diff --git a/lib/curl_setup.h b/lib/curl_setup.h
index 9d18875b9d..0214219a85 100644
--- a/lib/curl_setup.h
+++ b/lib/curl_setup.h
@@ -1568,8 +1568,8 @@ typedef struct sockaddr_un {
 /* OpenSSL 3 marks these functions deprecated but we have no replacements (yet)
    so tell the compiler to not warn for them:
    - DES_* (for NTLM)
-   - EVP_PKEY_get1_RSA, MD5_*, RSA_flags, RSA_free (auto-skipped for OpenSSL
-     built with no-deprecated) */
+   - EVP_PKEY_get1_RSA, RSA_flags, RSA_free (auto-skipped for OpenSSL built
+     with no-deprecated) */
 #  define OPENSSL_SUPPRESS_DEPRECATED
 #  ifdef _WIN32
 /* Silence LibreSSL warnings about wincrypt.h collision. Works in 3.8.2+ */
diff --git a/lib/curl_sha512_256.c b/lib/curl_sha512_256.c
index d0c81e7a55..f125f4f6c8 100644
--- a/lib/curl_sha512_256.c
+++ b/lib/curl_sha512_256.c
@@ -108,26 +108,23 @@ typedef EVP_MD_CTX *Curl_sha512_256_ctx;
  * @return CURLE_OK if succeed,
  *         error code otherwise
  */
-static CURLcode Curl_sha512_256_init(void *context)
+static CURLcode Curl_sha512_256_init(void *in)
 {
-  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
-
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   *ctx = EVP_MD_CTX_new();
   if(!*ctx)
     return CURLE_OUT_OF_MEMORY;
 
-  if(EVP_DigestInit_ex(*ctx, EVP_sha512_256(), NULL)) {
-    /* Check whether the header and this file use the same numbers */
-    DEBUGASSERT(EVP_MD_CTX_size(*ctx) == CURL_SHA512_256_DIGEST_SIZE);
-    /* Check whether the block size is correct */
-    DEBUGASSERT(EVP_MD_CTX_block_size(*ctx) == CURL_SHA512_256_BLOCK_SIZE);
-
-    return CURLE_OK; /* Success */
+  if(!EVP_DigestInit_ex(*ctx, EVP_sha512_256(), NULL)) {
+    EVP_MD_CTX_free(*ctx);
+    *ctx = NULL;
+    return CURLE_FAILED_INIT;
   }
-
-  /* Cleanup */
-  EVP_MD_CTX_free(*ctx);
-  return CURLE_FAILED_INIT;
+  /* Check whether the header and this file use the same numbers */
+  DEBUGASSERT(EVP_MD_CTX_size(*ctx) == CURL_SHA512_256_DIGEST_SIZE);
+  /* Check whether the block size is correct */
+  DEBUGASSERT(EVP_MD_CTX_block_size(*ctx) == CURL_SHA512_256_BLOCK_SIZE);
+  return CURLE_OK;
 }
 
 /**
@@ -138,15 +135,13 @@ static CURLcode Curl_sha512_256_init(void *context)
  * @return CURLE_OK if succeed,
  *         error code otherwise
  */
-static CURLcode Curl_sha512_256_update(void *context,
+static CURLcode Curl_sha512_256_update(void *in,
                                        const unsigned char *data,
                                        size_t length)
 {
-  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
-
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
   if(!EVP_DigestUpdate(*ctx, data, length))
     return CURLE_BAD_FUNCTION_ARGUMENT;
-
   return CURLE_OK;
 }
 
