From 209cdfe685db71714ec093480084bab8cf58d8eb Mon Sep 17 00:00:00 2001
From: James M Snell <jasnell@gmail.com>
Date: Wed, 22 Jan 2025 16:46:48 -0800
Subject: [PATCH] test: move crypto related common utilities in common/crypto

Since `common/crypto` already exists, it makes sense to keep
crypto-related utilities there. The only exception being
common.hasCrypto which is needed up front to determine
if tests should be skipped.

Eliminate the redundant check in hasFipsCrypto and just
use crypto.getFips() directly where needed.
---
 test/addons/openssl-providers/providers.cjs   |  7 ++-
 test/benchmark/test-benchmark-crypto.js       |  5 +-
 test/common/README.md                         | 17 ------
 test/common/crypto.js                         | 52 ++++++++++++++++++-
 test/common/index.js                          | 52 -------------------
 test/common/index.mjs                         |  2 -
 test/parallel/test-cli-node-options.js        |  3 +-
 test/parallel/test-crypto-authenticated.js    | 20 ++++---
 .../test-crypto-cipheriv-decipheriv.js        | 10 ++--
 test/parallel/test-crypto-classes.js          |  6 +--
 test/parallel/test-crypto-dh-constructor.js   |  3 +-
 test/parallel/test-crypto-dh-errors.js        |  3 +-
 test/parallel/test-crypto-dh-generate-keys.js |  3 +-
 test/parallel/test-crypto-dh-leak.js          |  3 +-
 test/parallel/test-crypto-dh-odd-key.js       |  8 +--
 test/parallel/test-crypto-dh-stateless.js     |  7 +--
 test/parallel/test-crypto-dh.js               | 17 +++---
 test/parallel/test-crypto-ecb.js              | 13 +++--
 test/parallel/test-crypto-fips.js             |  5 +-
 test/parallel/test-crypto-hash.js             |  7 +--
 test/parallel/test-crypto-hkdf.js             |  5 +-
 test/parallel/test-crypto-hmac.js             |  5 +-
 test/parallel/test-crypto-key-objects.js      | 10 ++--
 ...test-crypto-keygen-async-dsa-key-object.js |  8 +--
 test/parallel/test-crypto-keygen-async-dsa.js |  8 +--
 ...-explicit-elliptic-curve-encrypted-p256.js |  4 +-
 ...nc-explicit-elliptic-curve-encrypted.js.js |  3 +-
 ...ync-named-elliptic-curve-encrypted-p256.js |  3 +-
 ...en-async-named-elliptic-curve-encrypted.js |  3 +-
 test/parallel/test-crypto-keygen-async-rsa.js |  3 +-
 .../parallel/test-crypto-keygen-bit-length.js |  3 +-
 ...rypto-keygen-empty-passphrase-no-prompt.js |  3 +-
 .../test-crypto-keygen-missing-oid.js         |  4 +-
 test/parallel/test-crypto-keygen.js           |  3 +-
 test/parallel/test-crypto-no-algorithm.js     |  4 +-
 test/parallel/test-crypto-oneshot-hash.js     |  3 +-
 test/parallel/test-crypto-padding.js          |  5 +-
 test/parallel/test-crypto-pbkdf2.js           |  3 +-
 .../test-crypto-private-decrypt-gh32240.js    |  4 +-
 ...t-crypto-publicDecrypt-fails-first-time.js |  8 ++-
 test/parallel/test-crypto-rsa-dsa.js          |  7 +--
 test/parallel/test-crypto-secure-heap.js      | 13 +++--
 test/parallel/test-crypto-sign-verify.js      | 13 +++--
 test/parallel/test-crypto-stream.js           |  8 +--
 test/parallel/test-crypto-x509.js             |  5 +-
 test/parallel/test-crypto.js                  |  7 +--
 test/parallel/test-dsa-fips-invalid-key.js    | 10 +++-
 .../test-https-agent-session-eviction.js      |  9 ++--
 .../test-https-client-renegotiation-limit.js  |  8 ++-
 test/parallel/test-https-foafssl.js           | 10 ++--
 ...rocess-env-allowed-flags-are-documented.js |  7 +--
 test/parallel/test-process-versions.js        |  3 +-
 test/parallel/test-tls-alert-handling.js      | 20 ++++---
 test/parallel/test-tls-alert.js               | 15 ++++--
 test/parallel/test-tls-alpn-server-client.js  |  5 +-
 test/parallel/test-tls-cert-ext-encoding.js   |  4 +-
 test/parallel/test-tls-client-auth.js         |  7 ++-
 .../test-tls-client-getephemeralkeyinfo.js    |  3 +-
 test/parallel/test-tls-client-mindhsize.js    |  5 +-
 .../test-tls-client-renegotiation-13.js       |  8 ++-
 .../test-tls-client-renegotiation-limit.js    |  8 ++-
 test/parallel/test-tls-dhe.js                 | 17 ++++--
 test/parallel/test-tls-ecdh-auto.js           | 10 ++--
 test/parallel/test-tls-ecdh-multiple.js       | 14 +++--
 test/parallel/test-tls-ecdh.js                | 10 ++--
 test/parallel/test-tls-empty-sni-context.js   |  4 +-
 test/parallel/test-tls-getprotocol.js         |  6 ++-
 test/parallel/test-tls-junk-server.js         |  7 ++-
 test/parallel/test-tls-key-mismatch.js        |  6 ++-
 test/parallel/test-tls-legacy-pfx.js          |  9 +++-
 test/parallel/test-tls-min-max-version.js     | 16 ++++--
 test/parallel/test-tls-no-sslv3.js            | 10 ++--
 test/parallel/test-tls-ocsp-callback.js       | 15 ++++--
 test/parallel/test-tls-psk-circuit.js         | 10 ++--
 test/parallel/test-tls-psk-server.js          | 11 ++--
 test/parallel/test-tls-securepair-server.js   | 10 ++--
 test/parallel/test-tls-server-verify.js       | 10 ++--
 test/parallel/test-tls-session-cache.js       | 20 ++++---
 test/parallel/test-tls-set-ciphers.js         | 16 ++++--
 test/parallel/test-tls-set-secure-context.js  |  6 ++-
 test/parallel/test-tls-set-sigalgs.js         |  7 ++-
 test/parallel/test-trace-env.js               |  8 +--
 test/parallel/test-x509-escaping.js           |  5 +-
 test/pummel/test-crypto-dh-hash.js            |  4 +-
 test/pummel/test-crypto-dh-keys.js            |  3 +-
 test/pummel/test-dh-regr.js                   |  3 +-
 test/sequential/test-tls-psk-client.js        | 11 ++--
 test/sequential/test-tls-securepair-client.js | 25 +++++----
 test/sequential/test-tls-session-timeout.js   | 10 ++--
 89 files changed, 505 insertions(+), 288 deletions(-)

diff --git a/test/addons/openssl-providers/providers.cjs b/test/addons/openssl-providers/providers.cjs
index 2dabbf020e2a41..efa1019c62d99c 100644
--- a/test/addons/openssl-providers/providers.cjs
+++ b/test/addons/openssl-providers/providers.cjs
@@ -1,11 +1,14 @@
 'use strict';
 
 const common = require('../../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+const { hasOpenSSL3 } = require('../../common/crypto');
 
-if (!common.hasOpenSSL3)
+if (!hasOpenSSL3) {
   common.skip('this test requires OpenSSL 3.x');
+}
 const assert = require('node:assert');
 const { createHash, getCiphers, getHashes } = require('node:crypto');
 const { debuglog } = require('node:util');
diff --git a/test/benchmark/test-benchmark-crypto.js b/test/benchmark/test-benchmark-crypto.js
index 7f6988acf234d8..72d79ece13e787 100644
--- a/test/benchmark/test-benchmark-crypto.js
+++ b/test/benchmark/test-benchmark-crypto.js
@@ -5,8 +5,11 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (common.hasFipsCrypto)
+const { getFips } = require('crypto');
+
+if (getFips()) {
   common.skip('some benchmarks are FIPS-incompatible');
+}
 
 const runBenchmark = require('../common/benchmark');
 
diff --git a/test/common/README.md b/test/common/README.md
index 5f5ff75fca2431..ee36503f920001 100644
--- a/test/common/README.md
+++ b/test/common/README.md
@@ -226,17 +226,6 @@ The TTY file descriptor is assumed to be capable of being writable.
 
 Indicates whether OpenSSL is available.
 
-### `hasFipsCrypto`
-
-* [\<boolean>][<boolean>]
-
-Indicates that Node.js has been linked with a FIPS compatible OpenSSL library,
-and that FIPS as been enabled using `--enable-fips`.
-
-To only detect if the OpenSSL library is FIPS compatible, regardless if it has
-been enabled or not, then `process.config.variables.openssl_is_fips` can be
-used to determine that situation.
-
 ### `hasIntl`
 
 * [\<boolean>][<boolean>]
@@ -417,12 +406,6 @@ Returns `true` if the exit code `exitCode` and/or signal name `signal` represent
 the exit code and/or signal name of a node process that aborted, `false`
 otherwise.
 
