSI_OK;
+#else
+        VLOG(2) << "CertificateSelector is not supported with this SSL "
+                   "implementation.";
+        return TSI_UNIMPLEMENTED;
 #endif
+      });
+  if (result != TSI_OK) {
+    tsi_ssl_handshaker_factory_unref(&impl->base);
+    return result;
+  }
 
-      result = tsi_ssl_extract_x509_subject_names_from_pem_cert(
-          options->pem_key_cert_pairs[i].cert_chain.c_str(),
-          &ssl_context.x509_subject_name);
-      if (result != TSI_OK) break;
-
-      SSL_CTX_set_tlsext_servername_callback(
-          ssl_context.ssl_ctx,
-          ssl_server_handshaker_factory_servername_callback);
-      SSL_CTX_set_tlsext_servername_arg(ssl_context.ssl_ctx, impl);
-#if TSI_OPENSSL_ALPN_SUPPORT
-      SSL_CTX_set_alpn_select_cb(ssl_context.ssl_ctx,
-                                 ServerHandshakerFactoryAlpnCallback, impl);
-#endif  // TSI_OPENSSL_ALPN_SUPPORT
-      SSL_CTX_set_next_protos_advertised_cb(
-          ssl_context.ssl_ctx,
-          server_handshaker_factory_npn_advertised_callback, impl);
-
-#if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
-      // Register factory at index
-      if (options->key_logger != nullptr) {
-        // Need to set factory at g_ssl_ctx_ex_factory_index
-        SSL_CTX_set_ex_data(ssl_context.ssl_ctx, g_ssl_ctx_ex_factory_index,
-                            impl);
-        // SSL_CTX_set_keylog_callback is set here to register callback
-        // when ssl/tls handshakes complete.
-        SSL_CTX_set_keylog_callback(
-            ssl_context.ssl_ctx,
-            ssl_keylogging_callback<tsi_ssl_server_handshaker_factory>);
-      }
-#endif
-    } while (false);
+  if (options->root_cert_info != nullptr) {
+    impl->root_cert_info = options->root_cert_info;
+  }
 
+  if (options->num_alpn_protocols > 0) {
+    result = BuildAlpnProtocolNameList(
+        options->alpn_protocols, options->num_alpn_protocols,
+        &impl->alpn_protocol_list, &impl->alpn_protocol_list_length);
     if (result != TSI_OK) {
       tsi_ssl_handshaker_factory_unref(&impl->base);
       return result;
     }
   }
 
+  if (options->key_logger != nullptr) {
+    impl->key_logger = options->key_logger->Ref();
+  }
+
   *factory = impl;
   return TSI_OK;
 }