From 761de815c5cce3fb67f0d14ecabc5397497285ff Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Fri, 24 Jan 2025 16:58:32 -0800
Subject: [PATCH] test: move crypto related common utilities in common/crypto

Since `common/crypto` already exists, it makes sense to keep
crypto-related utilities there. The only exception being
common.hasCrypto which is needed up front to determine
if tests should be skipped.

Eliminate the redundant check in hasFipsCrypto and just
use crypto.getFips() directly where needed.

PR-URL: https://github.com/nodejs/node/pull/56714
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: Luigi Pinca <luigipinca@gmail.com>
---
 test/addons/openssl-providers/providers.cjs   |  7 ++-
 test/benchmark/test-benchmark-crypto.js       |  5 +-
 test/common/README.md                         | 17 ------
 test/common/crypto.js                         | 52 ++++++++++++++++++-
 test/common/index.js                          | 52 -------------------
 test/common/index.mjs                         |  2 -
 test/parallel/test-cli-node-options.js        |  3 +-
 test/parallel/test-crypto-authenticated.js    | 20 ++++---
 .../test-crypto-cipheriv-decipheriv.js        | 10 ++--
 test/parallel/test-crypto-classes.js          |  6 +--
 test/parallel/test-crypto-dh-constructor.js   |  3 +-
 test/parallel/test-crypto-dh-errors.js        |  3 +-
 test/parallel/test-crypto-dh-generate-keys.js |  3 +-
 test/parallel/test-crypto-dh-leak.js          |  3 +-
 test/parallel/test-crypto-dh-odd-key.js       |  8 +--
 test/parallel/test-crypto-dh-stateless.js     |  7 +--
 test/parallel/test-crypto-dh.js               | 17 +++---
 test/parallel/test-crypto-ecb.js              | 13 +++--
 test/parallel/test-crypto-fips.js             |  5 +-
 test/parallel/test-crypto-hash.js             |  7 +--
 test/parallel/test-crypto-hkdf.js             |  5 +-
 test/parallel/test-crypto-hmac.js             |  5 +-
 test/parallel/test-crypto-key-objects.js      | 10 ++--
 ...test-crypto-keygen-async-dsa-key-object.js |  8 +--
 test/parallel/test-crypto-keygen-async-dsa.js |  8 +--
 ...-explicit-elliptic-curve-encrypted-p256.js |  4 +-
 ...nc-explicit-elliptic-curve-encrypted.js.js |  3 +-
 ...ync-named-elliptic-curve-encrypted-p256.js |  3 +-
 ...en-async-named-elliptic-curve-encrypted.js |  3 +-
 test/parallel/test-crypto-keygen-async-rsa.js |  3 +-
 .../parallel/test-crypto-keygen-bit-length.js |  3 +-
 ...rypto-keygen-empty-passphrase-no-prompt.js |  3 +-
 .../test-crypto-keygen-missing-oid.js         |  4 +-
 test/parallel/test-crypto-keygen.js           |  3 +-
 test/parallel/test-crypto-no-algorithm.js     |  4 +-
 test/parallel/test-crypto-oneshot-hash.js     |  3 +-
 test/parallel/test-crypto-padding.js          |  5 +-
 test/parallel/test-crypto-pbkdf2.js           |  3 +-
 .../test-crypto-private-decrypt-gh32240.js    |  4 +-
 ...t-crypto-publicDecrypt-fails-first-time.js |  8 ++-
 test/parallel/test-crypto-rsa-dsa.js          |  7 +--
 test/parallel/test-crypto-secure-heap.js      | 13 +++--
 test/parallel/test-crypto-sign-verify.js      | 13 +++--
 test/parallel/test-crypto-stream.js           |  8 +--
 test/parallel/test-crypto-x509.js             |  5 +-
 test/parallel/test-crypto.js                  |  7 +--
 test/parallel/test-dsa-fips-invalid-key.js    | 12 +++--
 .../test-https-agent-session-eviction.js      |  9 ++--
 .../test-https-client-renegotiation-limit.js  |  8 ++-
 test/parallel/test-https-foafssl.js           | 10 ++--
 ...rocess-env-allowed-flags-are-documented.js |  7 +--
 test/parallel/test-process-versions.js        |  3 +-
 test/parallel/test-tls-alert-handling.js      | 20 ++++---
 test/parallel/test-tls-alert.js               | 15 ++++--
 test/parallel/test-tls-alpn-server-client.js  |  5 +-
 test/parallel/test-tls-cert-ext-encoding.js   |  4 +-
 test/parallel/test-tls-client-auth.js         |  7 ++-
 .../test-tls-client-getephemeralkeyinfo.js    |  3 +-
 test/parallel/test-tls-client-mindhsize.js    |  5 +-
 .../test-tls-client-renegotiation-13.js       |  8 ++-
 .../test-tls-client-renegotiation-limit.js    |  8 ++-
 test/parallel/test-tls-dhe.js                 | 17 ++++--
 test/parallel/test-tls-ecdh-auto.js           | 10 ++--
 test/parallel/test-tls-ecdh-multiple.js       | 14 +++--
 test/parallel/test-tls-ecdh.js                | 10 ++--
 test/parallel/test-tls-empty-sni-context.js   |  4 +-
 test/parallel/test-tls-getprotocol.js         |  6 ++-
 test/parallel/test-tls-junk-server.js         |  7 ++-
 test/parallel/test-tls-key-mismatch.js        |  6 ++-
 test/parallel/test-tls-legacy-pfx.js          |  9 +++-
 test/parallel/test-tls-min-max-version.js     | 16 ++++--
 test/parallel/test-tls-no-sslv3.js            | 10 ++--
 test/parallel/test-tls-ocsp-callback.js       | 15 ++++--
 test/parallel/test-tls-psk-circuit.js         | 10 ++--
 test/parallel/test-tls-psk-server.js          | 11 ++--
 test/parallel/test-tls-securepair-server.js   | 10 ++--
 test/parallel/test-tls-server-verify.js       | 10 ++--
 test/parallel/test-tls-session-cache.js       | 20 ++++---
 test/parallel/test-tls-set-ciphers.js         | 16 ++++--
 test/parallel/test-tls-set-secure-context.js  |  6 ++-
 test/parallel/test-tls-set-sigalgs.js         |  7 ++-
 test/parallel/test-trace-env.js               |  8 +--
 test/parallel/test-x509-escaping.js           |  5 +-
 test/pummel/test-crypto-dh-hash.js            |  4 +-
 test/pummel/test-crypto-dh-keys.js            |  3 +-
 test/pummel/test-dh-regr.js                   |  3 +-
 test/sequential/test-tls-psk-client.js        | 11 ++--
 test/sequential/test-tls-securepair-client.js | 25 +++++----
 test/sequential/test-tls-session-timeout.js   | 10 ++--
 89 files changed, 506 insertions(+), 289 deletions(-)

diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs
index 2dabbf020e2..efa1019c62d 100644
--- a/test/addons/openssl-providers/providers.cjs
+++ b/test/addons/openssl-providers/providers.cjs
@@ -1,11 +1,14 @@
 'use strict';
 
 const common = require('../../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+const { hasOpenSSL3 } = require('../../common/crypto');
 
-if (!common.hasOpenSSL3)
+if (!hasOpenSSL3) {
   common.skip('this test requires OpenSSL 3.x');
+}
 const assert = require('node:assert');
 const { createHash, getCiphers, getHashes } = require('node:crypto');
 const { debuglog } = require('node:util');
diff --git a/test/benchmark/test-benchmark-crypto.js b/test/benchmark/test-benchmark-crypto.js
index 7f6988acf23..72d79ece13e 100644
--- a/test/benchmark/test-benchmark-crypto.js
+++ b/test/benchmark/test-benchmark-crypto.js
@@ -5,8 +5,11 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (common.hasFipsCrypto)
+const { getFips } = require('crypto');
+
+if (getFips()) {
   common.skip('some benchmarks are FIPS-incompatible');
+}
 
 const runBenchmark = require('../common/benchmark');
 
diff --git a/test/common/README.md b/test/common/README.md
index 5f5ff75fca2..ee36503f920 100644
--- a/test/common/README.md
+++ b/test/common/README.md
@@ -226,17 +226,6 @@ The TTY file descriptor is assumed to be capable of being writable.
 
 Indicates whether OpenSSL is available.
 
-### `hasFipsCrypto`
-
-* [\<boolean>][<boolean>]
-
-Indicates that Node.js has been linked with a FIPS compatible OpenSSL library,
-and that FIPS as been enabled using `--enable-fips`.
-
-To only detect if the OpenSSL library is FIPS compatible, regardless if it has
-been enabled or not, then `process.config.variables.openssl_is_fips` can be
-used to determine that situation.
-
 ### `hasIntl`
 
 * [\<boolean>][<boolean>]
@@ -417,12 +406,6 @@ Returns `true` if the exit code `exitCode` and/or signal name `signal` represent
 the exit code and/or signal name of a node process that aborted, `false`
 otherwise.
 
-### `opensslCli`
-
-* [\<boolean>][<boolean>]
-
-Indicates whether 'opensslCli' is supported.
-
 ### `platformTimeout(ms)`
 
 * `ms` [\<number>][<number>] | [\<bigint>][<bigint>]
diff --git a/test/common/crypto.js b/test/common/crypto.js
index 10432d7e7a7..f50d3895a17 100644
--- a/test/common/crypto.js
+++ b/test/common/crypto.js
@@ -1,8 +1,9 @@
 'use strict';
 
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
@@ -98,6 +99,27 @@ const pkcs8EncExp = getRegExpForPEM('ENCRYPTED PRIVATE KEY');
 const sec1Exp = getRegExpForPEM('EC PRIVATE KEY');
 const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
 
+// Synthesize OPENSSL_VERSION_NUMBER format with the layout 0xMNN00PPSL
+const opensslVersionNumber = (major = 0, minor = 0, patch = 0) => {
+  assert(major >= 0 && major <= 0xf);
+  assert(minor >= 0 && minor <= 0xff);
+  assert(patch >= 0 && patch <= 0xff);
+  return (major << 28) | (minor << 20) | (patch << 4);
+};
+
+let OPENSSL_VERSION_NUMBER;
+const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
+  if (!common.hasCrypto) return false;
+  if (OPENSSL_VERSION_NUMBER === undefined) {
+    const regexp = /(?<m>\d+)\.(?<n>\d+)\.(?<p>\d+)/;
+    const { m, n, p } = process.versions.openssl.match(regexp).groups;
+    OPENSSL_VERSION_NUMBER = opensslVersionNumber(m, n, p);
+  }
+  return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
+};
+
+let opensslCli = null;
+
 module.exports = {
   modp2buf,
   assertApproximateSize,
@@ -111,4 +133,32 @@ module.exports = {
   pkcs8EncExp,  // used once
   sec1Exp,
   sec1EncExp,
+  hasOpenSSL,
+  get hasOpenSSL3() {
+    return hasOpenSSL(3);
+  },
+  // opensslCli defined lazily to reduce overhead of spawnSync
+  get opensslCli() {
+    if (opensslCli !== null) return opensslCli;
+
+    if (process.config.variables.node_shared_openssl) {
+      // Use external command
+      opensslCli = 'openssl';
+    } else {
+      const path = require('path');
+      // Use command built from sources included in Node.js repository
+      opensslCli = path.join(path.dirname(process.execPath), 'openssl-cli');
+    }
+
+    if (exports.isWindows) opensslCli += '.exe';
+
+    const { spawnSync } = require('child_process');
+
+    const opensslCmd = spawnSync(opensslCli, ['version']);
+    if (opensslCmd.status !== 0 || opensslCmd.error !== undefined) {
+      // OpenSSL command cannot be executed
+      opensslCli = false;
+    }
+    return opensslCli;
+  },
 };
diff --git a/test/common/index.js b/test/common/index.js
index b5592a66a08..d2c39578324 100644
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -19,7 +19,6 @@
 // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-/* eslint-disable node-core/crypto-check */
 'use strict';
 const process = global.process;  // Some tests tamper with the process global.
 