-### `opensslCli`
-
-* [\<boolean>][<boolean>]
-
-Indicates whether 'opensslCli' is supported.
-
 ### `platformTimeout(ms)`
 
 * `ms` [\<number>][<number>] | [\<bigint>][<bigint>]
diff --git a/test/common/crypto.js b/test/common/crypto.js
index 10432d7e7a7e32..f50d3895a1783b 100644
--- a/test/common/crypto.js
+++ b/test/common/crypto.js
@@ -1,8 +1,9 @@
 'use strict';
 
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
@@ -98,6 +99,27 @@ const pkcs8EncExp = getRegExpForPEM('ENCRYPTED PRIVATE KEY');
 const sec1Exp = getRegExpForPEM('EC PRIVATE KEY');
 const sec1EncExp = (cipher) => getRegExpForPEM('EC PRIVATE KEY', cipher);
 
+// Synthesize OPENSSL_VERSION_NUMBER format with the layout 0xMNN00PPSL
+const opensslVersionNumber = (major = 0, minor = 0, patch = 0) => {
+  assert(major >= 0 && major <= 0xf);
+  assert(minor >= 0 && minor <= 0xff);
+  assert(patch >= 0 && patch <= 0xff);
+  return (major << 28) | (minor << 20) | (patch << 4);
+};
+
+let OPENSSL_VERSION_NUMBER;
+const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
+  if (!common.hasCrypto) return false;
+  if (OPENSSL_VERSION_NUMBER === undefined) {
+    const regexp = /(?<m>\d+)\.(?<n>\d+)\.(?<p>\d+)/;
+    const { m, n, p } = process.versions.openssl.match(regexp).groups;
+    OPENSSL_VERSION_NUMBER = opensslVersionNumber(m, n, p);
+  }
+  return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
+};
+
+let opensslCli = null;
+
 module.exports = {
   modp2buf,
   assertApproximateSize,
@@ -111,4 +133,32 @@ module.exports = {
   pkcs8EncExp,  // used once
   sec1Exp,
   sec1EncExp,
+  hasOpenSSL,
+  get hasOpenSSL3() {
+    return hasOpenSSL(3);
+  },
+  // opensslCli defined lazily to reduce overhead of spawnSync
+  get opensslCli() {
+    if (opensslCli !== null) return opensslCli;
+
+    if (process.config.variables.node_shared_openssl) {
+      // Use external command
+      opensslCli = 'openssl';
+    } else {
+      const path = require('path');
+      // Use command built from sources included in Node.js repository
+      opensslCli = path.join(path.dirname(process.execPath), 'openssl-cli');
+    }
+
+    if (exports.isWindows) opensslCli += '.exe';
+
+    const { spawnSync } = require('child_process');
+
+    const opensslCmd = spawnSync(opensslCli, ['version']);
+    if (opensslCmd.status !== 0 || opensslCmd.error !== undefined) {
+      // OpenSSL command cannot be executed
+      opensslCli = false;
+    }
+    return opensslCli;
+  },
 };
diff --git a/test/common/index.js b/test/common/index.js
index b5592a66a081c3..d2c39578324600 100644
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -19,7 +19,6 @@
 // OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
 // USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-/* eslint-disable node-core/crypto-check */
 'use strict';
 const process = global.process;  // Some tests tamper with the process global.
 
@@ -57,25 +56,6 @@ const noop = () => {};
 const hasCrypto = Boolean(process.versions.openssl) &&
                   !process.env.NODE_SKIP_CRYPTO;
 
-// Synthesize OPENSSL_VERSION_NUMBER format with the layout 0xMNN00PPSL
-const opensslVersionNumber = (major = 0, minor = 0, patch = 0) => {
-  assert(major >= 0 && major <= 0xf);
-  assert(minor >= 0 && minor <= 0xff);
-  assert(patch >= 0 && patch <= 0xff);
-  return (major << 28) | (minor << 20) | (patch << 4);
-};
-
-let OPENSSL_VERSION_NUMBER;
-const hasOpenSSL = (major = 0, minor = 0, patch = 0) => {
-  if (!hasCrypto) return false;
-  if (OPENSSL_VERSION_NUMBER === undefined) {
-    const regexp = /(?<m>\d+)\.(?<n>\d+)\.(?<p>\d+)/;
-    const { m, n, p } = process.versions.openssl.match(regexp).groups;
-    OPENSSL_VERSION_NUMBER = opensslVersionNumber(m, n, p);
-  }
-  return OPENSSL_VERSION_NUMBER >= opensslVersionNumber(major, minor, patch);
-};
-
 const hasQuic = hasCrypto && !!process.config.variables.openssl_quic;
 
 function parseTestFlags(filename = process.argv[1]) {
@@ -220,7 +200,6 @@ if (process.env.NODE_TEST_WITH_ASYNC_HOOKS) {
   }).enable();
 }
 
-let opensslCli = null;
 let inFreeBSDJail = null;
 let localhostIPv4 = null;
 
@@ -985,7 +964,6 @@ const common = {
   getTTYfd,
   hasIntl,
   hasCrypto,
-  hasOpenSSL,
   hasQuic,
   hasMultiLocalhost,
   invalidArgTypeHelper,
@@ -1027,10 +1005,6 @@ const common = {
     return require('os').totalmem() > 0x70000000; /* 1.75 Gb */
   },
 
-  get hasFipsCrypto() {
-    return hasCrypto && require('crypto').getFips();
-  },
-
   get hasIPv6() {
     const iFaces = require('os').networkInterfaces();
     let re;
@@ -1047,10 +1021,6 @@ const common = {
     });
   },
 
-  get hasOpenSSL3() {
-    return hasOpenSSL(3);
-  },
-
   get inFreeBSDJail() {
     if (inFreeBSDJail !== null) return inFreeBSDJail;
 
@@ -1100,28 +1070,6 @@ const common = {
     return localhostIPv4;
   },
 
-  // opensslCli defined lazily to reduce overhead of spawnSync
-  get opensslCli() {
-    if (opensslCli !== null) return opensslCli;
-
-    if (process.config.variables.node_shared_openssl) {
-      // Use external command
-      opensslCli = 'openssl';
-    } else {
-      // Use command built from sources included in Node.js repository
-      opensslCli = path.join(path.dirname(process.execPath), 'openssl-cli');
-    }
-
-    if (exports.isWindows) opensslCli += '.exe';
-
-    const opensslCmd = spawnSync(opensslCli, ['version']);
-    if (opensslCmd.status !== 0 || opensslCmd.error !== undefined) {
-      // OpenSSL command cannot be executed
-      opensslCli = false;
-    }
-    return opensslCli;
-  },
-
   get PORT() {
     if (+process.env.TEST_PARALLEL) {
       throw new Error('common.PORT cannot be used in a parallelized test');
diff --git a/test/common/index.mjs b/test/common/index.mjs
index b252f2dc4aac5e..23328ac90ea3c9 100644
--- a/test/common/index.mjs
+++ b/test/common/index.mjs
@@ -41,7 +41,6 @@ const {
   mustNotMutateObjectDeep,
   mustSucceed,
   nodeProcessAborted,
-  opensslCli,
   parseTestFlags,
   PIPE,
   platformTimeout,
@@ -97,7 +96,6 @@ export {
   mustNotMutateObjectDeep,
   mustSucceed,
   nodeProcessAborted,
-  opensslCli,
   parseTestFlags,
   PIPE,
   platformTimeout,
diff --git a/test/parallel/test-cli-node-options.js b/test/parallel/test-cli-node-options.js
index 69bf136559c1a8..9e89200e9f6dfd 100644
--- a/test/parallel/test-cli-node-options.js
+++ b/test/parallel/test-cli-node-options.js
@@ -12,6 +12,7 @@ const { Worker } = require('worker_threads');
 
 const fixtures = require('../common/fixtures');
 const tmpdir = require('../common/tmpdir');
+const { hasOpenSSL3 } = require('../common/crypto');
 tmpdir.refresh();
 
 const printA = path.relative(tmpdir.path, fixtures.path('printA.js'));
@@ -64,7 +65,7 @@ if (common.isLinux) {
 if (common.hasCrypto) {
   expectNoWorker('--use-openssl-ca', 'B\n');
   expectNoWorker('--use-bundled-ca', 'B\n');
-  if (!common.hasOpenSSL3)
+  if (!hasOpenSSL3)
     expectNoWorker('--openssl-config=_ossl_cfg', 'B\n');
 }
 
diff --git a/test/parallel/test-crypto-authenticated.js b/test/parallel/test-crypto-authenticated.js
index d191ab7be2de20..181ea732b91281 100644
--- a/test/parallel/test-crypto-authenticated.js
+++ b/test/parallel/test-crypto-authenticated.js
@@ -21,13 +21,17 @@
 // Flags: --no-warnings
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
 const { inspect } = require('util');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
+
+const isFipsEnabled = crypto.getFips();
 
 //
 // Test authenticated encryption modes.
@@ -53,7 +57,7 @@ for (const test of TEST_CASES) {
     continue;
   }
 