@@ -159,28 +154,29 @@ static CURLcode Curl_sha512_256_update(void *context,
  * @return CURLE_OK if succeed,
  *         error code otherwise
  */
-static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *context)
+static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *in)
 {
   CURLcode result;
-  Curl_sha512_256_ctx * const ctx = (Curl_sha512_256_ctx *)context;
-
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
+  if(digest) {
 #ifdef NEED_NETBSD_SHA512_256_WORKAROUND
-  /* Use a larger buffer to work around a bug in NetBSD:
-     https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=58039 */
-  unsigned char tmp_digest[CURL_SHA512_256_DIGEST_SIZE * 2];
-  result = EVP_DigestFinal_ex(*ctx, tmp_digest, NULL) ?
-    CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
-  if(result == CURLE_OK)
-    memcpy(digest, tmp_digest, CURL_SHA512_256_DIGEST_SIZE);
-  curlx_memzero(tmp_digest, sizeof(tmp_digest));
+    /* Use a larger buffer to work around a bug in NetBSD:
+       https://gnats.netbsd.org/cgi-bin/query-pr-single.pl?number=58039 */
+    unsigned char tmp_digest[CURL_SHA512_256_DIGEST_SIZE * 2];
+    result = EVP_DigestFinal_ex(*ctx, tmp_digest, NULL) ?
+      CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
+    if(result == CURLE_OK)
+      memcpy(digest, tmp_digest, CURL_SHA512_256_DIGEST_SIZE);
+    curlx_memzero(tmp_digest, sizeof(tmp_digest));
 #else /* !NEED_NETBSD_SHA512_256_WORKAROUND */
-  result = EVP_DigestFinal_ex(*ctx, digest, NULL) ?
-    CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
+    result = EVP_DigestFinal_ex(*ctx, digest, NULL) ?
+      CURLE_OK : CURLE_BAD_FUNCTION_ARGUMENT;
 #endif /* NEED_NETBSD_SHA512_256_WORKAROUND */
-
+  }
+  else
+    result = CURLE_OK;
   EVP_MD_CTX_free(*ctx);
   *ctx = NULL;
-
   return result;
 }
 
diff --git a/lib/hmac.c b/lib/hmac.c
index a4d6ebdd8a..bba98aeec5 100644
--- a/lib/hmac.c
+++ b/lib/hmac.c
@@ -58,6 +58,8 @@ struct HMAC_context *Curl_HMAC_init(const struct HMAC_params *hashparams,
   if(!ctxt)
     return ctxt;
 
+  memset(ctxt, 0, i);
+
   ctxt->hash = hashparams;
   ctxt->hashctxt1 = (void *)(ctxt + 1);
   ctxt->hashctxt2 = (void *)((char *)ctxt->hashctxt1 + hashparams->ctxtsize);
@@ -94,6 +96,8 @@ struct HMAC_context *Curl_HMAC_init(const struct HMAC_params *hashparams,
   return ctxt;
 
 fail:
+  hashparams->hfinal(NULL, ctxt->hashctxt1);
+  hashparams->hfinal(NULL, ctxt->hashctxt2);
   curlx_free(ctxt);
   return NULL;
 }
diff --git a/lib/md4.c b/lib/md4.c
index e030ffac30..06cfbb0b3e 100644
--- a/lib/md4.c
+++ b/lib/md4.c
@@ -42,16 +42,35 @@
 #include <wolfssl/options.h>
 #endif
 
-/* When OpenSSL or wolfSSL is available, we use their MD4 functions. */
-
 #if defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD4)
-#include <openssl/md4.h>
+#include <openssl/evp.h>
 
-/* Map directly to OpenSSL implementation */
-#define my_md4_ctx    MD4_CTX
-#define my_md4_init   MD4_Init
-#define my_md4_update MD4_Update
-#define my_md4_final  MD4_Final
+typedef EVP_MD_CTX *my_md4_ctx;
+
+static int my_md4_init(my_md4_ctx *ctx)
+{
+  *ctx = EVP_MD_CTX_new();
+  if(!*ctx)
+    return 0;
+
+  if(!EVP_DigestInit_ex(*ctx, EVP_md4(), NULL)) {
+    EVP_MD_CTX_free(*ctx);
+    return 0;
+  }
+  return 1;
+}
+
+static void my_md4_update(my_md4_ctx *ctx,
+                          const unsigned char *input, unsigned int len)
+{
+  (void)EVP_DigestUpdate(*ctx, input, len);
+}
+
+static void my_md4_final(unsigned char *digest, my_md4_ctx *ctx)
+{
+  (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
+  EVP_MD_CTX_free(*ctx);
+}
 
 #elif defined(USE_WOLFSSL) && !defined(NO_MD4)
 #include <wolfssl/wolfcrypt/md4.h>
diff --git a/lib/md5.c b/lib/md5.c
index 358f0744ea..9d8b01988b 100644
--- a/lib/md5.c
+++ b/lib/md5.c
@@ -65,36 +65,48 @@ static void my_md5_update(void *ctx,
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
+  if(digest)
 #if NETTLE_VERSION_MAJOR >= 4
-  md5_digest(ctx, digest);
+    md5_digest(ctx, digest);
 #else
-  md5_digest(ctx, MD5_DIGEST_LEN, digest);
+    md5_digest(ctx, MD5_DIGEST_LEN, digest);
 #endif
 }
 