@@ -57,25 +56,6 @@ const noop = () => {};
 const hasCrypto = Boolean(process.versions.openssl) &&
                   !process.env.NODE_SKIP_CRYPTO;
 
-// Synthesize OPENSSL_VERSION_NUMBER format with the layout 0xMNN00PPSL
-const opensslVersionNumber = (major = 0, minor = 0, patch = 0) => {
-  assert(major >= 0 && major <= 0xf);
-  assert(minor >= 0 && minor <= 0xff);
-  assert(patch >= 0 && patch <= 0xff);
-  return (major << 28) | (minor << 20) | (patch << 4);
-};
-
-let OPENSSL_VERSION_NUMBER;
-const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
-  if (!hasCrypto) return false;
-  if (OPENSSL_VERSION_NUMBER === undefined) {
-    const regexp = /(?<m>\d+)\.(?<n>\d+)\.(?<p>\d+)/;
-    const { m, n, p } = process.versions.openssl.match(regexp).groups;
-    OPENSSL_VERSION_NUMBER = opensslVersionNumber(m, n, p);
-  }
-  return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
-};
-
 const hasQuic = hasCrypto && !!process.config.variables.openssl_quic;
 
 function parseTestFlags(filename = process.argv[1]) {
@@ -220,7 +200,6 @@ if (process.env.NODE_TEST_WITH_ASYNC_HOOKS) {
   }).enable();
 }
 
-let opensslCli = null;
 let inFreeBSDJail = null;
 let localhostIPv4 = null;
 
@@ -985,7 +964,6 @@ const common = {
   getTTYfd,
   hasIntl,
   hasCrypto,
-  hasOpenSSL,
   hasQuic,
   hasMultiLocalhost,
   invalidArgTypeHelper,
@@ -1027,10 +1005,6 @@ const common = {
     return require('os').totalmem() > 0x70000000; /* 1.75 Gb */
   },
 
-  get hasFipsCrypto() {
-    return hasCrypto && require('crypto').getFips();
-  },
-
   get hasIPv6() {
     const iFaces = require('os').networkInterfaces();
     let re;
@@ -1047,10 +1021,6 @@ const common = {
     });
   },
 
-  get hasOpenSSL3() {
-    return hasOpenSSL(3);
-  },
-
   get inFreeBSDJail() {
     if (inFreeBSDJail !== null) return inFreeBSDJail;
 
@@ -1100,28 +1070,6 @@ const common = {
     return localhostIPv4;
   },
 
-  // opensslCli defined lazily to reduce overhead of spawnSync
-  get opensslCli() {
-    if (opensslCli !== null) return opensslCli;
-
-    if (process.config.variables.node_shared_openssl) {
-      // Use external command
-      opensslCli = 'openssl';
-    } else {
-      // Use command built from sources included in Node.js repository
-      opensslCli = path.join(path.dirname(process.execPath), 'openssl-cli');
-    }
-
-    if (exports.isWindows) opensslCli += '.exe';
-
-    const opensslCmd = spawnSync(opensslCli, ['version']);
-    if (opensslCmd.status !== 0 || opensslCmd.error !== undefined) {
-      // OpenSSL command cannot be executed
-      opensslCli = false;
-    }
-    return opensslCli;
-  },
-
   get PORT() {
     if (+process.env.TEST_PARALLEL) {
       throw new Error('common.PORT cannot be used in a parallelized test');
diff --git a/test/common/index.mjs b/test/common/index.mjs
index b252f2dc4aa..23328ac90ea 100644
--- a/test/common/index.mjs
+++ b/test/common/index.mjs
@@ -41,7 +41,6 @@ const {
   mustNotMutateObjectDeep,
   mustSucceed,
   nodeProcessAborted,
-  opensslCli,
   parseTestFlags,
   PIPE,
   platformTimeout,
@@ -97,7 +96,6 @@ export {
   mustNotMutateObjectDeep,
   mustSucceed,
   nodeProcessAborted,
-  opensslCli,
   parseTestFlags,
   PIPE,
   platformTimeout,
diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js
index 69bf136559c..9e89200e9f6 100644
--- a/test/parallel/test-cli-node-options.js
+++ b/test/parallel/test-cli-node-options.js
@@ -12,6 +12,7 @@ const { Worker } = require('worker_threads');
 
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
+const { hasOpenSSL3 } = require('../common/crypto');
 tmpdir.refresh();
 
 const printA = path.relative(tmpdir.path, fixtures.path('printA.js'));
@@ -64,7 +65,7 @@ if (common.isLinux) {
 if (common.hasCrypto) {
   expectNoWorker('--use-openssl-ca', 'B\n');
   expectNoWorker('--use-bundled-ca', 'B\n');
-  if (!common.hasOpenSSL3)
+  if (!hasOpenSSL3)
     expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
 }
 
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index d191ab7be2d..181ea732b91 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -21,13 +21,17 @@
 // Flags: --no-warnings
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
 const { inspect } = require('util');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
+
+const isFipsEnabled = crypto.getFips();
 
 //
 // Test authenticated encryption modes.
@@ -53,7 +57,7 @@ for (const test of TEST_CASES) {
     continue;
   }
 
-  if (common.hasFipsCrypto && test.iv.length < 24) {
+  if (isFipsEnabled && test.iv.length < 24) {
     common.printSkipMessage('IV len < 12 bytes unsupported in FIPS mode');
     continue;
   }
@@ -95,7 +99,7 @@ for (const test of TEST_CASES) {
   }
 
   {
-    if (isCCM && common.hasFipsCrypto) {
+    if (isCCM && isFipsEnabled) {
       assert.throws(() => {
         crypto.createDecipheriv(test.algo,
                                 Buffer.from(test.key, 'hex'),
@@ -286,7 +290,7 @@ for (const test of TEST_CASES) {
                             });
     }, errMessages.authTagLength);
 
-    if (!common.hasFipsCrypto) {
+    if (!isFipsEnabled) {
       assert.throws(() => {
         crypto.createDecipheriv('aes-256-ccm',
                                 'FxLKsqdmv0E9xrQhp0b1ZgI0K7JFZJM8',
@@ -312,7 +316,7 @@ for (const test of TEST_CASES) {
     });
 
     // CCM decryption and create(De|C)ipher are unsupported in FIPS mode.
-    if (!common.hasFipsCrypto) {
+    if (!isFipsEnabled) {
       assert.throws(() => {
         crypto.createDecipheriv(`aes-256-${mode}`,
                                 'FxLKsqdmv0E9xrQhp0b1ZgI0K7JFZJM8',
@@ -388,7 +392,7 @@ for (const test of TEST_CASES) {
     cipher.setAAD(Buffer.from('0123456789', 'hex'));
   }, /options\.plaintextLength required for CCM mode with AAD/);
 
-  if (!common.hasFipsCrypto) {
+  if (!isFipsEnabled) {
     assert.throws(() => {
       const cipher = crypto.createDecipheriv('aes-256-ccm',
                                              'FxLKsqdmv0E9xrQhp0b1ZgI0K7JFZJM8',
@@ -403,7 +407,7 @@ for (const test of TEST_CASES) {
 
 // Test that final() throws in CCM mode when no authentication tag is provided.
 {
-  if (!common.hasFipsCrypto) {
+  if (!isFipsEnabled) {
     const key = Buffer.from('1ed2233fa2223ef5d7df08546049406c', 'hex');
     const iv = Buffer.from('7305220bca40d4c90e1791e9', 'hex');
     const ct = Buffer.from('8beba09d4d4d861f957d51c0794f4abf8030848e', 'hex');
@@ -562,7 +566,7 @@ for (const test of TEST_CASES) {
   ]) {
     assert.throws(() => {
       cipher.final();
-    }, common.hasOpenSSL3 ? {
+    }, hasOpenSSL3 ? {
       code: 'ERR_OSSL_TAG_NOT_SET'
     } : {
       message: /Unsupported state/
diff --git a/test/parallel/test-crypto-cipheriv-decipheriv.js b/test/parallel/test-crypto-cipheriv-decipheriv.js
index 3e3632203af..88d07c3b957 100644
--- a/test/parallel/test-crypto-cipheriv-decipheriv.js
+++ b/test/parallel/test-crypto-cipheriv-decipheriv.js
@@ -5,6 +5,8 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
+const isFipsEnabled = crypto.getFips();
 
 function testCipher1(key, iv) {
   // Test encryption and decryption with explicit key and iv
@@ -150,7 +152,7 @@ testCipher1(Buffer.from('0123456789abcd0123456789'), '12345678');
 testCipher1(Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
 testCipher2(Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
 
-if (!common.hasFipsCrypto) {
+if (!isFipsEnabled) {
   testCipher3(Buffer.from('000102030405060708090A0B0C0D0E0F', 'hex'),
               Buffer.from('A6A6A6A6A6A6A6A6', 'hex'));
 }
@@ -193,10 +195,10 @@ assert.throws(
   errMessage);
 
 // But all other IV lengths should be accepted.
-const minIvLength = common.hasOpenSSL3 ? 8 : 1;
-const maxIvLength = common.hasOpenSSL3 ? 64 : 256;
+const minIvLength = hasOpenSSL3 ? 8 : 1;
+const maxIvLength = hasOpenSSL3 ? 64 : 256;
 for (let n = minIvLength; n < maxIvLength; n += 1) {
-  if (common.hasFipsCrypto && n < 12) continue;
+  if (isFipsEnabled && n < 12) continue;
   crypto.createCipheriv('aes-128-gcm', Buffer.alloc(16), Buffer.alloc(n));
 }
 
diff --git a/test/parallel/test-crypto-classes.js b/test/parallel/test-crypto-classes.js
index f736921476a..429bc91d441 100644
--- a/test/parallel/test-crypto-classes.js
+++ b/test/parallel/test-crypto-classes.js
@@ -4,9 +4,9 @@ const assert = require('assert');
 
 if (!common.hasCrypto) {
   common.skip('missing crypto');
-  return;
 }
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // 'ClassName' : ['args', 'for', 'constructor']
 const TEST_CASES = {
@@ -21,8 +21,8 @@ const TEST_CASES = {
   'ECDH': ['prime256v1'],
 };
 