-  if (common.hasFipsCrypto && test.iv.length < 24) {
+  if (isFipsEnabled && test.iv.length < 24) {
     common.printSkipMessage('IV len < 12 bytes unsupported in FIPS mode');
     continue;
   }
@@ -95,7 +99,7 @@ for (const test of TEST_CASES) {
   }
 
   {
-    if (isCCM && common.hasFipsCrypto) {
+    if (isCCM && isFipsEnabled) {
       assert.throws(() => {
         crypto.createDecipheriv(test.algo,
                                 Buffer.from(test.key, 'hex'),
@@ -286,7 +290,7 @@ for (const test of TEST_CASES) {
                             });
     }, errMessages.authTagLength);
 
-    if (!common.hasFipsCrypto) {
+    if (!isFipsEnabled) {
       assert.throws(() => {
         crypto.createDecipheriv('aes-256-ccm',
                                 'FxLKsqdmv0E9xrQhp0b1ZgI0K7JFZJM8',
@@ -312,7 +316,7 @@ for (const test of TEST_CASES) {
     });
 
     // CCM decryption and create(De|C)ipher are unsupported in FIPS mode.
-    if (!common.hasFipsCrypto) {
+    if (!isFipsEnabled) {
       assert.throws(() => {
         crypto.createDecipheriv(`aes-256-${mode}`,
                                 'FxLKsqdmv0E9xrQhp0b1ZgI0K7JFZJM8',
@@ -388,7 +392,7 @@ for (const test of TEST_CASES) {
     cipher.setAAD(Buffer.from('0123456789', 'hex'));
   }, /options\.plaintextLength required for CCM mode with AAD/);
 
-  if (!common.hasFipsCrypto) {
+  if (!isFipsEnabled) {
     assert.throws(() => {
       const cipher = crypto.createDecipheriv('aes-256-ccm',
                                              'FxLKsqdmv0E9xrQhp0b1ZgI0K7JFZJM8',
@@ -403,7 +407,7 @@ for (const test of TEST_CASES) {
 
 // Test that final() throws in CCM mode when no authentication tag is provided.
 {
-  if (!common.hasFipsCrypto) {
+  if (!isFipsEnabled) {
     const key = Buffer.from('1ed2233fa2223ef5d7df08546049406c', 'hex');
     const iv = Buffer.from('7305220bca40d4c90e1791e9', 'hex');
     const ct = Buffer.from('8beba09d4d4d861f957d51c0794f4abf8030848e', 'hex');
@@ -562,7 +566,7 @@ for (const test of TEST_CASES) {
   ]) {
     assert.throws(() => {
       cipher.final();
-    }, common.hasOpenSSL3 ? {
+    }, hasOpenSSL3 ? {
       code: 'ERR_OSSL_TAG_NOT_SET'
     } : {
       message: /Unsupported state/
diff --git a/test/parallel/test-crypto-cipheriv-decipheriv.js b/test/parallel/test-crypto-cipheriv-decipheriv.js
index 3e3632203af72c..88d07c3b957f57 100644
--- a/test/parallel/test-crypto-cipheriv-decipheriv.js
+++ b/test/parallel/test-crypto-cipheriv-decipheriv.js
@@ -5,6 +5,8 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
+const isFipsEnabled = crypto.getFips();
 
 function testCipher1(key, iv) {
   // Test encryption and decryption with explicit key and iv
@@ -150,7 +152,7 @@ testCipher1(Buffer.from('0123456789abcd0123456789'), '12345678');
 testCipher1(Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
 testCipher2(Buffer.from('0123456789abcd0123456789'), Buffer.from('12345678'));
 
-if (!common.hasFipsCrypto) {
+if (!isFipsEnabled) {
   testCipher3(Buffer.from('000102030405060708090A0B0C0D0E0F', 'hex'),
               Buffer.from('A6A6A6A6A6A6A6A6', 'hex'));
 }
@@ -193,10 +195,10 @@ assert.throws(
   errMessage);
 
 // But all other IV lengths should be accepted.
-const minIvLength = common.hasOpenSSL3 ? 8 : 1;
-const maxIvLength = common.hasOpenSSL3 ? 64 : 256;
+const minIvLength = hasOpenSSL3 ? 8 : 1;
+const maxIvLength = hasOpenSSL3 ? 64 : 256;
 for (let n = minIvLength; n < maxIvLength; n += 1) {
-  if (common.hasFipsCrypto && n < 12) continue;
+  if (isFipsEnabled && n < 12) continue;
   crypto.createCipheriv('aes-128-gcm', Buffer.alloc(16), Buffer.alloc(n));
 }
 
diff --git a/test/parallel/test-crypto-classes.js b/test/parallel/test-crypto-classes.js
index f736921476a1c5..429bc91d4412be 100644
--- a/test/parallel/test-crypto-classes.js
+++ b/test/parallel/test-crypto-classes.js
@@ -4,9 +4,9 @@ const assert = require('assert');
 
 if (!common.hasCrypto) {
   common.skip('missing crypto');
-  return;
 }
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // 'ClassName' : ['args', 'for', 'constructor']
 const TEST_CASES = {
@@ -21,8 +21,8 @@ const TEST_CASES = {
   'ECDH': ['prime256v1'],
 };
 
-if (!common.hasFipsCrypto) {
-  TEST_CASES.DiffieHellman = [common.hasOpenSSL3 ? 1024 : 256];
+if (!crypto.getFips()) {
+  TEST_CASES.DiffieHellman = [hasOpenSSL3 ? 1024 : 256];
 }
 
 for (const [clazz, args] of Object.entries(TEST_CASES)) {
diff --git a/test/parallel/test-crypto-dh-constructor.js b/test/parallel/test-crypto-dh-constructor.js
index c7eaca29347a2b..eb8674932484ed 100644
--- a/test/parallel/test-crypto-dh-constructor.js
+++ b/test/parallel/test-crypto-dh-constructor.js
@@ -5,8 +5,9 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
-const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
 const dh1 = crypto.createDiffieHellman(size);
 const p1 = dh1.getPrime('buffer');
 
diff --git a/test/parallel/test-crypto-dh-errors.js b/test/parallel/test-crypto-dh-errors.js
index 476ca64b4425b5..0af4db0310750c 100644
--- a/test/parallel/test-crypto-dh-errors.js
+++ b/test/parallel/test-crypto-dh-errors.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // https://github.com/nodejs/node/issues/32738
 // XXX(bnoordhuis) validateInt32() throwing ERR_OUT_OF_RANGE and RangeError
@@ -24,7 +25,7 @@ assert.throws(() => crypto.createDiffieHellman('abcdef', 13.37), {
 });
 
 for (const bits of [-1, 0, 1]) {
-  if (common.hasOpenSSL3) {
+  if (hasOpenSSL3) {
     assert.throws(() => crypto.createDiffieHellman(bits), {
       code: 'ERR_OSSL_DH_MODULUS_TOO_SMALL',
       name: 'Error',
diff --git a/test/parallel/test-crypto-dh-generate-keys.js b/test/parallel/test-crypto-dh-generate-keys.js
index fc277bb0d9b8e4..e4598274328bd8 100644
--- a/test/parallel/test-crypto-dh-generate-keys.js
+++ b/test/parallel/test-crypto-dh-generate-keys.js
@@ -6,9 +6,10 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 {
-  const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
 
   function unlessInvalidState(f) {
     try {
diff --git a/test/parallel/test-crypto-dh-leak.js b/test/parallel/test-crypto-dh-leak.js
index 1998d61d4affd7..3b5051feb43cd8 100644
--- a/test/parallel/test-crypto-dh-leak.js
+++ b/test/parallel/test-crypto-dh-leak.js
@@ -9,10 +9,11 @@ if (common.isASan)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 const before = process.memoryUsage.rss();
 {
-  const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
   const dh = crypto.createDiffieHellman(size);
   const publicKey = dh.generateKeys();
   const privateKey = dh.getPrivateKey();
diff --git a/test/parallel/test-crypto-dh-odd-key.js b/test/parallel/test-crypto-dh-odd-key.js
index 69a1eb56c866b3..fbe42be425ed1c 100644
--- a/test/parallel/test-crypto-dh-odd-key.js
+++ b/test/parallel/test-crypto-dh-odd-key.js
@@ -21,22 +21,24 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 function test() {
   const odd = Buffer.alloc(39, 'A');
 
-  const c = crypto.createDiffieHellman(common.hasOpenSSL3 ? 1024 : 32);
+  const c = crypto.createDiffieHellman(hasOpenSSL3 ? 1024 : 32);
   c.setPrivateKey(odd);
   c.generateKeys();
 }
 
 // FIPS requires a length of at least 1024
-if (!common.hasFipsCrypto) {
+if (!crypto.getFips()) {
   test();
 } else {
   assert.throws(function() { test(); }, /key size too small/);
diff --git a/test/parallel/test-crypto-dh-stateless.js b/test/parallel/test-crypto-dh-stateless.js
index 2ccac322e23958..f4fc1849699e31 100644
--- a/test/parallel/test-crypto-dh-stateless.js
+++ b/test/parallel/test-crypto-dh-stateless.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 assert.throws(() => crypto.diffieHellman(), {
   name: 'TypeError',
@@ -150,7 +151,7 @@ const list = [
 