-#elif defined(USE_OPENSSL) && \
-  !defined(OPENSSL_NO_MD5) && !defined(OPENSSL_NO_DEPRECATED_3_0)
-#include <openssl/md5.h>
+#elif defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD5)
+#include <openssl/evp.h>
 
-typedef MD5_CTX my_md5_ctx;
+typedef EVP_MD_CTX *my_md5_ctx;
 
-static CURLcode my_md5_init(void *ctx)
+static CURLcode my_md5_init(void *in)
 {
-  if(!MD5_Init(ctx))
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
+  *ctx = EVP_MD_CTX_new();
+  if(!*ctx)
     return CURLE_OUT_OF_MEMORY;
 
+  if(!EVP_DigestInit_ex(*ctx, EVP_md5(), NULL)) {
+    EVP_MD_CTX_free(*ctx);
+    *ctx = NULL;
+    return CURLE_FAILED_INIT;
+  }
   return CURLE_OK;
 }
 
-static void my_md5_update(void *ctx,
+static void my_md5_update(void *in,
                           const unsigned char *input, unsigned int len)
 {
-  (void)MD5_Update(ctx, input, len);
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
+  (void)EVP_DigestUpdate(*ctx, input, len);
 }
 
-static void my_md5_final(unsigned char *digest, void *ctx)
+static void my_md5_final(unsigned char *digest, void *in)
 {
-  (void)MD5_Final(digest, ctx);
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
+  if(digest)
+    (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
+  EVP_MD_CTX_free(*ctx);
+  *ctx = NULL;
 }
 
 #elif defined(USE_WOLFSSL) && !defined(NO_MD5)
@@ -117,7 +129,8 @@ static void my_md5_update(void *ctx,
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
-  (void)wc_Md5Final(ctx, digest);
+  if(digest)
+    (void)wc_Md5Final(ctx, digest);
 }
 
 #elif defined(USE_MBEDTLS) && \
@@ -143,8 +156,12 @@ static void my_md5_update(void *ctx,
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
-  size_t actual_length;
-  (void)psa_hash_finish(ctx, digest, MD5_DIGEST_LEN, &actual_length);
+  if(digest) {
+    size_t actual_length;
+    (void)psa_hash_finish(ctx, digest, MD5_DIGEST_LEN, &actual_length);
+  }
+  else
+    (void)psa_hash_abort(ctx);
 }
 
 #elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
@@ -181,7 +198,8 @@ static void my_md5_update(void *ctx,
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
-  CC_MD5_Final(digest, ctx);
+  if(digest)
+    CC_MD5_Final(digest, ctx);
 }
 
 #elif defined(USE_WIN32_CRYPTO)
@@ -219,12 +237,17 @@ static void my_md5_update(void *in,
 static void my_md5_final(unsigned char *digest, void *in)
 {
   my_md5_ctx *ctx = (my_md5_ctx *)in;
-  unsigned long length = 0;
-  CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
-  if(length == MD5_DIGEST_LEN)
-    CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
+
+  if(digest) {
+    unsigned long length = 0;
+    CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
+    if(length == MD5_DIGEST_LEN)
+      CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
+  }
+
   if(ctx->hHash)
     CryptDestroyHash(ctx->hHash);
+
   if(ctx->hCryptProv)
     CryptReleaseContext(ctx->hCryptProv, 0);
 }
@@ -475,6 +498,9 @@ static void my_md5_final(unsigned char *digest, void *in)
   unsigned int used, available;
   my_md5_ctx *ctx = (my_md5_ctx *)in;
 
+  if(!digest)
+    return;
+
   used = ctx->lo & 0x3f;
 
   ctx->buffer[used++] = 0x80;
diff --git a/lib/sha256.c b/lib/sha256.c
index e2278d3664..6b1e90dcc1 100644
--- a/lib/sha256.c
+++ b/lib/sha256.c
@@ -53,20 +53,18 @@
 #ifdef USE_OPENSSL
 #include <openssl/evp.h>
 
-struct ossl_sha256_ctx {
-  EVP_MD_CTX *openssl_ctx;
-};
-typedef struct ossl_sha256_ctx my_sha256_ctx;
+typedef EVP_MD_CTX *my_sha256_ctx;
 
 static CURLcode my_sha256_init(void *in)
 {
-  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
-  ctx->openssl_ctx = EVP_MD_CTX_new();
-  if(!ctx->openssl_ctx)
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
+  *ctx = EVP_MD_CTX_new();
+  if(!*ctx)
     return CURLE_OUT_OF_MEMORY;
 