-if (!common.hasFipsCrypto) {
-  TEST_CASES.DiffieHellman = [common.hasOpenSSL3 ? 1024 : 256];
+if (!crypto.getFips()) {
+  TEST_CASES.DiffieHellman = [hasOpenSSL3 ? 1024 : 256];
 }
 
 for (const [clazz, args] of Object.entries(TEST_CASES)) {
diff --git a/test/parallel/test-crypto-dh-constructor.js b/test/parallel/test-crypto-dh-constructor.js
index c7eaca29347..eb867493248 100644
--- a/test/parallel/test-crypto-dh-constructor.js
+++ b/test/parallel/test-crypto-dh-constructor.js
@@ -5,8 +5,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
-const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
 const dh1 = crypto.createDiffieHellman(size);
 const p1 = dh1.getPrime('buffer');
 
diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js
index 476ca64b442..0af4db03107 100644
--- a/test/parallel/test-crypto-dh-errors.js
+++ b/test/parallel/test-crypto-dh-errors.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // https://github.com/nodejs/node/issues/32738
 // XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError
@@ -24,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
 });
 
 for (const bits of [-1, 0, 1]) {
-  if (common.hasOpenSSL3) {
+  if (hasOpenSSL3) {
     assert.throws(() => crypto.createDiffieHellman(bits), {
       code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL',
       name: 'Error',
diff --git a/test/parallel/test-crypto-dh-generate-keys.js b/test/parallel/test-crypto-dh-generate-keys.js
index fc277bb0d9b..e4598274328 100644
--- a/test/parallel/test-crypto-dh-generate-keys.js
+++ b/test/parallel/test-crypto-dh-generate-keys.js
@@ -6,9 +6,10 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 {
-  const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
 
   function unlessInvalidState(f) {
     try {
diff --git a/test/parallel/test-crypto-dh-leak.js b/test/parallel/test-crypto-dh-leak.js
index 1998d61d4af..3b5051feb43 100644
--- a/test/parallel/test-crypto-dh-leak.js
+++ b/test/parallel/test-crypto-dh-leak.js
@@ -9,10 +9,11 @@ if (common.isASan)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 const before = process.memoryUsage.rss();
 {
-  const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
   const dh = crypto.createDiffieHellman(size);
   const publicKey = dh.generateKeys();
   const privateKey = dh.getPrivateKey();
diff --git a/test/parallel/test-crypto-dh-odd-key.js b/test/parallel/test-crypto-dh-odd-key.js
index 69a1eb56c86..fbe42be425e 100644
--- a/test/parallel/test-crypto-dh-odd-key.js
+++ b/test/parallel/test-crypto-dh-odd-key.js
@@ -21,22 +21,24 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 function test() {
   const odd = Buffer.alloc(39, 'A');
 
-  const c = crypto.createDiffieHellman(common.hasOpenSSL3 ? 1024 : 32);
+  const c = crypto.createDiffieHellman(hasOpenSSL3 ? 1024 : 32);
   c.setPrivateKey(odd);
   c.generateKeys();
 }
 
 // FIPS requires a length of at least 1024
-if (!common.hasFipsCrypto) {
+if (!crypto.getFips()) {
   test();
 } else {
   assert.throws(function() { test(); }, /key size too small/);
diff --git a/test/parallel/test-crypto-dh-stateless.js b/test/parallel/test-crypto-dh-stateless.js
index 2ccac322e23..f4fc1849699 100644
--- a/test/parallel/test-crypto-dh-stateless.js
+++ b/test/parallel/test-crypto-dh-stateless.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 assert.throws(() => crypto.diffieHellman(), {
   name: 'TypeError',
@@ -150,7 +151,7 @@ const list = [
 
 // TODO(danbev): Take a closer look if there should be a check in OpenSSL3
 // when the dh parameters differ.
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   // Same primes, but different generator.
   list.push([{ group: 'modp5' }, { prime: group.getPrime(), generator: 5 }]);
   // Same generator, but different primes.
@@ -161,7 +162,7 @@ for (const [params1, params2] of list) {
   assert.throws(() => {
     test(crypto.generateKeyPairSync('dh', params1),
          crypto.generateKeyPairSync('dh', params2));
-  }, common.hasOpenSSL3 ? {
+  }, hasOpenSSL3 ? {
     name: 'Error',
     code: 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
   } : {
@@ -220,7 +221,7 @@ const not256k1 = crypto.getCurves().find((c) => /^sec.*(224|384|512)/.test(c));
 assert.throws(() => {
   test(crypto.generateKeyPairSync('ec', { namedCurve: 'secp256k1' }),
        crypto.generateKeyPairSync('ec', { namedCurve: not256k1 }));
-}, common.hasOpenSSL3 ? {
+}, hasOpenSSL3 ? {
   name: 'Error',
   code: 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
 } : {
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index 9ebe14011ee..d7ffbe5eca9 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -1,13 +1,18 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
+const {
+  hasOpenSSL3,
+  hasOpenSSL,
+} = require('../common/crypto');
 
 {
-  const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
   const dh1 = crypto.createDiffieHellman(size);
   const p1 = dh1.getPrime('buffer');
   const dh2 = crypto.createDiffieHellman(p1, 'buffer');
@@ -53,7 +58,7 @@ const crypto = require('crypto');
   assert.strictEqual(secret1, secret4);
 
   let wrongBlockLength;
-  if (common.hasOpenSSL3) {
+  if (hasOpenSSL3) {
     wrongBlockLength = {
       message: 'error:1C80006B:Provider routines::wrong final block length',
       code: 'ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH',
@@ -87,11 +92,11 @@ const crypto = require('crypto');
 
   {
     // Error message was changed in OpenSSL 3.0.x from 3.0.12, and 3.1.x from 3.1.4.
-    const hasOpenSSL3WithNewErrorMessage = (common.hasOpenSSL(3, 0, 12) && !common.hasOpenSSL(3, 1, 0)) ||
-                                           (common.hasOpenSSL(3, 1, 4));
+    const hasOpenSSL3WithNewErrorMessage = (hasOpenSSL(3, 0, 12) && !hasOpenSSL(3, 1, 0)) ||
+                                           (hasOpenSSL(3, 1, 4));
     assert.throws(() => {
       dh3.computeSecret('');
-    }, { message: common.hasOpenSSL3 && !hasOpenSSL3WithNewErrorMessage ?
+    }, { message: hasOpenSSL3 && !hasOpenSSL3WithNewErrorMessage ?
       'Unspecified validation error' :
       'Supplied key is too small' });
   }
diff --git a/test/parallel/test-crypto-ecb.js b/test/parallel/test-crypto-ecb.js
index aecd858ef3b..6439c9354a0 100644
--- a/test/parallel/test-crypto-ecb.js
+++ b/test/parallel/test-crypto-ecb.js
@@ -21,18 +21,23 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (common.hasFipsCrypto)
+const { hasOpenSSL3 } = require('../common/crypto');
+const crypto = require('crypto');
+
+if (crypto.getFips()) {
   common.skip('BF-ECB is not FIPS 140-2 compatible');
+}
 
-if (common.hasOpenSSL3)
+if (hasOpenSSL3) {
   common.skip('Blowfish is only available with the legacy provider in ' +
     'OpenSSl 3.x');
+}
 
 const assert = require('assert');
-const crypto = require('crypto');
 
 // Testing whether EVP_CipherInit_ex is functioning correctly.
 // Reference: bug#1997
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index 8a8a8089a3c..de004b9a9e8 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -10,6 +10,7 @@ const path = require('path');
 const fixtures = require('../common/fixtures');
 const { internalBinding } = require('internal/test/binding');
 const { testFipsCrypto } = internalBinding('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 const FIPS_ENABLED = 1;
 const FIPS_DISABLED = 0;
@@ -114,7 +115,7 @@ assert.ok(test_result === 1 || test_result === 0);
 // ("Error: Cannot set FIPS mode in a non-FIPS build.").
 // Due to this uncertainty the following tests are skipped when configured
 // with --shared-openssl.
-if (!sharedOpenSSL() && !common.hasOpenSSL3) {
+if (!sharedOpenSSL() && !hasOpenSSL3) {
   // OpenSSL config file should be able to turn on FIPS mode
   testHelper(
     'stdout',
@@ -144,7 +145,7 @@ if (!sharedOpenSSL() && !common.hasOpenSSL3) {
 // will not work as expected with that version.
 // TODO(danbev) Revisit these test once FIPS support is available in
 // OpenSSL 3.x.
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   testHelper(
     'stdout',
     [`--openssl-config=${CNF_FIPS_OFF}`],
diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
index ca8f630b4bb..61145aee072 100644
--- a/test/parallel/test-crypto-hash.js
+++ b/test/parallel/test-crypto-hash.js
@@ -1,13 +1,14 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
 const fs = require('fs');
 
-const { hasOpenSSL } = common;
+const { hasOpenSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 let cryptoType;
@@ -40,7 +41,7 @@ a8.write('');
 a8.end();
 a8 = a8.read();
 
-if (!common.hasFipsCrypto) {
+if (!crypto.getFips()) {
   cryptoType = 'md5';
   digest = 'latin1';
   const a0 = crypto.createHash(cryptoType).update('Test123').digest(digest);
diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js
index ff3abdf291e..3f7e61e9b2e 100644
--- a/test/parallel/test-crypto-hkdf.js
+++ b/test/parallel/test-crypto-hkdf.js
@@ -13,6 +13,7 @@ const {
   hkdfSync,
   getHashes
 } = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 {
   assert.throws(() => hkdf(), {
@@ -124,7 +125,7 @@ const algorithms = [
   ['sha256', '', 'salt', '', 10],
   ['sha512', 'secret', 'salt', '', 15],
 ];
-if (!common.hasOpenSSL3)
+if (!hasOpenSSL3)
   algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
 
 algorithms.forEach(([ hash, secret, salt, info, length ]) => {
@@ -215,7 +216,7 @@ algorithms.forEach(([ hash, secret, salt, info, length ]) => {
 });
 
 
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   const kKnownUnsupported = ['shake128', 'shake256'];
   getHashes()
     .filter((hash) => !kKnownUnsupported.includes(hash))
diff --git a/test/parallel/test-crypto-hmac.js b/test/parallel/test-crypto-hmac.js
index 62a6ac18d25..afb5f74cbf0 100644
--- a/test/parallel/test-crypto-hmac.js
+++ b/test/parallel/test-crypto-hmac.js
@@ -1,7 +1,8 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
@@ -40,7 +41,7 @@ assert.throws(
 
 function testHmac(algo, key, data, expected) {
   // FIPS does not support MD5.
-  if (common.hasFipsCrypto && algo === 'md5')
+  if (crypto.getFips() && algo === 'md5')
     return;
 
   if (!Array.isArray(data))
diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
index f5271f16d34..0c516d80950 100644
--- a/test/parallel/test-crypto-key-objects.js
+++ b/test/parallel/test-crypto-key-objects.js
@@ -24,6 +24,8 @@ const {
   generateKeyPairSync,
 } = require('crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 const fixtures = require('../common/fixtures');
 
 const publicPem = fixtures.readKey('rsa_public.pem', 'ascii');
@@ -297,7 +299,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
   // This should not cause a crash: https://github.com/nodejs/node/issues/25247
   assert.throws(() => {
     createPrivateKey({ key: '' });
-  }, common.hasOpenSSL3 ? {
+  }, hasOpenSSL3 ? {
     message: 'error:1E08010C:DECODER routines::unsupported',
   } : {
     message: 'error:0909006C:PEM routines:get_name:no start line',
@@ -323,7 +325,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
       type: 'pkcs1'
     });
     createPrivateKey({ key, format: 'der', type: 'pkcs1' });
-  }, common.hasOpenSSL3 ? {
+  }, hasOpenSSL3 ? {
     message: /error:1E08010C:DECODER routines::unsupported/,
     library: 'DECODER routines'
   } : {
@@ -510,7 +512,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
 
 {
   // Reading an encrypted key without a passphrase should fail.
-  assert.throws(() => createPrivateKey(privateDsa), common.hasOpenSSL3 ? {
+  assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL3 ? {
     name: 'Error',
     message: 'error:07880109:common libcrypto routines::interrupted or ' +
              'cancelled',
@@ -526,7 +528,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
     key: privateDsa,
     format: 'pem',
     passphrase: Buffer.alloc(1025, 'a')
-  }), common.hasOpenSSL3 ? { name: 'Error' } : {
+  }), hasOpenSSL3 ? { name: 'Error' } : {
     code: 'ERR_OSSL_PEM_BAD_PASSWORD_READ',
     name: 'Error'
   });
diff --git a/test/parallel/test-crypto-keygen-async-dsa-key-object.js b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
index c1580729554..a3df136230d 100644
--- a/test/parallel/test-crypto-keygen-async-dsa-key-object.js
+++ b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
@@ -9,23 +9,25 @@ const {
   generateKeyPair,
 } = require('crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 // Test async DSA key object generation.
 {
   generateKeyPair('dsa', {
-    modulusLength: common.hasOpenSSL3 ? 2048 : 512,
+    modulusLength: hasOpenSSL3 ? 2048 : 512,
     divisorLength: 256
   }, common.mustSucceed((publicKey, privateKey) => {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: common.hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL3 ? 2048 : 512,
       divisorLength: 256
     });
 