 // TODO(danbev): Take a closer look if there should be a check in OpenSSL3
 // when the dh parameters differ.
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   // Same primes, but different generator.
   list.push([{ group: 'modp5' }, { prime: group.getPrime(), generator: 5 }]);
   // Same generator, but different primes.
@@ -161,7 +162,7 @@ for (const [params1, params2] of list) {
   assert.throws(() => {
     test(crypto.generateKeyPairSync('dh', params1),
          crypto.generateKeyPairSync('dh', params2));
-  }, common.hasOpenSSL3 ? {
+  }, hasOpenSSL3 ? {
     name: 'Error',
     code: 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
   } : {
@@ -220,7 +221,7 @@ const not256k1 = crypto.getCurves().find((c) => /^sec.*(224|384|512)/.test(c));
 assert.throws(() => {
   test(crypto.generateKeyPairSync('ec', { namedCurve: 'secp256k1' }),
        crypto.generateKeyPairSync('ec', { namedCurve: not256k1 }));
-}, common.hasOpenSSL3 ? {
+}, hasOpenSSL3 ? {
   name: 'Error',
   code: 'ERR_OSSL_MISMATCHING_DOMAIN_PARAMETERS'
 } : {
diff --git a/test/parallel/test-crypto-dh.js b/test/parallel/test-crypto-dh.js
index 9ebe14011eed22..d7ffbe5eca9273 100644
--- a/test/parallel/test-crypto-dh.js
+++ b/test/parallel/test-crypto-dh.js
@@ -1,13 +1,18 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
+const {
+  hasOpenSSL3,
+  hasOpenSSL,
+} = require('../common/crypto');
 
 {
-  const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+  const size = crypto.getFips() || hasOpenSSL3 ? 1024 : 256;
   const dh1 = crypto.createDiffieHellman(size);
   const p1 = dh1.getPrime('buffer');
   const dh2 = crypto.createDiffieHellman(p1, 'buffer');
@@ -53,7 +58,7 @@ const crypto = require('crypto');
   assert.strictEqual(secret1, secret4);
 
   let wrongBlockLength;
-  if (common.hasOpenSSL3) {
+  if (hasOpenSSL3) {
     wrongBlockLength = {
       message: 'error:1C80006B:Provider routines::wrong final block length',
       code: 'ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH',
@@ -87,11 +92,11 @@ const crypto = require('crypto');
 
   {
     // Error message was changed in OpenSSL 3.0.x from 3.0.12, and 3.1.x from 3.1.4.
-    const hasOpenSSL3WithNewErrorMessage = (common.hasOpenSSL(3, 0, 12) && !common.hasOpenSSL(3, 1, 0)) ||
-                                           (common.hasOpenSSL(3, 1, 4));
+    const hasOpenSSL3WithNewErrorMessage = (hasOpenSSL(3, 0, 12) && !hasOpenSSL(3, 1, 0)) ||
+                                           (hasOpenSSL(3, 1, 4));
     assert.throws(() => {
       dh3.computeSecret('');
-    }, { message: common.hasOpenSSL3 && !hasOpenSSL3WithNewErrorMessage ?
+    }, { message: hasOpenSSL3 && !hasOpenSSL3WithNewErrorMessage ?
       'Unspecified validation error' :
       'Supplied key is too small' });
   }
diff --git a/test/parallel/test-crypto-ecb.js b/test/parallel/test-crypto-ecb.js
index aecd858ef3bf1e..6439c9354a059e 100644
--- a/test/parallel/test-crypto-ecb.js
+++ b/test/parallel/test-crypto-ecb.js
@@ -21,18 +21,23 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { hasOpenSSL3 } = require('../common/crypto');
+const crypto = require('crypto');
 
-if (common.hasFipsCrypto)
+if (crypto.getFips()) {
   common.skip('BF-ECB is not FIPS 140-2 compatible');
+}
 
-if (common.hasOpenSSL3)
+if (hasOpenSSL3) {
   common.skip('Blowfish is only available with the legacy provider in ' +
     'OpenSSl 3.x');
+}
 
 const assert = require('assert');
-const crypto = require('crypto');
 
 // Testing whether EVP_CipherInit_ex is functioning correctly.
 // Reference: bug#1997
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index 8a8a8089a3cf3b..de004b9a9e8f23 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -10,6 +10,7 @@ const path = require('path');
 const fixtures = require('../common/fixtures');
 const { internalBinding } = require('internal/test/binding');
 const { testFipsCrypto } = internalBinding('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 const FIPS_ENABLED = 1;
 const FIPS_DISABLED = 0;
@@ -114,7 +115,7 @@ assert.ok(test_result === 1 || test_result === 0);
 // ("Error: Cannot set FIPS mode in a non-FIPS build.").
 // Due to this uncertainty the following tests are skipped when configured
 // with --shared-openssl.
-if (!sharedOpenSSL() && !common.hasOpenSSL3) {
+if (!sharedOpenSSL() && !hasOpenSSL3) {
   // OpenSSL config file should be able to turn on FIPS mode
   testHelper(
     'stdout',
@@ -144,7 +145,7 @@ if (!sharedOpenSSL() && !common.hasOpenSSL3) {
 // will not work as expected with that version.
 // TODO(danbev) Revisit these test once FIPS support is available in
 // OpenSSL 3.x.
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   testHelper(
     'stdout',
     [`--openssl-config=${CNF_FIPS_OFF}`],
diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
index ca8f630b4bb7e7..61145aee0727fb 100644
--- a/test/parallel/test-crypto-hash.js
+++ b/test/parallel/test-crypto-hash.js
@@ -1,13 +1,14 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
 const fs = require('fs');
 
-const { hasOpenSSL } = common;
+const { hasOpenSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 let cryptoType;
@@ -40,7 +41,7 @@ a8.write('');
 a8.end();
 a8 = a8.read();
 
-if (!common.hasFipsCrypto) {
+if (!crypto.getFips()) {
   cryptoType = 'md5';
   digest = 'latin1';
   const a0 = crypto.createHash(cryptoType).update('Test123').digest(digest);
diff --git a/test/parallel/test-crypto-hkdf.js b/test/parallel/test-crypto-hkdf.js
index ff3abdf291efcd..3f7e61e9b2ebc0 100644
--- a/test/parallel/test-crypto-hkdf.js
+++ b/test/parallel/test-crypto-hkdf.js
@@ -13,6 +13,7 @@ const {
   hkdfSync,
   getHashes
 } = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 {
   assert.throws(() => hkdf(), {
@@ -124,7 +125,7 @@ const algorithms = [
   ['sha256', '', 'salt', '', 10],
   ['sha512', 'secret', 'salt', '', 15],
 ];
-if (!common.hasOpenSSL3)
+if (!hasOpenSSL3)
   algorithms.push(['whirlpool', 'secret', '', 'info', 20]);
 
 algorithms.forEach(([ hash, secret, salt, info, length ]) => {
@@ -215,7 +216,7 @@ algorithms.forEach(([ hash, secret, salt, info, length ]) => {
 });
 
 
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   const kKnownUnsupported = ['shake128', 'shake256'];
   getHashes()
     .filter((hash) => !kKnownUnsupported.includes(hash))
diff --git a/test/parallel/test-crypto-hmac.js b/test/parallel/test-crypto-hmac.js
index 62a6ac18d25265..afb5f74cbf076b 100644
--- a/test/parallel/test-crypto-hmac.js
+++ b/test/parallel/test-crypto-hmac.js
@@ -1,7 +1,8 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
@@ -40,7 +41,7 @@ assert.throws(
 
 function testHmac(algo, key, data, expected) {
   // FIPS does not support MD5.
-  if (common.hasFipsCrypto && algo === 'md5')
+  if (crypto.getFips() && algo === 'md5')
     return;
 
   if (!Array.isArray(data))
diff --git a/test/parallel/test-crypto-key-objects.js b/test/parallel/test-crypto-key-objects.js
index f5271f16d346c0..0c516d80950694 100644
--- a/test/parallel/test-crypto-key-objects.js
+++ b/test/parallel/test-crypto-key-objects.js
@@ -24,6 +24,8 @@ const {
   generateKeyPairSync,
 } = require('crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 const fixtures = require('../common/fixtures');
 
 const publicPem = fixtures.readKey('rsa_public.pem', 'ascii');
@@ -297,7 +299,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
   // This should not cause a crash: https://github.com/nodejs/node/issues/25247
   assert.throws(() => {
     createPrivateKey({ key: '' });
-  }, common.hasOpenSSL3 ? {
+  }, hasOpenSSL3 ? {
     message: 'error:1E08010C:DECODER routines::unsupported',
   } : {
     message: 'error:0909006C:PEM routines:get_name:no start line',
@@ -323,7 +325,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
       type: 'pkcs1'
     });
     createPrivateKey({ key, format: 'der', type: 'pkcs1' });
-  }, common.hasOpenSSL3 ? {
+  }, hasOpenSSL3 ? {
     message: /error:1E08010C:DECODER routines::unsupported/,
     library: 'DECODER routines'
   } : {
@@ -510,7 +512,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
 