-  if(!EVP_DigestInit_ex(ctx->openssl_ctx, EVP_sha256(), NULL)) {
-    EVP_MD_CTX_free(ctx->openssl_ctx);
+  if(!EVP_DigestInit_ex(*ctx, EVP_sha256(), NULL)) {
+    EVP_MD_CTX_free(*ctx);
+    *ctx = NULL;
     return CURLE_FAILED_INIT;
   }
   return CURLE_OK;
@@ -76,15 +74,17 @@ static void my_sha256_update(void *in,
                              const unsigned char *data,
                              unsigned int length)
 {
-  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
-  EVP_DigestUpdate(ctx->openssl_ctx, data, length);
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
+  (void)EVP_DigestUpdate(*ctx, data, length);
 }
 
 static void my_sha256_final(unsigned char *digest, void *in)
 {
-  my_sha256_ctx *ctx = (my_sha256_ctx *)in;
-  EVP_DigestFinal_ex(ctx->openssl_ctx, digest, NULL);
-  EVP_MD_CTX_free(ctx->openssl_ctx);
+  EVP_MD_CTX ** const ctx = (EVP_MD_CTX **)in;
+  if(digest)
+    (void)EVP_DigestFinal_ex(*ctx, digest, NULL);
+  EVP_MD_CTX_free(*ctx);
+  *ctx = NULL;
 }
 
 #elif defined(USE_WOLFSSL)
@@ -109,7 +109,8 @@ static void my_sha256_update(void *in,
 
 static void my_sha256_final(unsigned char *digest, void *in)
 {
-  (void)wc_Sha256Final(in, digest);
+  if(digest)
+    (void)wc_Sha256Final(in, digest);
 }
 
 #elif defined(USE_GNUTLS)
@@ -133,10 +134,11 @@ static void my_sha256_update(void *ctx,
 
 static void my_sha256_final(unsigned char *digest, void *ctx)
 {
+  if(digest)
 #if NETTLE_VERSION_MAJOR >= 4
-  sha256_digest(ctx, digest);
+    sha256_digest(ctx, digest);
 #else
-  sha256_digest(ctx, SHA256_DIGEST_SIZE, digest);
+    sha256_digest(ctx, SHA256_DIGEST_SIZE, digest);
 #endif
 }
 
@@ -164,9 +166,13 @@ static void my_sha256_update(void *ctx,
 
 static void my_sha256_final(unsigned char *digest, void *ctx)
 {
-  size_t actual_length;
-  (void)psa_hash_finish(ctx, digest, CURL_SHA256_DIGEST_LENGTH,
-                        &actual_length);
+  if(digest) {
+    size_t actual_length;
+    (void)psa_hash_finish(ctx, digest, CURL_SHA256_DIGEST_LENGTH,
+                          &actual_length);
+  }
+  else
+    (void)psa_hash_abort(ctx);
 }
 
 #elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
@@ -192,7 +198,8 @@ static void my_sha256_update(void *ctx,
 
 static void my_sha256_final(unsigned char *digest, void *ctx)
 {
-  (void)CC_SHA256_Final(digest, ctx);
+  if(digest)
+    (void)CC_SHA256_Final(digest, ctx);
 }
 
 #elif defined(USE_WIN32_CRYPTO)
@@ -231,11 +238,13 @@ static void my_sha256_update(void *in,
 static void my_sha256_final(unsigned char *digest, void *in)
 {
   my_sha256_ctx *ctx = (my_sha256_ctx *)in;
-  unsigned long length = 0;
 
-  CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
-  if(length == CURL_SHA256_DIGEST_LENGTH)
-    CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
+  if(digest) {
+    unsigned long length = 0;
+    CryptGetHashParam(ctx->hHash, HP_HASHVAL, NULL, &length, 0);
+    if(length == CURL_SHA256_DIGEST_LENGTH)
+      CryptGetHashParam(ctx->hHash, HP_HASHVAL, digest, &length, 0);
+  }
 
   if(ctx->hHash)
     CryptDestroyHash(ctx->hHash);
@@ -431,6 +440,9 @@ static void my_sha256_final(unsigned char *out, void *ctx)
   struct sha256_state *md = ctx;
   int i;
 
+  if(!out)
+    return;
+
   if(md->curlen >= sizeof(md->buf))
     return;