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: common.hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL3 ? 2048 : 512,
       divisorLength: 256
     });
   }));
diff --git a/test/parallel/test-crypto-keygen-async-dsa.js b/test/parallel/test-crypto-keygen-async-dsa.js
index 048c0ce6fb9..41968d8cc23 100644
--- a/test/parallel/test-crypto-keygen-async-dsa.js
+++ b/test/parallel/test-crypto-keygen-async-dsa.js
@@ -14,6 +14,8 @@ const {
   spkiExp,
 } = require('../common/crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 // Test async DSA key generation.
 {
   const privateKeyEncoding = {
@@ -22,7 +24,7 @@ const {
   };
 
   generateKeyPair('dsa', {
-    modulusLength: common.hasOpenSSL3 ? 2048 : 512,
+    modulusLength: hasOpenSSL3 ? 2048 : 512,
     divisorLength: 256,
     publicKeyEncoding: {
       type: 'spki',
@@ -39,8 +41,8 @@ const {
     // The private key is DER-encoded.
     assert(Buffer.isBuffer(privateKeyDER));
 
-    assertApproximateSize(publicKey, common.hasOpenSSL3 ? 1194 : 440);
-    assertApproximateSize(privateKeyDER, common.hasOpenSSL3 ? 721 : 336);
+    assertApproximateSize(publicKey, hasOpenSSL3 ? 1194 : 440);
+    assertApproximateSize(privateKeyDER, hasOpenSSL3 ? 721 : 336);
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
index 55367477457..55aa3831c42 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
@@ -14,6 +14,8 @@ const {
   pkcs8EncExp,
 } = require('../common/crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
 // private key with paramEncoding explicit.
 {
@@ -38,7 +40,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  common.hasOpenSSL3 ? {
+                  hasOpenSSL3 ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
index 79a132eed0b..8a55d4338bc 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
@@ -12,6 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   sec1EncExp,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 {
@@ -38,7 +39,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  common.hasOpenSSL3 ? {
+                  hasOpenSSL3 ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
index 5e7d1a6c9b6..4c11401d0fc 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
@@ -12,6 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
@@ -38,7 +39,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  common.hasOpenSSL3 ? {
+                  hasOpenSSL3 ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
index 1cc93d0a794..0503ff74787 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
@@ -12,6 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   sec1EncExp,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 {
@@ -38,7 +39,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  common.hasOpenSSL3 ? {
+                  hasOpenSSL3 ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-rsa.js b/test/parallel/test-crypto-keygen-async-rsa.js
index f4a83809dc7..c80d7d33492 100644
--- a/test/parallel/test-crypto-keygen-async-rsa.js
+++ b/test/parallel/test-crypto-keygen-async-rsa.js
@@ -13,6 +13,7 @@ const {
   testEncryptDecrypt,
   testSignVerify,
   pkcs1EncExp,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 // Test async RSA key generation with an encrypted private key.
@@ -43,7 +44,7 @@ const {
       type: 'pkcs1',
       format: 'der',
     };
-    const expectedError = common.hasOpenSSL3 ? {
+    const expectedError = hasOpenSSL3 ? {
       name: 'Error',
       message: 'error:07880109:common libcrypto routines::interrupted or ' +
                'cancelled'
diff --git a/test/parallel/test-crypto-keygen-bit-length.js b/test/parallel/test-crypto-keygen-bit-length.js
index 08772ba2e49..63a80659bb2 100644
--- a/test/parallel/test-crypto-keygen-bit-length.js
+++ b/test/parallel/test-crypto-keygen-bit-length.js
@@ -8,6 +8,7 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // This tests check that generateKeyPair returns correct bit length in
 // KeyObject's asymmetricKeyDetails.
@@ -27,7 +28,7 @@ const {
     assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513);
   }));
 
-  if (common.hasOpenSSL3) {
+  if (hasOpenSSL3) {
     generateKeyPair('dsa', {
       modulusLength: 2049,
       divisorLength: 256,
diff --git a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
index 7679a492c31..cb873ff0474 100644
--- a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
+++ b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
@@ -11,6 +11,7 @@ const {
 } = require('crypto');
 const {
   testSignVerify,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 // Passing an empty passphrase string should not cause OpenSSL's default
@@ -40,7 +41,7 @@ for (const type of ['pkcs1', 'pkcs8']) {
     // the key, and not specifying a passphrase should fail when decoding it.
     assert.throws(() => {
       return testSignVerify(publicKey, privateKey);
-    }, common.hasOpenSSL3 ? {
+    }, hasOpenSSL3 ? {
       name: 'Error',
       code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
       message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
diff --git a/test/parallel/test-crypto-keygen-missing-oid.js b/test/parallel/test-crypto-keygen-missing-oid.js
index f7fefe13848..1e4f309292e 100644
--- a/test/parallel/test-crypto-keygen-missing-oid.js
+++ b/test/parallel/test-crypto-keygen-missing-oid.js
@@ -11,6 +11,8 @@ const {
   getCurves,
 } = require('crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 // This test creates EC key pairs on curves without associated OIDs.
 // Specifying a key encoding should not crash.
 {
@@ -20,7 +22,7 @@ const {
         continue;
 
       const expectedErrorCode =
-        common.hasOpenSSL3 ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
+        hasOpenSSL3 ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
       const params = {
         namedCurve,
         publicKeyEncoding: {
diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
index b09ca9e7c53..edaee845075 100644
--- a/test/parallel/test-crypto-keygen.js
+++ b/test/parallel/test-crypto-keygen.js
@@ -14,6 +14,7 @@ const {
 } = require('crypto');
 const { inspect } = require('util');
 
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Test invalid parameter encoding.
 {
@@ -351,7 +352,7 @@ const { inspect } = require('util');
       publicExponent
     }, common.mustCall((err) => {
       assert.strictEqual(err.name, 'Error');
-      assert.match(err.message, common.hasOpenSSL3 ? /exponent/ : /bad e value/);
+      assert.match(err.message, hasOpenSSL3 ? /exponent/ : /bad e value/);
     }));
   }
 }
diff --git a/test/parallel/test-crypto-no-algorithm.js b/test/parallel/test-crypto-no-algorithm.js
index 37db38cf613..06124e3d465 100644
--- a/test/parallel/test-crypto-no-algorithm.js
+++ b/test/parallel/test-crypto-no-algorithm.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (!common.hasOpenSSL3)
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3)
   common.skip('this test requires OpenSSL 3.x');
 
 const assert = require('node:assert/strict');
diff --git a/test/parallel/test-crypto-oneshot-hash.js b/test/parallel/test-crypto-oneshot-hash.js
index 69051c43d9e..861aded5dd3 100644
--- a/test/parallel/test-crypto-oneshot-hash.js
+++ b/test/parallel/test-crypto-oneshot-hash.js
@@ -8,6 +8,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL } = require('../common/crypto');
 const fs = require('fs');
 
 // Test errors for invalid arguments.
@@ -32,7 +33,7 @@ const input = fs.readFileSync(fixtures.path('utf8_test_text.txt'));
 
 for (const method of methods) {
   // Skip failing tests on OpenSSL 3.4.0
-  if (method.startsWith('shake') && common.hasOpenSSL(3, 4))
+  if (method.startsWith('shake') && hasOpenSSL(3, 4))
     continue;
   for (const outputEncoding of ['buffer', 'hex', 'base64', undefined]) {
     const oldDigest = crypto.createHash(method).update(input).digest(outputEncoding || 'hex');
diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js
index f1f14b47299..48cd1ed4df6 100644
--- a/test/parallel/test-crypto-padding.js
+++ b/test/parallel/test-crypto-padding.js
@@ -26,6 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Input data.
 const ODD_LENGTH_PLAIN = 'Hello node world!';
@@ -82,7 +83,7 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED);
 assert.throws(function() {
   // Input must have block length %.
   enc(ODD_LENGTH_PLAIN, false);
-}, common.hasOpenSSL3 ? {
+}, hasOpenSSL3 ? {
   message: 'error:1C80006B:Provider routines::wrong final block length',
   code: 'ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH',
   reason: 'wrong final block length',
@@ -109,7 +110,7 @@ assert.strictEqual(dec(EVEN_LENGTH_ENCRYPTED, false).length, 48);
 assert.throws(function() {
   // Must have at least 1 byte of padding (PKCS):
   assert.strictEqual(dec(EVEN_LENGTH_ENCRYPTED_NOPAD, true), EVEN_LENGTH_PLAIN);
-}, common.hasOpenSSL3 ? {
+}, hasOpenSSL3 ? {
   message: 'error:1C800064:Provider routines::bad decrypt',
   reason: 'bad decrypt',
   code: 'ERR_OSSL_BAD_DECRYPT',
diff --git a/test/parallel/test-crypto-pbkdf2.js b/test/parallel/test-crypto-pbkdf2.js
index 1f8e6a81f30..efd8d6eaf0d 100644
--- a/test/parallel/test-crypto-pbkdf2.js
+++ b/test/parallel/test-crypto-pbkdf2.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 function runPBKDF2(password, salt, iterations, keylen, hash) {
   const syncResult =
@@ -219,7 +220,7 @@ assert.throws(
   }
 );
 
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   const kNotPBKDF2Supported = ['shake128', 'shake256'];
   crypto.getHashes()
     .filter((hash) => !kNotPBKDF2Supported.includes(hash))
diff --git a/test/parallel/test-crypto-private-decrypt-gh32240.js b/test/parallel/test-crypto-private-decrypt-gh32240.js
index e88227a215b..1ff5b565d6d 100644
--- a/test/parallel/test-crypto-private-decrypt-gh32240.js
+++ b/test/parallel/test-crypto-private-decrypt-gh32240.js
@@ -14,6 +14,8 @@ const {
   privateDecrypt,
 } = require('crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 const pair = generateKeyPairSync('rsa', { modulusLength: 512 });
 
 const expected = Buffer.from('shibboleth');
@@ -34,7 +36,7 @@ function decrypt(key) {
 }
 
 decrypt(pkey);
-assert.throws(() => decrypt(pkeyEncrypted), common.hasOpenSSL3 ?
+assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL3 ?
   { message: 'error:07880109:common libcrypto routines::interrupted or ' +
              'cancelled' } :
   { code: 'ERR_MISSING_PASSPHRASE' });
diff --git a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
index a60b87dbf65..1d64e08920c 100644
--- a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
+++ b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
@@ -3,11 +3,15 @@ const common = require('../common');
 
 // Test for https://github.com/nodejs/node/issues/40814
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.hasOpenSSL3)
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3) {
   common.skip('only openssl3'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
index 5f4fafdfffb..dcd5045daaf 100644
--- a/test/parallel/test-crypto-rsa-dsa.js
+++ b/test/parallel/test-crypto-rsa-dsa.js
@@ -9,6 +9,7 @@ const crypto = require('crypto');
 const constants = crypto.constants;
 
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Test certificates
 const certPem = fixtures.readKey('rsa_cert.crt');
@@ -36,11 +37,11 @@ const openssl1DecryptError = {
   library: 'digital envelope routines',
 };
 
-const decryptError = common.hasOpenSSL3 ?
+const decryptError = hasOpenSSL3 ?
   { message: 'error:1C800064:Provider routines::bad decrypt' } :
   openssl1DecryptError;
 