 {
   // Reading an encrypted key without a passphrase should fail.
-  assert.throws(() => createPrivateKey(privateDsa), common.hasOpenSSL3 ? {
+  assert.throws(() => createPrivateKey(privateDsa), hasOpenSSL3 ? {
     name: 'Error',
     message: 'error:07880109:common libcrypto routines::interrupted or ' +
              'cancelled',
@@ -526,7 +528,7 @@ const privateDsa = fixtures.readKey('dsa_private_encrypted_1025.pem',
     key: privateDsa,
     format: 'pem',
     passphrase: Buffer.alloc(1025, 'a')
-  }), common.hasOpenSSL3 ? { name: 'Error' } : {
+  }), hasOpenSSL3 ? { name: 'Error' } : {
     code: 'ERR_OSSL_PEM_BAD_PASSWORD_READ',
     name: 'Error'
   });
diff --git a/test/parallel/test-crypto-keygen-async-dsa-key-object.js b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
index c15807295541e2..a3df136230d0f8 100644
--- a/test/parallel/test-crypto-keygen-async-dsa-key-object.js
+++ b/test/parallel/test-crypto-keygen-async-dsa-key-object.js
@@ -9,23 +9,25 @@ const {
   generateKeyPair,
 } = require('crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 // Test async DSA key object generation.
 {
   generateKeyPair('dsa', {
-    modulusLength: common.hasOpenSSL3 ? 2048 : 512,
+    modulusLength: hasOpenSSL3 ? 2048 : 512,
     divisorLength: 256
   }, common.mustSucceed((publicKey, privateKey) => {
     assert.strictEqual(publicKey.type, 'public');
     assert.strictEqual(publicKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(publicKey.asymmetricKeyDetails, {
-      modulusLength: common.hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL3 ? 2048 : 512,
       divisorLength: 256
     });
 
     assert.strictEqual(privateKey.type, 'private');
     assert.strictEqual(privateKey.asymmetricKeyType, 'dsa');
     assert.deepStrictEqual(privateKey.asymmetricKeyDetails, {
-      modulusLength: common.hasOpenSSL3 ? 2048 : 512,
+      modulusLength: hasOpenSSL3 ? 2048 : 512,
       divisorLength: 256
     });
   }));
diff --git a/test/parallel/test-crypto-keygen-async-dsa.js b/test/parallel/test-crypto-keygen-async-dsa.js
index 048c0ce6fb92ef..41968d8cc23365 100644
--- a/test/parallel/test-crypto-keygen-async-dsa.js
+++ b/test/parallel/test-crypto-keygen-async-dsa.js
@@ -14,6 +14,8 @@ const {
   spkiExp,
 } = require('../common/crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 // Test async DSA key generation.
 {
   const privateKeyEncoding = {
@@ -22,7 +24,7 @@ const {
   };
 
   generateKeyPair('dsa', {
-    modulusLength: common.hasOpenSSL3 ? 2048 : 512,
+    modulusLength: hasOpenSSL3 ? 2048 : 512,
     divisorLength: 256,
     publicKeyEncoding: {
       type: 'spki',
@@ -39,8 +41,8 @@ const {
     // The private key is DER-encoded.
     assert(Buffer.isBuffer(privateKeyDER));
 
-    assertApproximateSize(publicKey, common.hasOpenSSL3 ? 1194 : 440);
-    assertApproximateSize(privateKeyDER, common.hasOpenSSL3 ? 721 : 336);
+    assertApproximateSize(publicKey, hasOpenSSL3 ? 1194 : 440);
+    assertApproximateSize(privateKeyDER, hasOpenSSL3 ? 721 : 336);
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
index 553674774571d3..55aa3831c4233b 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted-p256.js
@@ -14,6 +14,8 @@ const {
   pkcs8EncExp,
 } = require('../common/crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
 // private key with paramEncoding explicit.
 {
@@ -38,7 +40,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  common.hasOpenSSL3 ? {
+                  hasOpenSSL3 ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
index 79a132eed0b854..8a55d4338bc72f 100644
--- a/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
+++ b/test/parallel/test-crypto-keygen-async-explicit-elliptic-curve-encrypted.js.js
@@ -12,6 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   sec1EncExp,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 {
@@ -38,7 +39,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  common.hasOpenSSL3 ? {
+                  hasOpenSSL3 ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
index 5e7d1a6c9b6611..4c11401d0fc516 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted-p256.js
@@ -12,6 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   pkcs8EncExp,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 // Test async elliptic curve key generation, e.g. for ECDSA, with an encrypted
@@ -38,7 +39,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  common.hasOpenSSL3 ? {
+                  hasOpenSSL3 ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
index 1cc93d0a794931..0503ff74787f37 100644
--- a/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
+++ b/test/parallel/test-crypto-keygen-async-named-elliptic-curve-encrypted.js
@@ -12,6 +12,7 @@ const {
   testSignVerify,
   spkiExp,
   sec1EncExp,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 {
@@ -38,7 +39,7 @@ const {
 
     // Since the private key is encrypted, signing shouldn't work anymore.
     assert.throws(() => testSignVerify(publicKey, privateKey),
-                  common.hasOpenSSL3 ? {
+                  hasOpenSSL3 ? {
                     message: 'error:07880109:common libcrypto ' +
                              'routines::interrupted or cancelled'
                   } : {
diff --git a/test/parallel/test-crypto-keygen-async-rsa.js b/test/parallel/test-crypto-keygen-async-rsa.js
index f4a83809dc73c7..c80d7d33492923 100644
--- a/test/parallel/test-crypto-keygen-async-rsa.js
+++ b/test/parallel/test-crypto-keygen-async-rsa.js
@@ -13,6 +13,7 @@ const {
   testEncryptDecrypt,
   testSignVerify,
   pkcs1EncExp,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 // Test async RSA key generation with an encrypted private key.
@@ -43,7 +44,7 @@ const {
       type: 'pkcs1',
       format: 'der',
     };
-    const expectedError = common.hasOpenSSL3 ? {
+    const expectedError = hasOpenSSL3 ? {
       name: 'Error',
       message: 'error:07880109:common libcrypto routines::interrupted or ' +
                'cancelled'
diff --git a/test/parallel/test-crypto-keygen-bit-length.js b/test/parallel/test-crypto-keygen-bit-length.js
index 08772ba2e496b8..63a80659bb2f53 100644
--- a/test/parallel/test-crypto-keygen-bit-length.js
+++ b/test/parallel/test-crypto-keygen-bit-length.js
@@ -8,6 +8,7 @@ const assert = require('assert');
 const {
   generateKeyPair,
 } = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // This tests check that generateKeyPair returns correct bit length in
 // KeyObject's asymmetricKeyDetails.
@@ -27,7 +28,7 @@ const {
     assert.strictEqual(publicKey.asymmetricKeyDetails.modulusLength, 513);
   }));
 
-  if (common.hasOpenSSL3) {
+  if (hasOpenSSL3) {
     generateKeyPair('dsa', {
       modulusLength: 2049,
       divisorLength: 256,
diff --git a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
index 7679a492c3194c..cb873ff04748b7 100644
--- a/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
+++ b/test/parallel/test-crypto-keygen-empty-passphrase-no-prompt.js
@@ -11,6 +11,7 @@ const {
 } = require('crypto');
 const {
   testSignVerify,
+  hasOpenSSL3,
 } = require('../common/crypto');
 
 // Passing an empty passphrase string should not cause OpenSSL's default
@@ -40,7 +41,7 @@ for (const type of ['pkcs1', 'pkcs8']) {
     // the key, and not specifying a passphrase should fail when decoding it.
     assert.throws(() => {
       return testSignVerify(publicKey, privateKey);
-    }, common.hasOpenSSL3 ? {
+    }, hasOpenSSL3 ? {
       name: 'Error',
       code: 'ERR_OSSL_CRYPTO_INTERRUPTED_OR_CANCELLED',
       message: 'error:07880109:common libcrypto routines::interrupted or cancelled'
diff --git a/test/parallel/test-crypto-keygen-missing-oid.js b/test/parallel/test-crypto-keygen-missing-oid.js
index f7fefe13848d4b..1e4f309292eb47 100644
--- a/test/parallel/test-crypto-keygen-missing-oid.js
+++ b/test/parallel/test-crypto-keygen-missing-oid.js
@@ -11,6 +11,8 @@ const {
   getCurves,
 } = require('crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 // This test creates EC key pairs on curves without associated OIDs.
 // Specifying a key encoding should not crash.
 {
@@ -20,7 +22,7 @@ const {
         continue;
 
       const expectedErrorCode =
-        common.hasOpenSSL3 ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
+        hasOpenSSL3 ? 'ERR_OSSL_MISSING_OID' : 'ERR_OSSL_EC_MISSING_OID';
       const params = {
         namedCurve,
         publicKeyEncoding: {
diff --git a/test/parallel/test-crypto-keygen.js b/test/parallel/test-crypto-keygen.js
index b09ca9e7c531ea..edaee845075668 100644
--- a/test/parallel/test-crypto-keygen.js
+++ b/test/parallel/test-crypto-keygen.js
@@ -14,6 +14,7 @@ const {
 } = require('crypto');
 const { inspect } = require('util');
 
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Test invalid parameter encoding.
 {
@@ -351,7 +352,7 @@ const { inspect } = require('util');
       publicExponent
     }, common.mustCall((err) => {
       assert.strictEqual(err.name, 'Error');
-      assert.match(err.message, common.hasOpenSSL3 ? /exponent/ : /bad e value/);
+      assert.match(err.message, hasOpenSSL3 ? /exponent/ : /bad e value/);
     }));
   }
 }
diff --git a/test/parallel/test-crypto-no-algorithm.js b/test/parallel/test-crypto-no-algorithm.js
index 37db38cf613b65..06124e3d465e41 100644
--- a/test/parallel/test-crypto-no-algorithm.js
+++ b/test/parallel/test-crypto-no-algorithm.js
@@ -4,7 +4,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (!common.hasOpenSSL3)
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3)
   common.skip('this test requires OpenSSL 3.x');
 
 const assert = require('node:assert/strict');
diff --git a/test/parallel/test-crypto-oneshot-hash.js b/test/parallel/test-crypto-oneshot-hash.js
index 69051c43d9e882..861aded5dd3f60 100644
--- a/test/parallel/test-crypto-oneshot-hash.js
+++ b/test/parallel/test-crypto-oneshot-hash.js
@@ -8,6 +8,7 @@ if (!common.hasCrypto)
 const assert = require('assert');
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL } = require('../common/crypto');
 const fs = require('fs');
 
 // Test errors for invalid arguments.
@@ -32,7 +33,7 @@ const input = fs.readFileSync(fixtures.path('utf8_test_text.txt'));
 
 for (const method of methods) {
   // Skip failing tests on OpenSSL 3.4.0
-  if (method.startsWith('shake') && common.hasOpenSSL(3, 4))
+  if (method.startsWith('shake') && hasOpenSSL(3, 4))
     continue;
   for (const outputEncoding of ['buffer', 'hex', 'base64', undefined]) {
     const oldDigest = crypto.createHash(method).update(input).digest(outputEncoding || 'hex');
diff --git a/test/parallel/test-crypto-padding.js b/test/parallel/test-crypto-padding.js
index f1f14b472997e7..48cd1ed4df61aa 100644
--- a/test/parallel/test-crypto-padding.js
+++ b/test/parallel/test-crypto-padding.js
@@ -26,6 +26,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Input data.
 const ODD_LENGTH_PLAIN = 'Hello node world!';
@@ -82,7 +83,7 @@ assert.strictEqual(enc(EVEN_LENGTH_PLAIN, true), EVEN_LENGTH_ENCRYPTED);
 assert.throws(function() {
   // Input must have block length %.
   enc(ODD_LENGTH_PLAIN, false);
-}, common.hasOpenSSL3 ? {
+}, hasOpenSSL3 ? {
   message: 'error:1C80006B:Provider routines::wrong final block length',
   code: 'ERR_OSSL_WRONG_FINAL_BLOCK_LENGTH',
   reason: 'wrong final block length',
@@ -109,7 +110,7 @@ assert.strictEqual(dec(EVEN_LENGTH_ENCRYPTED, false).length, 48);
 assert.throws(function() {
   // Must have at least 1 byte of padding (PKCS):
   assert.strictEqual(dec(EVEN_LENGTH_ENCRYPTED_NOPAD, true), EVEN_LENGTH_PLAIN);
-}, common.hasOpenSSL3 ? {
+}, hasOpenSSL3 ? {
   message: 'error:1C800064:Provider routines::bad decrypt',
   reason: 'bad decrypt',
   code: 'ERR_OSSL_BAD_DECRYPT',
diff --git a/test/parallel/test-crypto-pbkdf2.js b/test/parallel/test-crypto-pbkdf2.js
index 1f8e6a81f300e7..efd8d6eaf0d640 100644
--- a/test/parallel/test-crypto-pbkdf2.js
+++ b/test/parallel/test-crypto-pbkdf2.js
@@ -5,6 +5,7 @@ if (!common.hasCrypto)
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 function runPBKDF2(password, salt, iterations, keylen, hash) {
   const syncResult =
@@ -219,7 +220,7 @@ assert.throws(
   }
 );
 
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   const kNotPBKDF2Supported = ['shake128', 'shake256'];
   crypto.getHashes()
     .filter((hash) => !kNotPBKDF2Supported.includes(hash))
diff --git a/test/parallel/test-crypto-private-decrypt-gh32240.js b/test/parallel/test-crypto-private-decrypt-gh32240.js
index e88227a215ba4f..1ff5b565d6d5f4 100644
--- a/test/parallel/test-crypto-private-decrypt-gh32240.js
+++ b/test/parallel/test-crypto-private-decrypt-gh32240.js
@@ -14,6 +14,8 @@ const {
   privateDecrypt,
 } = require('crypto');
 
+const { hasOpenSSL3 } = require('../common/crypto');
+
 const pair = generateKeyPairSync('rsa', { modulusLength: 512 });
 
 const expected = Buffer.from('shibboleth');
@@ -34,7 +36,7 @@ function decrypt(key) {
 }
 
 decrypt(pkey);
-assert.throws(() => decrypt(pkeyEncrypted), common.hasOpenSSL3 ?
+assert.throws(() => decrypt(pkeyEncrypted), hasOpenSSL3 ?
   { message: 'error:07880109:common libcrypto routines::interrupted or ' +
              'cancelled' } :
   { code: 'ERR_MISSING_PASSPHRASE' });
diff --git a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
index a60b87dbf65229..1d64e08920c63b 100644
--- a/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
+++ b/test/parallel/test-crypto-publicDecrypt-fails-first-time.js
@@ -3,11 +3,15 @@ const common = require('../common');
 
 // Test for https://github.com/nodejs/node/issues/40814
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.hasOpenSSL3)
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3) {
   common.skip('only openssl3'); // https://github.com/nodejs/node/pull/42793#issuecomment-1107491901
+}
 
 const assert = require('assert');
 const crypto = require('crypto');
diff --git a/test/parallel/test-crypto-rsa-dsa.js b/test/parallel/test-crypto-rsa-dsa.js
index 5f4fafdfffbf72..dcd5045daaf58c 100644
--- a/test/parallel/test-crypto-rsa-dsa.js
+++ b/test/parallel/test-crypto-rsa-dsa.js
@@ -9,6 +9,7 @@ const crypto = require('crypto');
 const constants = crypto.constants;
 
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Test certificates
 const certPem = fixtures.readKey('rsa_cert.crt');
@@ -36,11 +37,11 @@ const openssl1DecryptError = {
   library: 'digital envelope routines',
 };
 
-const decryptError = common.hasOpenSSL3 ?
+const decryptError = hasOpenSSL3 ?
   { message: 'error:1C800064:Provider routines::bad decrypt' } :
   openssl1DecryptError;
 
-const decryptPrivateKeyError = common.hasOpenSSL3 ? {
+const decryptPrivateKeyError = hasOpenSSL3 ? {
   message: 'error:1C800064:Provider routines::bad decrypt',
 } : openssl1DecryptError;
 
@@ -146,7 +147,7 @@ function getBufferCopy(buf) {
   // Now with RSA_NO_PADDING. Plaintext needs to match key size.
   // OpenSSL 3.x has a rsa_check_padding that will cause an error if
   // RSA_NO_PADDING is used.
-  if (!common.hasOpenSSL3) {
+  if (!hasOpenSSL3) {
     {
       const plaintext = 'x'.repeat(rsaKeySize / 8);
       encryptedBuffer = crypto.privateEncrypt({
diff --git a/test/parallel/test-crypto-secure-heap.js b/test/parallel/test-crypto-secure-heap.js
index 0e5788f00e4a44..c20b01a91a9840 100644
--- a/test/parallel/test-crypto-secure-heap.js
+++ b/test/parallel/test-crypto-secure-heap.js
@@ -1,21 +1,26 @@
 'use strict';
 
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (common.isWindows)
+if (common.isWindows) {
   common.skip('Not supported on Windows');
+}
 
-if (common.isASan)
+if (common.isASan) {
   common.skip('ASan does not play well with secure heap allocations');
+}
 
 const assert = require('assert');
 const { fork } = require('child_process');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 const {
   secureHeapUsed,
   createDiffieHellman,
+  getFips,
 } = require('crypto');
 
 if (process.argv[2] === 'child') {
@@ -29,7 +34,7 @@ if (process.argv[2] === 'child') {
   assert.strictEqual(a.used, 0);
 
   {
-    const size = common.hasFipsCrypto || common.hasOpenSSL3 ? 1024 : 256;
+    const size = getFips() || hasOpenSSL3 ? 1024 : 256;
     const dh1 = createDiffieHellman(size);
     const p1 = dh1.getPrime('buffer');
     const dh2 = createDiffieHellman(p1, 'buffer');
diff --git a/test/parallel/test-crypto-sign-verify.js b/test/parallel/test-crypto-sign-verify.js
index 8a263ec3350f55..0589d60736e377 100644
--- a/test/parallel/test-crypto-sign-verify.js
+++ b/test/parallel/test-crypto-sign-verify.js
@@ -8,6 +8,10 @@ const fs = require('fs');
 const exec = require('child_process').exec;
 const crypto = require('crypto');
 const fixtures = require('../common/fixtures');
+const {
+  hasOpenSSL3,
+  opensslCli,
+} = require('../common/crypto');
 