-const decryptPrivateKeyError = common.hasOpenSSL3 ? {
+const decryptPrivateKeyError = hasOpenSSL3 ? {
   message: 'error:1C800064:Provider routines::bad decrypt',
 } : openssl1DecryptError;
 
@@ -146,7 +147,7 @@ function getBufferCopy(buf) {
   // Now with RSA_NO_PADDING. Plaintext needs to match key size.
   // OpenSSL 3.x has a rsa_check_padding that will cause an error if
   // RSA_NO_PADDING is used.
-  if (!common.hasOpenSSL3) {
+  if (!hasOpenSSL3) {
     {
       const plaintext = 'x'.repeat(rsaKeySize / 8);
       encryptedBuffer = crypto.privateEncrypt({
diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js
index 0e5788f00e4..c20b01a91a9 100644
--- a/test/parallel/test-crypto-secure-heap.js
+++ b/test/parallel/test-crypto-secure-heap.js
@@ -1,21 +1,26 @@
 'use strict';
 
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (common.isWindows)
+if (common.isWindows) {
   common.skip('Not supported on Windows');
+}
 
-if (common.isASan)
+if (common.isASan) {
   common.skip('ASan does not play well with secure heap allocations');
+}
 
 const assert = require('assert');
 const { fork } = require('child_process');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 const {
   secureHeapUsed,
   createDiffieHellman,
+  getFips,
 } = require('crypto');
 
 if (process.argv[2] === 'child') {
@@ -29,7 +34,7 @@ if (process.argv[2] === 'child') {
   assert.strictEqual(a.used, 0);
 
   {
-    const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+    const size = getFips() || hasOpenSSL3 ? 1024 : 256;
     const dh1 = createDiffieHellman(size);
     const p1 = dh1.getPrime('buffer');
     const dh2 = createDiffieHellman(p1, 'buffer');
diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
index 8a263ec3350..0589d60736e 100644
--- a/test/parallel/test-crypto-sign-verify.js
+++ b/test/parallel/test-crypto-sign-verify.js
@@ -8,6 +8,10 @@ const fs = require('fs');
 const exec = require('child_process').exec;
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
+const {
+  hasOpenSSL3,
+  opensslCli,
+} = require('../common/crypto');
 
 // Test certificates
 const certPem = fixtures.readKey('rsa_cert.crt');
@@ -62,7 +66,7 @@ const keySize = 2048;
         key: keyPem,
         padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
       });
-  }, { message: common.hasOpenSSL3 ?
+  }, { message: hasOpenSSL3 ?
     'error:1C8000A5:Provider routines::illegal or unsupported padding mode' :
     'bye, bye, error stack' });
 
@@ -340,7 +344,7 @@ assert.throws(
         key: keyPem,
         padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
       });
-  }, common.hasOpenSSL3 ? {
+  }, hasOpenSSL3 ? {
     code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /illegal or unsupported padding mode/,
   } : {
@@ -599,8 +603,9 @@ assert.throws(
 // Note: this particular test *must* be the last in this file as it will exit
 // early if no openssl binary is found
 {
-  if (!common.opensslCli)
+  if (!opensslCli) {
     common.skip('node compiled without OpenSSL CLI.');
+  }
 
   const pubfile = fixtures.path('keys', 'rsa_public_2048.pem');
   const privkey = fixtures.readKey('rsa_private_2048.pem');
@@ -622,7 +627,7 @@ assert.throws(
   fs.writeFileSync(msgfile, msg);
 
   exec(...common.escapePOSIXShell`"${
-    common.opensslCli}" dgst -sha256 -verify "${pubfile}" -signature "${
+    opensslCli}" dgst -sha256 -verify "${pubfile}" -signature "${
     sigfile}" -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-2 "${msgfile
   }"`, common.mustCall((err, stdout, stderr) => {
     assert(stdout.includes('Verified OK'));
diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js
index 008ab129f0e..62be4eaf6ed 100644
--- a/test/parallel/test-crypto-stream.js
+++ b/test/parallel/test-crypto-stream.js
@@ -21,14 +21,16 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const stream = require('stream');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
-if (!common.hasFipsCrypto) {
+if (!crypto.getFips()) {
   // Small stream to buffer converter
   class Stream2buffer extends stream.Writable {
     constructor(callback) {
@@ -71,7 +73,7 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
 const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
 
 cipher.pipe(decipher)
-  .on('error', common.expectsError(common.hasOpenSSL3 ? {
+  .on('error', common.expectsError(hasOpenSSL3 ? {
     message: /bad decrypt/,
     library: 'Provider routines',
     reason: 'bad decrypt',
diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js
index bd906c25b9e..f75e1d63470 100644
--- a/test/parallel/test-crypto-x509.js
+++ b/test/parallel/test-crypto-x509.js
@@ -18,6 +18,7 @@ const {
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 const { readFileSync } = require('fs');
 
 const cert = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
@@ -50,7 +51,7 @@ emailAddress=ry@tinyclouds.org`;
 
 let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/
 CA Issuers - URI:http://ca.nodejs.org/ca.cert`;
-if (!common.hasOpenSSL3)
+if (!hasOpenSSL3)
   infoAccessCheck += '\n';
 
 const der = Buffer.from(
@@ -357,7 +358,7 @@ UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
 
   const cert = new X509Certificate(certPem);
   assert.throws(() => cert.publicKey, {
-    message: common.hasOpenSSL3 ? /decode error/ : /wrong tag/,
+    message: hasOpenSSL3 ? /decode error/ : /wrong tag/,
     name: 'Error'
   });
 
diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
index 42711218813..93644e016de 100644
--- a/test/parallel/test-crypto.js
+++ b/test/parallel/test-crypto.js
@@ -29,6 +29,7 @@ const assert = require('assert');
 const crypto = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Test Certificates
 const certPfx = fixtures.readKey('rsa_cert.pfx');
@@ -208,9 +209,9 @@ assert.throws(() => {
   ].join('\n');
   crypto.createSign('SHA256').update('test').sign(priv);
 }, (err) => {
-  if (!common.hasOpenSSL3)
+  if (!hasOpenSSL3)
     assert.ok(!('opensslErrorStack' in err));
-  assert.throws(() => { throw err; }, common.hasOpenSSL3 ? {
+  assert.throws(() => { throw err; }, hasOpenSSL3 ? {
     name: 'Error',
     message: 'error:02000070:rsa routines::digest too big for rsa key',
     library: 'rsa routines',
@@ -225,7 +226,7 @@ assert.throws(() => {
   return true;
 });
 
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   assert.throws(() => {
     // The correct header inside `rsa_private_pkcs8_bad.pem` should have been
     // -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----
diff --git a/test/parallel/test-dsa-fips-invalid-key.js b/test/parallel/test-dsa-fips-invalid-key.js
index 05cc1d143ac..3df51bfbed3 100644
--- a/test/parallel/test-dsa-fips-invalid-key.js
+++ b/test/parallel/test-dsa-fips-invalid-key.js
@@ -1,12 +1,18 @@
 'use strict';
 const common = require('../common');
-const fixtures = require('../common/fixtures');
 
-if (!common.hasFipsCrypto)
+if (!common.hasCrypto) {
+  common.skip('no crypto');
+}
+
+const fixtures = require('../common/fixtures');
+const crypto = require('crypto');
+
+if (!crypto.getFips()) {
   common.skip('node compiled without FIPS OpenSSL.');
+}
 
 const assert = require('assert');
-const crypto = require('crypto');
 
 const input = 'hello';
 
diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
index e0986e53c11..6f88e81e9ff 100644
--- a/test/parallel/test-https-agent-session-eviction.js
+++ b/test/parallel/test-https-agent-session-eviction.js
@@ -2,10 +2,13 @@
 'use strict';
 
 const common = require('../common');
-const { readKey } = require('../common/fixtures');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { readKey } = require('../common/fixtures');
+const { hasOpenSSL } = require('../common/crypto');
 
 const https = require('https');
 const { SSL_OP_NO_TICKET } = require('crypto').constants;
@@ -56,7 +59,7 @@ function faultyServer(port) {
 function second(server, session) {
   const req = https.request({
     port: server.address().port,
-    ciphers: (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
     rejectUnauthorized: false
   }, function(res) {
     res.resume();
diff --git a/test/parallel/test-https-client-renegotiation-limit.js b/test/parallel/test-https-client-renegotiation-limit.js
index 35fcc6bfcc6..18a602d738c 100644
--- a/test/parallel/test-https-client-renegotiation-limit.js
+++ b/test/parallel/test-https-client-renegotiation-limit.js
@@ -21,11 +21,15 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const tls = require('tls');
diff --git a/test/parallel/test-https-foafssl.js b/test/parallel/test-https-foafssl.js
index d6dde97a41d..df375e7d222 100644
--- a/test/parallel/test-https-foafssl.js
+++ b/test/parallel/test-https-foafssl.js
@@ -21,11 +21,15 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
@@ -67,7 +71,7 @@ server.listen(0, function() {
                 '-cert', fixtures.path('keys/rsa_cert_foafssl_b.crt'),
                 '-key', fixtures.path('keys/rsa_private_b.pem')];
 
-  const client = spawn(common.opensslCli, args);
+  const client = spawn(opensslCli, args);
 
   client.stdout.on('data', function(data) {
     console.log('response received');
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
index 2a40a821314..070a88bca8c 100644
--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -5,6 +5,7 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 const rootDir = path.resolve(__dirname, '..', '..');
 const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md');
@@ -43,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
   }
 }
 
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   documented.delete('--openssl-legacy-provider');
   documented.delete('--openssl-shared-config');
 }
@@ -55,8 +56,8 @@ const conditionalOpts = [
     filter: (opt) => {
       return [
         '--openssl-config',
-        common.hasOpenSSL3 ? '--openssl-legacy-provider' : '',
-        common.hasOpenSSL3 ? '--openssl-shared-config' : '',
+        hasOpenSSL3 ? '--openssl-legacy-provider' : '',
+        hasOpenSSL3 ? '--openssl-shared-config' : '',
         '--tls-cipher-list',
         '--use-bundled-ca',
         '--use-openssl-ca',
diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js
index 3b8af4b5b52..0a2a4014f18 100644
--- a/test/parallel/test-process-versions.js
+++ b/test/parallel/test-process-versions.js
@@ -85,11 +85,12 @@ assert.match(process.versions.modules, /^\d+$/);
 assert.match(process.versions.cjs_module_lexer, commonTemplate);
 
 if (common.hasCrypto) {
+  const { hasOpenSSL3 } = require('../common/crypto');
   assert.match(process.versions.ncrypto, commonTemplate);
   if (process.config.variables.node_shared_openssl) {
     assert.ok(process.versions.openssl);
   } else {
-    const versionRegex = common.hasOpenSSL3 ?
+    const versionRegex = hasOpenSSL3 ?
       // The following also matches a development version of OpenSSL 3.x which
       // can be in the format '3.0.0-alpha4-dev'. This can be handy when
       // building and linking against the main development branch of OpenSSL.
diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
index b14438bc92d..eec07279606 100644
--- a/test/parallel/test-tls-alert-handling.js
+++ b/test/parallel/test-tls-alert-handling.js
@@ -1,11 +1,19 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const {
+  hasOpenSSL,
+  hasOpenSSL3,
+  opensslCli,
+} = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI');
+}
 