 // Test certificates
 const certPem = fixtures.readKey('rsa_cert.crt');
@@ -62,7 +66,7 @@ const keySize = 2048;
         key: keyPem,
         padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
       });
-  }, { message: common.hasOpenSSL3 ?
+  }, { message: hasOpenSSL3 ?
     'error:1C8000A5:Provider routines::illegal or unsupported padding mode' :
     'bye, bye, error stack' });
 
@@ -340,7 +344,7 @@ assert.throws(
         key: keyPem,
         padding: crypto.constants.RSA_PKCS1_OAEP_PADDING
       });
-  }, common.hasOpenSSL3 ? {
+  }, hasOpenSSL3 ? {
     code: 'ERR_OSSL_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE',
     message: /illegal or unsupported padding mode/,
   } : {
@@ -599,8 +603,9 @@ assert.throws(
 // Note: this particular test *must* be the last in this file as it will exit
 // early if no openssl binary is found
 {
-  if (!common.opensslCli)
+  if (!opensslCli) {
     common.skip('node compiled without OpenSSL CLI.');
+  }
 
   const pubfile = fixtures.path('keys', 'rsa_public_2048.pem');
   const privkey = fixtures.readKey('rsa_private_2048.pem');
@@ -622,7 +627,7 @@ assert.throws(
   fs.writeFileSync(msgfile, msg);
 
   exec(...common.escapePOSIXShell`"${
-    common.opensslCli}" dgst -sha256 -verify "${pubfile}" -signature "${
+    opensslCli}" dgst -sha256 -verify "${pubfile}" -signature "${
     sigfile}" -sigopt rsa_padding_mode:pss -sigopt rsa_pss_saltlen:-2 "${msgfile
   }"`, common.mustCall((err, stdout, stderr) => {
     assert(stdout.includes('Verified OK'));
diff --git a/test/parallel/test-crypto-stream.js b/test/parallel/test-crypto-stream.js
index 008ab129f0e019..62be4eaf6edfb0 100644
--- a/test/parallel/test-crypto-stream.js
+++ b/test/parallel/test-crypto-stream.js
@@ -21,14 +21,16 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const stream = require('stream');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
-if (!common.hasFipsCrypto) {
+if (!crypto.getFips()) {
   // Small stream to buffer converter
   class Stream2buffer extends stream.Writable {
     constructor(callback) {
@@ -71,7 +73,7 @@ const cipher = crypto.createCipheriv('aes-128-cbc', key, iv);
 const decipher = crypto.createDecipheriv('aes-128-cbc', badkey, iv);
 
 cipher.pipe(decipher)
-  .on('error', common.expectsError(common.hasOpenSSL3 ? {
+  .on('error', common.expectsError(hasOpenSSL3 ? {
     message: /bad decrypt/,
     library: 'Provider routines',
     reason: 'bad decrypt',
diff --git a/test/parallel/test-crypto-x509.js b/test/parallel/test-crypto-x509.js
index bd906c25b9ee19..f75e1d63470bfb 100644
--- a/test/parallel/test-crypto-x509.js
+++ b/test/parallel/test-crypto-x509.js
@@ -18,6 +18,7 @@ const {
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 const { readFileSync } = require('fs');
 
 const cert = readFileSync(fixtures.path('keys', 'agent1-cert.pem'));
@@ -50,7 +51,7 @@ emailAddress=ry@tinyclouds.org`;
 
 let infoAccessCheck = `OCSP - URI:http://ocsp.nodejs.org/
 CA Issuers - URI:http://ca.nodejs.org/ca.cert`;
-if (!common.hasOpenSSL3)
+if (!hasOpenSSL3)
   infoAccessCheck += '\n';
 
 const der = Buffer.from(
@@ -357,7 +358,7 @@ UcXd/5qu2GhokrKU2cPttU+XAN2Om6a0
 
   const cert = new X509Certificate(certPem);
   assert.throws(() => cert.publicKey, {
-    message: common.hasOpenSSL3 ? /decode error/ : /wrong tag/,
+    message: hasOpenSSL3 ? /decode error/ : /wrong tag/,
     name: 'Error'
   });
 
diff --git a/test/parallel/test-crypto.js b/test/parallel/test-crypto.js
index 4271121881379b..93644e016de447 100644
--- a/test/parallel/test-crypto.js
+++ b/test/parallel/test-crypto.js
@@ -29,6 +29,7 @@ const assert = require('assert');
 const crypto = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Test Certificates
 const certPfx = fixtures.readKey('rsa_cert.pfx');
@@ -208,9 +209,9 @@ assert.throws(() => {
   ].join('\n');
   crypto.createSign('SHA256').update('test').sign(priv);
 }, (err) => {
-  if (!common.hasOpenSSL3)
+  if (!hasOpenSSL3)
     assert.ok(!('opensslErrorStack' in err));
-  assert.throws(() => { throw err; }, common.hasOpenSSL3 ? {
+  assert.throws(() => { throw err; }, hasOpenSSL3 ? {
     name: 'Error',
     message: 'error:02000070:rsa routines::digest too big for rsa key',
     library: 'rsa routines',
@@ -225,7 +226,7 @@ assert.throws(() => {
   return true;
 });
 
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   assert.throws(() => {
     // The correct header inside `rsa_private_pkcs8_bad.pem` should have been
     // -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----
diff --git a/test/parallel/test-dsa-fips-invalid-key.js b/test/parallel/test-dsa-fips-invalid-key.js
index 05cc1d143aca6e..3df51bfbed3517 100644
--- a/test/parallel/test-dsa-fips-invalid-key.js
+++ b/test/parallel/test-dsa-fips-invalid-key.js
@@ -1,12 +1,18 @@
 'use strict';
 const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('no crypto');
+}
+
 const fixtures = require('../common/fixtures');
+const crypto = require('crypto');
 
-if (!common.hasFipsCrypto)
+if (!crypto.getFips()) {
   common.skip('node compiled without FIPS OpenSSL.');
+}
 
 const assert = require('assert');
-const crypto = require('crypto');
 
 const input = 'hello';
 
diff --git a/test/parallel/test-https-agent-session-eviction.js b/test/parallel/test-https-agent-session-eviction.js
index e0986e53c1103b..6f88e81e9ff29d 100644
--- a/test/parallel/test-https-agent-session-eviction.js
+++ b/test/parallel/test-https-agent-session-eviction.js
@@ -2,10 +2,13 @@
 'use strict';
 
 const common = require('../common');
-const { readKey } = require('../common/fixtures');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { readKey } = require('../common/fixtures');
+const { hasOpenSSL } = require('../common/crypto');
 
 const https = require('https');
 const { SSL_OP_NO_TICKET } = require('crypto').constants;
@@ -56,7 +59,7 @@ function faultyServer(port) {
 function second(server, session) {
   const req = https.request({
     port: server.address().port,
-    ciphers: (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
     rejectUnauthorized: false
   }, function(res) {
     res.resume();
diff --git a/test/parallel/test-https-client-renegotiation-limit.js b/test/parallel/test-https-client-renegotiation-limit.js
index 35fcc6bfcc6e43..18a602d738c316 100644
--- a/test/parallel/test-https-client-renegotiation-limit.js
+++ b/test/parallel/test-https-client-renegotiation-limit.js
@@ -21,11 +21,15 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const tls = require('tls');
diff --git a/test/parallel/test-https-foafssl.js b/test/parallel/test-https-foafssl.js
index d6dde97a41da9c..df375e7d22201e 100644
--- a/test/parallel/test-https-foafssl.js
+++ b/test/parallel/test-https-foafssl.js
@@ -21,11 +21,15 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const fixtures = require('../common/fixtures');
@@ -67,7 +71,7 @@ server.listen(0, function() {
                 '-cert', fixtures.path('keys/rsa_cert_foafssl_b.crt'),
                 '-key', fixtures.path('keys/rsa_private_b.pem')];
 
-  const client = spawn(common.opensslCli, args);
+  const client = spawn(opensslCli, args);
 
   client.stdout.on('data', function(data) {
     console.log('response received');
diff --git a/test/parallel/test-process-env-allowed-flags-are-documented.js b/test/parallel/test-process-env-allowed-flags-are-documented.js
index 2a40a821314ff3..070a88bca8c12c 100644
--- a/test/parallel/test-process-env-allowed-flags-are-documented.js
+++ b/test/parallel/test-process-env-allowed-flags-are-documented.js
@@ -5,6 +5,7 @@ const common = require('../common');
 const assert = require('assert');
 const fs = require('fs');
 const path = require('path');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 const rootDir = path.resolve(__dirname, '..', '..');
 const cliMd = path.join(rootDir, 'doc', 'api', 'cli.md');
@@ -43,7 +44,7 @@ for (const line of [...nodeOptionsLines, ...v8OptionsLines]) {
   }
 }
 