 const assert = require('assert');
 const net = require('net');
@@ -33,14 +41,14 @@ let iter = 0;
 const errorHandler = common.mustCall((err) => {
   let expectedErrorCode = 'ERR_SSL_WRONG_VERSION_NUMBER';
   let expectedErrorReason = 'wrong version number';
-  if (common.hasOpenSSL(3, 2)) {
+  if (hasOpenSSL(3, 2)) {
     expectedErrorCode = 'ERR_SSL_PACKET_LENGTH_TOO_LONG';
     expectedErrorReason = 'packet length too long';
   };
 
   assert.strictEqual(err.code, expectedErrorCode);
   assert.strictEqual(err.library, 'SSL routines');
-  if (!common.hasOpenSSL3) assert.strictEqual(err.function, 'ssl3_get_record');
+  if (!hasOpenSSL3) assert.strictEqual(err.function, 'ssl3_get_record');
   assert.strictEqual(err.reason, expectedErrorReason);
   errorReceived = true;
   if (canCloseServer())
@@ -96,13 +104,13 @@ function sendBADTLSRecord() {
   client.on('error', common.mustCall((err) => {
     let expectedErrorCode = 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION';
     let expectedErrorReason = 'tlsv1 alert protocol version';
-    if (common.hasOpenSSL(3, 2)) {
+    if (hasOpenSSL(3, 2)) {
       expectedErrorCode = 'ERR_SSL_TLSV1_ALERT_RECORD_OVERFLOW';
       expectedErrorReason = 'tlsv1 alert record overflow';
     }
     assert.strictEqual(err.code, expectedErrorCode);
     assert.strictEqual(err.library, 'SSL routines');
-    if (!common.hasOpenSSL3)
+    if (!hasOpenSSL3)
       assert.strictEqual(err.function, 'ssl3_read_bytes');
     assert.strictEqual(err.reason, expectedErrorReason);
   }));
diff --git a/test/parallel/test-tls-alert.js b/test/parallel/test-tls-alert.js
index e6aaaedfe59..23c92e72934 100644
--- a/test/parallel/test-tls-alert.js
+++ b/test/parallel/test-tls-alert.js
@@ -21,11 +21,18 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const {
+  hasOpenSSL,
+  opensslCli,
+} = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const { execFile } = require('child_process');
@@ -42,10 +49,10 @@ const server = tls.Server({
   cert: loadPEM('agent2-cert')
 }, null).listen(0, common.mustCall(() => {
   const args = ['s_client', '-quiet', '-tls1_1',
-                '-cipher', (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+                '-cipher', (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
                 '-connect', `127.0.0.1:${server.address().port}`];
 
-  execFile(common.opensslCli, args, common.mustCall((err, _, stderr) => {
+  execFile(opensslCli, args, common.mustCall((err, _, stderr) => {
     assert.strictEqual(err.code, 1);
     assert.match(stderr, /SSL alert number 70/);
     server.close();
diff --git a/test/parallel/test-tls-alpn-server-client.js b/test/parallel/test-tls-alpn-server-client.js
index 8f1a4b8e439..b7cd2806471 100644
--- a/test/parallel/test-tls-alpn-server-client.js
+++ b/test/parallel/test-tls-alpn-server-client.js
@@ -1,8 +1,9 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const { spawn } = require('child_process');
@@ -198,7 +199,7 @@ function TestFatalAlert() {
 
       // OpenSSL's s_client should output the TLS alert number, which is 120
       // for the 'no_application_protocol' alert.
-      const { opensslCli } = common;
+      const { opensslCli } = require('../common/crypto');
       if (opensslCli) {
         const addr = `${serverIP}:${port}`;
         let stderr = '';
diff --git a/test/parallel/test-tls-cert-ext-encoding.js b/test/parallel/test-tls-cert-ext-encoding.js
index 4556b579185..154e0cdcf02 100644
--- a/test/parallel/test-tls-cert-ext-encoding.js
+++ b/test/parallel/test-tls-cert-ext-encoding.js
@@ -3,7 +3,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (common.hasOpenSSL3)
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (hasOpenSSL3)
   // TODO(danbev) This test fails with the following error:
   // error:0D00008F:asn1 encoding routines::no matching choice type
   //
diff --git a/test/parallel/test-tls-client-auth.js b/test/parallel/test-tls-client-auth.js
index de4c8f038ec..b347c0a88df 100644
--- a/test/parallel/test-tls-client-auth.js
+++ b/test/parallel/test-tls-client-auth.js
@@ -3,6 +3,11 @@
 const common = require('../common');
 const fixtures = require('../common/fixtures');
 
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+const { hasOpenSSL } = require('../common/crypto');
+
 const {
   assert, connect, keys, tls
 } = require(fixtures.path('tls-connect'));
@@ -79,7 +84,7 @@ connect({
 }, function(err, pair, cleanup) {
   assert.strictEqual(pair.server.err.code,
                      'ERR_SSL_PEER_DID_NOT_RETURN_A_CERTIFICATE');
-  const expectedErr = common.hasOpenSSL(3, 2) ?
+  const expectedErr = hasOpenSSL(3, 2) ?
     'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
   assert.strictEqual(pair.client.err.code,
                      expectedErr);
diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
index 0bacd8702fc..0f132c565e4 100644
--- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
+++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js
@@ -3,6 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
@@ -69,7 +70,7 @@ function test(size, type, name, cipher) {
 
 test(undefined, undefined, undefined, 'AES256-SHA256');
 test('auto', 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
-if (!common.hasOpenSSL(3, 2)) {
+if (!hasOpenSSL(3, 2)) {
   test(1024, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
 } else {
   test(3072, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
diff --git a/test/parallel/test-tls-client-mindhsize.js b/test/parallel/test-tls-client-mindhsize.js
index 15c086842e1..1ab5b5fe1bf 100644
--- a/test/parallel/test-tls-client-mindhsize.js
+++ b/test/parallel/test-tls-client-mindhsize.js
@@ -3,6 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
@@ -38,7 +39,7 @@ function test(size, err, next) {
     // Client set minimum DH parameter size to 2048 or 3072 bits
     // so that it fails when it makes a connection to the tls
     // server where is too small
-    const minDHSize = common.hasOpenSSL(3, 2) ? 3072 : 2048;
+    const minDHSize = hasOpenSSL(3, 2) ? 3072 : 2048;
     const client = tls.connect({
       minDHSize: minDHSize,
       port: this.address().port,
@@ -76,7 +77,7 @@ function testDHE3072() {
   test(3072, false, null);
 }
 
-if (common.hasOpenSSL(3, 2)) {
+if (hasOpenSSL(3, 2)) {
   // Minimum size for OpenSSL 3.2 is 2048 by default
   testDHE2048(true, testDHE3072);
 } else {
diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/parallel/test-tls-client-renegotiation-13.js
index a32baed0249..38a72fb525b 100644
--- a/test/parallel/test-tls-client-renegotiation-13.js
+++ b/test/parallel/test-tls-client-renegotiation-13.js
@@ -1,6 +1,12 @@
 'use strict';
 
 const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+const { hasOpenSSL3 } = require('../common/crypto');
+
 const fixtures = require('../common/fixtures');
 
 // Confirm that for TLSv1.3, renegotiate() is disallowed.
@@ -29,7 +35,7 @@ connect({
 
   const ok = client.renegotiate({}, common.mustCall((err) => {
     assert.throws(() => { throw err; }, {
-      message: common.hasOpenSSL3 ?
+      message: hasOpenSSL3 ?
         'error:0A00010A:SSL routines::wrong ssl version' :
         'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
       code: 'ERR_SSL_WRONG_SSL_VERSION',
diff --git a/test/parallel/test-tls-client-renegotiation-limit.js b/test/parallel/test-tls-client-renegotiation-limit.js
index 71d7a85bae4..b35140e8964 100644
--- a/test/parallel/test-tls-client-renegotiation-limit.js
+++ b/test/parallel/test-tls-client-renegotiation-limit.js
@@ -21,11 +21,15 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const tls = require('tls');
diff --git a/test/parallel/test-tls-dhe.js b/test/parallel/test-tls-dhe.js
index 21739ce4242..25b58191e1d 100644
--- a/test/parallel/test-tls-dhe.js
+++ b/test/parallel/test-tls-dhe.js
@@ -22,11 +22,18 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const {
+  hasOpenSSL,
+  opensslCli,
+} = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
@@ -43,7 +50,7 @@ const dheCipher = 'DHE-RSA-AES128-SHA256';
 const ecdheCipher = 'ECDHE-RSA-AES128-SHA256';
 const ciphers = `${dheCipher}:${ecdheCipher}`;
 
-if (!common.hasOpenSSL(3, 2)) {
+if (!hasOpenSSL(3, 2)) {
   // Test will emit a warning because the DH parameter size is < 2048 bits
   // when the test is run on versions lower than OpenSSL32
   common.expectWarning('SecurityWarning',
@@ -70,7 +77,7 @@ function test(dhparam, keylen, expectedCipher) {
     const args = ['s_client', '-connect', `127.0.0.1:${server.address().port}`,
                   '-cipher', `${ciphers}:@SECLEVEL=1`];
 
-    execFile(common.opensslCli, args, common.mustSucceed((stdout) => {
+    execFile(opensslCli, args, common.mustSucceed((stdout) => {
       assert(keylen === null ||
              stdout.includes(`Server Temp Key: DH, ${keylen} bits`));
       assert(stdout.includes(`Cipher    : ${expectedCipher}`));
@@ -107,7 +114,7 @@ function testCustomParam(keylen, expectedCipher) {
   }, /DH parameter is less than 1024 bits/);
 
   // Custom DHE parameters are supported (but discouraged).
-  if (!common.hasOpenSSL(3, 2)) {
+  if (!hasOpenSSL(3, 2)) {
     await testCustomParam(1024, dheCipher);
   } else {
     await testCustomParam(3072, dheCipher);
diff --git a/test/parallel/test-tls-ecdh-auto.js b/test/parallel/test-tls-ecdh-auto.js
index 11c588d8ac8..adc7817b729 100644
--- a/test/parallel/test-tls-ecdh-auto.js
+++ b/test/parallel/test-tls-ecdh-auto.js
@@ -4,11 +4,15 @@ const common = require('../common');
 // This test ensures that the value "auto" on ecdhCurve option is
 // supported to enable automatic curve selection in TLS server.
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -36,7 +40,7 @@ const server = tls.createServer(options, (conn) => {
                 '-cipher', `${options.ciphers}`,
                 '-connect', `127.0.0.1:${server.address().port}`];
 
-  execFile(common.opensslCli, args, common.mustSucceed((stdout) => {
+  execFile(opensslCli, args, common.mustSucceed((stdout) => {
     assert(stdout.includes(reply));
     server.close();
   }));
diff --git a/test/parallel/test-tls-ecdh-multiple.js b/test/parallel/test-tls-ecdh-multiple.js
index 5bf119f48ba..957f8e0407a 100644
--- a/test/parallel/test-tls-ecdh-multiple.js
+++ b/test/parallel/test-tls-ecdh-multiple.js
@@ -4,11 +4,16 @@ const common = require('../common');
 // This test ensures that ecdhCurve option of TLS server supports colon
 // separated ECDH curve names as value.
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+const crypto = require('crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -36,7 +41,7 @@ const server = tls.createServer(options, (conn) => {
                 '-cipher', `${options.ciphers}`,
                 '-connect', `127.0.0.1:${server.address().port}`];
 
-  execFile(common.opensslCli, args, common.mustSucceed((stdout) => {
+  execFile(opensslCli, args, common.mustSucceed((stdout) => {
     assert(stdout.includes(reply));
     server.close();
   }));
@@ -51,8 +56,9 @@ const server = tls.createServer(options, (conn) => {
   ];
 
   // Brainpool is not supported in FIPS mode.
-  if (common.hasFipsCrypto)
+  if (crypto.getFips()) {
     unsupportedCurves.push('brainpoolP256r1');
+  }
 
   unsupportedCurves.forEach((ecdhCurve) => {
     assert.throws(() => tls.createServer({ ecdhCurve }),
diff --git a/test/parallel/test-tls-ecdh.js b/test/parallel/test-tls-ecdh.js
index 276b713f5ec..4d45e7f0245 100644
--- a/test/parallel/test-tls-ecdh.js
+++ b/test/parallel/test-tls-ecdh.js
@@ -23,11 +23,15 @@
 const common = require('../common');
 const fixtures = require('../common/fixtures');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -49,7 +53,7 @@ const server = tls.createServer(options, common.mustCall(function(conn) {
 }));
 
 server.listen(0, '127.0.0.1', common.mustCall(function() {
-  const cmd = common.escapePOSIXShell`"${common.opensslCli}" s_client -cipher ${
+  const cmd = common.escapePOSIXShell`"${opensslCli}" s_client -cipher ${
     options.ciphers} -connect 127.0.0.1:${this.address().port}`;
 
   exec(...cmd, common.mustSucceed((stdout, stderr) => {
diff --git a/test/parallel/test-tls-empty-sni-context.js b/test/parallel/test-tls-empty-sni-context.js
index 093e5cca712..79f1ddd341d 100644
--- a/test/parallel/test-tls-empty-sni-context.js
+++ b/test/parallel/test-tls-empty-sni-context.js
@@ -3,7 +3,7 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-
+const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
@@ -26,7 +26,7 @@ const server = tls.createServer(options, (c) => {
   }, common.mustNotCall());
 
   c.on('error', common.mustCall((err) => {
-    const expectedErr = common.hasOpenSSL(3, 2) ?
+    const expectedErr = hasOpenSSL(3, 2) ?
       'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
     assert.strictEqual(err.code, expectedErr);
   }));
diff --git a/test/parallel/test-tls-getprotocol.js b/test/parallel/test-tls-getprotocol.js
index a9c8775e2f1..b1eab88fd65 100644
--- a/test/parallel/test-tls-getprotocol.js
+++ b/test/parallel/test-tls-getprotocol.js
@@ -3,6 +3,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasOpenSSL } = require('../common/crypto');
+
 // This test ensures that `getProtocol` returns the right protocol
 // from a TLS connection
 
@@ -14,11 +16,11 @@ const clientConfigs = [
   {
     secureProtocol: 'TLSv1_method',
     version: 'TLSv1',
-    ciphers: (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
+    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
   }, {
     secureProtocol: 'TLSv1_1_method',
     version: 'TLSv1.1',
-    ciphers: (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
+    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
   }, {
     secureProtocol: 'TLSv1_2_method',
     version: 'TLSv1.2'
diff --git a/test/parallel/test-tls-junk-server.js b/test/parallel/test-tls-junk-server.js
index cc520383ede..0e536a66884 100644
--- a/test/parallel/test-tls-junk-server.js
+++ b/test/parallel/test-tls-junk-server.js
@@ -1,8 +1,11 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { hasOpenSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const https = require('https');
@@ -21,7 +24,7 @@ server.listen(0, function() {
   req.end();
 
   let expectedErrorMessage = new RegExp('wrong version number');
-  if (common.hasOpenSSL(3, 2)) {
+  if (hasOpenSSL(3, 2)) {
     expectedErrorMessage = new RegExp('packet length too long');
   };
   req.once('error', common.mustCall(function(err) {
diff --git a/test/parallel/test-tls-key-mismatch.js b/test/parallel/test-tls-key-mismatch.js
index fdbb3676267..df8848a03de 100644
--- a/test/parallel/test-tls-key-mismatch.js
+++ b/test/parallel/test-tls-key-mismatch.js
@@ -22,14 +22,16 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 const assert = require('assert');
 const tls = require('tls');
-const errorMessageRegex = common.hasOpenSSL3 ?
+const errorMessageRegex = hasOpenSSL3 ?
   /^Error: error:05800074:x509 certificate routines::key values mismatch$/ :
   /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/;
 
diff --git a/test/parallel/test-tls-legacy-pfx.js b/test/parallel/test-tls-legacy-pfx.js
index 33b4c58fc6c..5106217718d 100644
--- a/test/parallel/test-tls-legacy-pfx.js
+++ b/test/parallel/test-tls-legacy-pfx.js
@@ -1,9 +1,14 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
-if (!common.hasOpenSSL3)
+}
+
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3) {
   common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+');
+}
 
 const fixtures = require('../common/fixtures');
 
diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
index af32468eea6..4903d92f5c5 100644
--- a/test/parallel/test-tls-min-max-version.js
+++ b/test/parallel/test-tls-min-max-version.js
@@ -1,5 +1,13 @@
 'use strict';
 const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+const {
+  hasOpenSSL,
+  hasOpenSSL3,
+} = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const { inspect } = require('util');
 
@@ -16,13 +24,13 @@ function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
   assert(proto || cerr || serr, 'test missing any expectations');
 
   let ciphers;
-  if (common.hasOpenSSL3 && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
+  if (hasOpenSSL3 && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
       proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
       sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
     if (serr !== 'ERR_SSL_UNSUPPORTED_PROTOCOL')
       ciphers = 'ALL@SECLEVEL=0';
   }
-  if (common.hasOpenSSL(3, 1) && cerr === 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION') {
+  if (hasOpenSSL(3, 1) && cerr === 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION') {
     ciphers = 'DEFAULT@SECLEVEL=0';
   }
   // Report where test was called from. Strip leading garbage from
@@ -125,9 +133,9 @@ test(U, U, 'TLS_method', U, U, 'TLSv1_method', 'TLSv1');
 
 // OpenSSL 1.1.1 and 3.0 use a different error code and alert (sent to the
 // client) when no protocols are enabled on the server.
-const NO_PROTOCOLS_AVAILABLE_SERVER = common.hasOpenSSL3 ?
+const NO_PROTOCOLS_AVAILABLE_SERVER = hasOpenSSL3 ?
   'ERR_SSL_NO_PROTOCOLS_AVAILABLE' : 'ERR_SSL_INTERNAL_ERROR';
-const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = common.hasOpenSSL3 ?
+const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = hasOpenSSL3 ?
   'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION' : 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR';
 
 // SSLv23 also means "any supported protocol" greater than the default
diff --git a/test/parallel/test-tls-no-sslv3.js b/test/parallel/test-tls-no-sslv3.js
index 9282beb4bda..cd5f4ad944a 100644
--- a/test/parallel/test-tls-no-sslv3.js
+++ b/test/parallel/test-tls-no-sslv3.js
@@ -1,10 +1,14 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (common.opensslCli === false)
+const { opensslCli } = require('../common/crypto');
+
+if (opensslCli === false) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -23,7 +27,7 @@ server.listen(0, '127.0.0.1', function() {
                 '-ssl3',
                 '-connect', address];
 
-  const client = spawn(common.opensslCli, args, { stdio: 'pipe' });
+  const client = spawn(opensslCli, args, { stdio: 'pipe' });
   client.stdout.pipe(process.stdout);
   client.stderr.pipe(process.stderr);
   client.stderr.setEncoding('utf8');
diff --git a/test/parallel/test-tls-ocsp-callback.js b/test/parallel/test-tls-ocsp-callback.js
index 04a60a0890c..bdf622d4686 100644
--- a/test/parallel/test-tls-ocsp-callback.js
+++ b/test/parallel/test-tls-ocsp-callback.js
@@ -22,12 +22,17 @@
 'use strict';
 const common = require('../common');
 
-if (!common.opensslCli)
-  common.skip('node compiled without OpenSSL CLI.');
-
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
+  common.skip('node compiled without OpenSSL CLI.');
+}
+
+const crypto = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
 
@@ -108,6 +113,6 @@ test({ ocsp: true, response: false });
 test({ ocsp: true, response: 'hello world' });
 test({ ocsp: false });
 
-if (!common.hasFipsCrypto) {
+if (!crypto.getFips()) {
   test({ ocsp: true, response: 'hello pfx', pfx: pfx, passphrase: 'sample' });
 }
diff --git a/test/parallel/test-tls-psk-circuit.js b/test/parallel/test-tls-psk-circuit.js
index c06e61c321e..61861ecf4da 100644
--- a/test/parallel/test-tls-psk-circuit.js
+++ b/test/parallel/test-tls-psk-circuit.js
@@ -1,9 +1,11 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
+const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
@@ -62,12 +64,12 @@ test({ psk: USERS.UserA, identity: 'UserA' }, { minVersion: 'TLSv1.3' });
 test({ psk: USERS.UserB, identity: 'UserB' });
 test({ psk: USERS.UserB, identity: 'UserB' }, { minVersion: 'TLSv1.3' });
 // Unrecognized user should fail handshake
-const expectedHandshakeErr = common.hasOpenSSL(3, 2) ?
+const expectedHandshakeErr = hasOpenSSL(3, 2) ?
   'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
 test({ psk: USERS.UserB, identity: 'UserC' }, {}, expectedHandshakeErr);
 // Recognized user but incorrect secret should fail handshake
-const expectedIllegalParameterErr = common.hasOpenSSL(3, 4) ? 'ERR_SSL_TLSV1_ALERT_DECRYPT_ERROR' :
-  common.hasOpenSSL(3, 2) ?
+const expectedIllegalParameterErr = hasOpenSSL(3, 4) ? 'ERR_SSL_TLSV1_ALERT_DECRYPT_ERROR' :
+  hasOpenSSL(3, 2) ?
     'ERR_SSL_SSL/TLS_ALERT_ILLEGAL_PARAMETER' : 'ERR_SSL_SSLV3_ALERT_ILLEGAL_PARAMETER';
 test({ psk: USERS.UserA, identity: 'UserB' }, {}, expectedIllegalParameterErr);
 test({ psk: USERS.UserB, identity: 'UserB' });
diff --git a/test/parallel/test-tls-psk-server.js b/test/parallel/test-tls-psk-server.js
index b9260958401..87fad86083e 100644
--- a/test/parallel/test-tls-psk-server.js
+++ b/test/parallel/test-tls-psk-server.js
@@ -1,10 +1,15 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
-if (!common.opensslCli)
+}
+
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl cli');
+}
 
 const assert = require('assert');
 
@@ -41,7 +46,7 @@ let sentWorld = false;
 let gotWorld = false;
 
 server.listen(0, () => {
-  const client = spawn(common.opensslCli, [
+  const client = spawn(opensslCli, [
     's_client',
     '-connect', `127.0.0.1:${server.address().port}`,
     '-cipher', CIPHERS,
diff --git a/test/parallel/test-tls-securepair-server.js b/test/parallel/test-tls-securepair-server.js
index 78cd9f72540..fb4ebe6a251 100644
--- a/test/parallel/test-tls-securepair-server.js
+++ b/test/parallel/test-tls-securepair-server.js
@@ -21,11 +21,15 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -109,7 +113,7 @@ server.listen(0, common.mustCall(function() {
 
   const args = ['s_client', '-connect', `127.0.0.1:${this.address().port}`];
 
-  const client = spawn(common.opensslCli, args);
+  const client = spawn(opensslCli, args);
 
 
   let out = '';
diff --git a/test/parallel/test-tls-server-verify.js b/test/parallel/test-tls-server-verify.js
index 51ccd0d747f..2517c7c8dbb 100644
--- a/test/parallel/test-tls-server-verify.js
+++ b/test/parallel/test-tls-server-verify.js
@@ -22,11 +22,15 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 // This is a rather complex test which sets up various TLS servers with node
 // and connects to them using the 'openssl s_client' command line utility
@@ -188,7 +192,7 @@ function runClient(prefix, port, options, cb) {
   }
 
   // To test use: openssl s_client -connect localhost:8000
-  const client = spawn(common.opensslCli, args);
+  const client = spawn(opensslCli, args);
 
   let out = '';
 
diff --git a/test/parallel/test-tls-session-cache.js b/test/parallel/test-tls-session-cache.js
index b55e150401d..9524764aa60 100644
--- a/test/parallel/test-tls-session-cache.js
+++ b/test/parallel/test-tls-session-cache.js
@@ -21,17 +21,23 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+const {
+  hasOpenSSL,
+  opensslCli,
+} = require('../common/crypto');
+
+if (!opensslCli) {
+  common.skip('node compiled without OpenSSL CLI.');
+}
+
 const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const tls = require('tls');
 const { spawn } = require('child_process');
 
-if (!common.opensslCli)
-  common.skip('node compiled without OpenSSL CLI.');
-
-
 doTest({ tickets: false }, function() {
   doTest({ tickets: true }, function() {
     doTest({ tickets: false, invalidSession: true }, function() {
@@ -100,7 +106,7 @@ function doTest(testOptions, callback) {
     const args = [
       's_client',
       '-tls1',
-      '-cipher', (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+      '-cipher', (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
       '-connect', `localhost:${this.address().port}`,
       '-servername', 'ohgod',
       '-key', fixtures.path('keys/rsa_private.pem'),
@@ -109,7 +115,7 @@ function doTest(testOptions, callback) {
     ].concat(testOptions.tickets ? [] : '-no_ticket');
 
     function spawnClient() {
-      const client = spawn(common.opensslCli, args, {
+      const client = spawn(opensslCli, args, {
         stdio: [ 0, 1, 'pipe' ]
       });
       let err = '';
diff --git a/test/parallel/test-tls-set-ciphers.js b/test/parallel/test-tls-set-ciphers.js
index f7062e73c94..1e63e9376e1 100644
--- a/test/parallel/test-tls-set-ciphers.js
+++ b/test/parallel/test-tls-set-ciphers.js
@@ -1,7 +1,17 @@
 'use strict';
 const common = require('../common');
-if (!common.hasOpenSSL3)
+if (!common.hasCrypto) {
   common.skip('missing crypto, or OpenSSL version lower than 3');
+}
+
+const {
+  hasOpenSSL,
+  hasOpenSSL3,
+} = require('../common/crypto');
+
+if (!hasOpenSSL3) {
+  common.skip('missing crypto, or OpenSSL version lower than 3');
+}
 
 const fixtures = require('../common/fixtures');
 const { inspect } = require('util');
@@ -80,7 +90,7 @@ function test(cciphers, sciphers, cipher, cerr, serr, options) {
 const U = undefined;
 
 let expectedTLSAlertError = 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
-if (common.hasOpenSSL(3, 2)) {
+if (hasOpenSSL(3, 2)) {
   expectedTLSAlertError = 'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE';
 }
 
@@ -117,7 +127,7 @@ test(U, 'AES256-SHA', 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' })
 // default, but work.
 // However, for OpenSSL32 AES_128 is not enabled due to the
 // default security level
-if (!common.hasOpenSSL(3, 2)) {
+if (!hasOpenSSL(3, 2)) {
   test('TLS_AES_128_CCM_8_SHA256', U,
        U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
 
diff --git a/test/parallel/test-tls-set-secure-context.js b/test/parallel/test-tls-set-secure-context.js
index c056875e14d..3d2de6b3321 100644
--- a/test/parallel/test-tls-set-secure-context.js
+++ b/test/parallel/test-tls-set-secure-context.js
@@ -1,8 +1,9 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 // This test verifies the behavior of the tls setSecureContext() method.
 // It also verifies that existing connections are not disrupted when the
@@ -12,6 +13,7 @@ const assert = require('assert');
 const events = require('events');
 const https = require('https');
 const timers = require('timers/promises');
+const { hasOpenSSL3 } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const credentialOptions = [
   {
@@ -55,7 +57,7 @@ server.listen(0, common.mustCall(() => {
 
     server.setSecureContext(credentialOptions[1]);
     firstResponse.write('request-');
-    const errorMessageRegex = common.hasOpenSSL3 ?
+    const errorMessageRegex = hasOpenSSL3 ?
       /^Error: self-signed certificate$/ :
       /^Error: self signed certificate$/;
     await assert.rejects(makeRequest(port, 3), errorMessageRegex);
diff --git a/test/parallel/test-tls-set-sigalgs.js b/test/parallel/test-tls-set-sigalgs.js
index 3f3d152f4d8..985ca13ba2a 100644
--- a/test/parallel/test-tls-set-sigalgs.js
+++ b/test/parallel/test-tls-set-sigalgs.js
@@ -1,6 +1,9 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto) common.skip('missing crypto');
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+const { hasOpenSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 // Test sigalgs: option for TLS.
@@ -63,7 +66,7 @@ test('RSA-PSS+SHA256:RSA-PSS+SHA512:ECDSA+SHA256',
      ['RSA-PSS+SHA256', 'ECDSA+SHA256']);
 
 // Do not have shared sigalgs.
-const handshakeErr = common.hasOpenSSL(3, 2) ?
+const handshakeErr = hasOpenSSL(3, 2) ?
   'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
 test('RSA-PSS+SHA384', 'ECDSA+SHA256',
      undefined, handshakeErr,
diff --git a/test/parallel/test-trace-env.js b/test/parallel/test-trace-env.js
index ba08e0af2aa..7a7b80fa4c1 100644
--- a/test/parallel/test-trace-env.js
+++ b/test/parallel/test-trace-env.js
@@ -18,9 +18,11 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')],
     }
     if (common.hasCrypto) {
       assert.match(output, /get "NODE_EXTRA_CA_CERTS"/);
-    }
-    if (common.hasOpenSSL3) {
-      assert.match(output, /get "OPENSSL_CONF"/);
+
+      const { hasOpenSSL3 } = require('../common/crypto');
+      if (hasOpenSSL3) {
+        assert.match(output, /get "OPENSSL_CONF"/);
+      }
     }
     assert.match(output, /get "NODE_DEBUG_NATIVE"/);
     assert.match(output, /get "NODE_COMPILE_CACHE"/);
diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js
index e6ae4d88690..b507af88e1f 100644
--- a/test/parallel/test-x509-escaping.js
+++ b/test/parallel/test-x509-escaping.js
@@ -1,15 +1,16 @@
 'use strict';
 
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
 
-const { hasOpenSSL3 } = common;
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Test that all certificate chains provided by the reporter are rejected.
 {
diff --git a/test/pummel/test-crypto-dh-hash.js b/test/pummel/test-crypto-dh-hash.js
index ef5a640688c..b59f556a204 100644
--- a/test/pummel/test-crypto-dh-hash.js
+++ b/test/pummel/test-crypto-dh-hash.js
@@ -30,7 +30,9 @@ if (common.isPi) {
   common.skip('Too slow for Raspberry Pi devices');
 }
 
-if (!common.hasOpenSSL3) {
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3) {
   common.skip('Too slow when dynamically linked against OpenSSL 1.1.1');
 }
 
diff --git a/test/pummel/test-crypto-dh-keys.js b/test/pummel/test-crypto-dh-keys.js
index 2caa4e244a9..abce6a07acf 100644
--- a/test/pummel/test-crypto-dh-keys.js
+++ b/test/pummel/test-crypto-dh-keys.js
@@ -36,8 +36,9 @@ const crypto = require('crypto');
 [ 'modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17' ]
 .forEach((name) => {
   // modp1 is 768 bits, FIPS requires >= 1024
-  if (name === 'modp1' && common.hasFipsCrypto)
+  if (name === 'modp1' && crypto.getFips()) {
     return;
+  }
   const group1 = crypto.getDiffieHellman(name);
   const group2 = crypto.getDiffieHellman(name);
   group1.generateKeys();
diff --git a/test/pummel/test-dh-regr.js b/test/pummel/test-dh-regr.js
index 41d5bf872f9..cfae57d0728 100644
--- a/test/pummel/test-dh-regr.js
+++ b/test/pummel/test-dh-regr.js
@@ -32,10 +32,11 @@ if (common.isPi) {
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // FIPS requires length >= 1024 but we use 512/256 in this test to keep it from
 // taking too long and timing out in CI.
-const length = (common.hasFipsCrypto) ? 1024 : common.hasOpenSSL3 ? 512 : 256;
+const length = crypto.getFips() ? 1024 : hasOpenSSL3 ? 512 : 256;
 
 const p = crypto.createDiffieHellman(length).getPrime();
 
diff --git a/test/sequential/test-tls-psk-client.js b/test/sequential/test-tls-psk-client.js
index ddebc8f8cc9..c07b1f92d98 100644
--- a/test/sequential/test-tls-psk-client.js
+++ b/test/sequential/test-tls-psk-client.js
@@ -1,10 +1,15 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
-if (!common.opensslCli)
+}
+
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -16,7 +21,7 @@ const KEY = 'd731ef57be09e5204f0b205b60627028';
 const IDENTITY = 'Client_identity';  // Hardcoded by `openssl s_server`
 const useIPv4 = !common.hasIPv6;
 
-const server = spawn(common.opensslCli, [
+const server = spawn(opensslCli, [
   's_server',
   '-accept', common.PORT,
   '-cipher', CIPHERS,
diff --git a/test/sequential/test-tls-securepair-client.js b/test/sequential/test-tls-securepair-client.js
index f3ca42ad6ed..262518621b5 100644
--- a/test/sequential/test-tls-securepair-client.js
+++ b/test/sequential/test-tls-securepair-client.js
@@ -23,14 +23,19 @@
 
 const common = require('../common');
 
-if (!common.opensslCli)
-  common.skip('node compiled without OpenSSL CLI.');
-
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (common.isWindows)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
+  common.skip('node compiled without OpenSSL CLI.');
+}
+
+if (common.isWindows) {
   common.skip('test does not work on Windows'); // ...but it should!
+}
 
 const net = require('net');
 const assert = require('assert');
@@ -63,11 +68,11 @@ function test(keyPath, certPath, check, next) {
   const key = fixtures.readSync(keyPath).toString();
   const cert = fixtures.readSync(certPath).toString();
 
-  const server = spawn(common.opensslCli, ['s_server',
-                                           '-accept', 0,
-                                           '-cert', fixtures.path(certPath),
-                                           '-key', fixtures.path(keyPath),
-                                           ...(useIPv4 ? ['-4'] : []),
+  const server = spawn(opensslCli, ['s_server',
+                                    '-accept', 0,
+                                    '-cert', fixtures.path(certPath),
+                                    '-key', fixtures.path(keyPath),
+                                    ...(useIPv4 ? ['-4'] : []),
   ]);
   server.stdout.pipe(process.stdout);
   server.stderr.pipe(process.stdout);
diff --git a/test/sequential/test-tls-session-timeout.js b/test/sequential/test-tls-session-timeout.js
index 09107011aed..a93cdc793a2 100644
--- a/test/sequential/test-tls-session-timeout.js
+++ b/test/sequential/test-tls-session-timeout.js
@@ -22,8 +22,11 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
 
 const tmpdir = require('../common/tmpdir');
 tmpdir.refresh();
@@ -56,8 +59,9 @@ const cert = fixtures.readKey('rsa_cert.crt');
   }
 }
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 doTest();
 
@@ -105,7 +109,7 @@ function doTest() {
       '-sess_in', sessionFileName,
       '-sess_out', sessionFileName,
     ];
-    const client = spawn(common.opensslCli, flags, {
+    const client = spawn(opensslCli, flags, {
       stdio: ['ignore', 'pipe', 'ignore']
     });