-if (!common.hasOpenSSL3) {
+if (!hasOpenSSL3) {
   documented.delete('--openssl-legacy-provider');
   documented.delete('--openssl-shared-config');
 }
@@ -55,8 +56,8 @@ const conditionalOpts = [
     filter: (opt) => {
       return [
         '--openssl-config',
-        common.hasOpenSSL3 ? '--openssl-legacy-provider' : '',
-        common.hasOpenSSL3 ? '--openssl-shared-config' : '',
+        hasOpenSSL3 ? '--openssl-legacy-provider' : '',
+        hasOpenSSL3 ? '--openssl-shared-config' : '',
         '--tls-cipher-list',
         '--use-bundled-ca',
         '--use-openssl-ca',
diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js
index 3b8af4b5b52526..0a2a4014f18d6b 100644
--- a/test/parallel/test-process-versions.js
+++ b/test/parallel/test-process-versions.js
@@ -85,11 +85,12 @@ assert.match(process.versions.modules, /^\d+$/);
 assert.match(process.versions.cjs_module_lexer, commonTemplate);
 
 if (common.hasCrypto) {
+  const { hasOpenSSL3 } = require('../common/crypto');
   assert.match(process.versions.ncrypto, commonTemplate);
   if (process.config.variables.node_shared_openssl) {
     assert.ok(process.versions.openssl);
   } else {
-    const versionRegex = common.hasOpenSSL3 ?
+    const versionRegex = hasOpenSSL3 ?
       // The following also matches a development version of OpenSSL 3.x which
       // can be in the format '3.0.0-alpha4-dev'. This can be handy when
       // building and linking against the main development branch of OpenSSL.
diff --git a/test/parallel/test-tls-alert-handling.js b/test/parallel/test-tls-alert-handling.js
index b14438bc92d7e6..eec072796063dc 100644
--- a/test/parallel/test-tls-alert-handling.js
+++ b/test/parallel/test-tls-alert-handling.js
@@ -1,11 +1,19 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const {
+  hasOpenSSL,
+  hasOpenSSL3,
+  opensslCli,
+} = require('../common/crypto');
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI');
+}
 
 const assert = require('assert');
 const net = require('net');
@@ -33,14 +41,14 @@ let iter = 0;
 const errorHandler = common.mustCall((err) => {
   let expectedErrorCode = 'ERR_SSL_WRONG_VERSION_NUMBER';
   let expectedErrorReason = 'wrong version number';
-  if (common.hasOpenSSL(3, 2)) {
+  if (hasOpenSSL(3, 2)) {
     expectedErrorCode = 'ERR_SSL_PACKET_LENGTH_TOO_LONG';
     expectedErrorReason = 'packet length too long';
   };
 
   assert.strictEqual(err.code, expectedErrorCode);
   assert.strictEqual(err.library, 'SSL routines');
-  if (!common.hasOpenSSL3) assert.strictEqual(err.function, 'ssl3_get_record');
+  if (!hasOpenSSL3) assert.strictEqual(err.function, 'ssl3_get_record');
   assert.strictEqual(err.reason, expectedErrorReason);
   errorReceived = true;
   if (canCloseServer())
@@ -96,13 +104,13 @@ function sendBADTLSRecord() {
   client.on('error', common.mustCall((err) => {
     let expectedErrorCode = 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION';
     let expectedErrorReason = 'tlsv1 alert protocol version';
-    if (common.hasOpenSSL(3, 2)) {
+    if (hasOpenSSL(3, 2)) {
       expectedErrorCode = 'ERR_SSL_TLSV1_ALERT_RECORD_OVERFLOW';
       expectedErrorReason = 'tlsv1 alert record overflow';
     }
     assert.strictEqual(err.code, expectedErrorCode);
     assert.strictEqual(err.library, 'SSL routines');
-    if (!common.hasOpenSSL3)
+    if (!hasOpenSSL3)
       assert.strictEqual(err.function, 'ssl3_read_bytes');
     assert.strictEqual(err.reason, expectedErrorReason);
   }));
diff --git a/test/parallel/test-tls-alert.js b/test/parallel/test-tls-alert.js
index e6aaaedfe59d72..23c92e7293458f 100644
--- a/test/parallel/test-tls-alert.js
+++ b/test/parallel/test-tls-alert.js
@@ -21,11 +21,18 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const {
+  hasOpenSSL,
+  opensslCli,
+} = require('../common/crypto');
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const { execFile } = require('child_process');
@@ -42,10 +49,10 @@ const server = tls.Server({
   cert: loadPEM('agent2-cert')
 }, null).listen(0, common.mustCall(() => {
   const args = ['s_client', '-quiet', '-tls1_1',
-                '-cipher', (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+                '-cipher', (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
                 '-connect', `127.0.0.1:${server.address().port}`];
 
-  execFile(common.opensslCli, args, common.mustCall((err, _, stderr) => {
+  execFile(opensslCli, args, common.mustCall((err, _, stderr) => {
     assert.strictEqual(err.code, 1);
     assert.match(stderr, /SSL alert number 70/);
     server.close();
diff --git a/test/parallel/test-tls-alpn-server-client.js b/test/parallel/test-tls-alpn-server-client.js
index 8f1a4b8e439aab..b7cd2806471e67 100644
--- a/test/parallel/test-tls-alpn-server-client.js
+++ b/test/parallel/test-tls-alpn-server-client.js
@@ -1,8 +1,9 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const { spawn } = require('child_process');
@@ -198,7 +199,7 @@ function TestFatalAlert() {
 
       // OpenSSL's s_client should output the TLS alert number, which is 120
       // for the 'no_application_protocol' alert.
-      const { opensslCli } = common;
+      const { opensslCli } = require('../common/crypto');
       if (opensslCli) {
         const addr = `${serverIP}:${port}`;
         let stderr = '';
diff --git a/test/parallel/test-tls-cert-ext-encoding.js b/test/parallel/test-tls-cert-ext-encoding.js
index 4556b5791851c5..154e0cdcf02294 100644
--- a/test/parallel/test-tls-cert-ext-encoding.js
+++ b/test/parallel/test-tls-cert-ext-encoding.js
@@ -3,7 +3,9 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
-if (common.hasOpenSSL3)
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (hasOpenSSL3)
   // TODO(danbev) This test fails with the following error:
   // error:0D00008F:asn1 encoding routines::no matching choice type
   //
diff --git a/test/parallel/test-tls-client-auth.js b/test/parallel/test-tls-client-auth.js
index de4c8f038ec073..b347c0a88df571 100644
--- a/test/parallel/test-tls-client-auth.js
+++ b/test/parallel/test-tls-client-auth.js
@@ -3,6 +3,11 @@
 const common = require('../common');
 const fixtures = require('../common/fixtures');
 
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+const { hasOpenSSL } = require('../common/crypto');
+
 const {
   assert, connect, keys, tls
 } = require(fixtures.path('tls-connect'));
@@ -79,7 +84,7 @@ connect({
 }, function(err, pair, cleanup) {
   assert.strictEqual(pair.server.err.code,
                      'ERR_SSL_PEER_DID_NOT_RETURN_A_CERTIFICATE');
-  const expectedErr = common.hasOpenSSL(3, 2) ?
+  const expectedErr = hasOpenSSL(3, 2) ?
     'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
   assert.strictEqual(pair.client.err.code,
                      expectedErr);
diff --git a/test/parallel/test-tls-client-getephemeralkeyinfo.js b/test/parallel/test-tls-client-getephemeralkeyinfo.js
index 0bacd8702fc650..0f132c565e4400 100644
--- a/test/parallel/test-tls-client-getephemeralkeyinfo.js
+++ b/test/parallel/test-tls-client-getephemeralkeyinfo.js
@@ -3,6 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
@@ -69,7 +70,7 @@ function test(size, type, name, cipher) {
 
 test(undefined, undefined, undefined, 'AES256-SHA256');
 test('auto', 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
-if (!common.hasOpenSSL(3, 2)) {
+if (!hasOpenSSL(3, 2)) {
   test(1024, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
 } else {
   test(3072, 'DH', undefined, 'DHE-RSA-AES256-GCM-SHA384');
diff --git a/test/parallel/test-tls-client-mindhsize.js b/test/parallel/test-tls-client-mindhsize.js
index 15c086842e1e4a..1ab5b5fe1bffd7 100644
--- a/test/parallel/test-tls-client-mindhsize.js
+++ b/test/parallel/test-tls-client-mindhsize.js
@@ -3,6 +3,7 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
@@ -38,7 +39,7 @@ function test(size, err, next) {
     // Client set minimum DH parameter size to 2048 or 3072 bits
     // so that it fails when it makes a connection to the tls
     // server where is too small
-    const minDHSize = common.hasOpenSSL(3, 2) ? 3072 : 2048;
+    const minDHSize = hasOpenSSL(3, 2) ? 3072 : 2048;
     const client = tls.connect({
       minDHSize: minDHSize,
       port: this.address().port,
@@ -76,7 +77,7 @@ function testDHE3072() {
   test(3072, false, null);
 }
 
-if (common.hasOpenSSL(3, 2)) {
+if (hasOpenSSL(3, 2)) {
   // Minimum size for OpenSSL 3.2 is 2048 by default
   testDHE2048(true, testDHE3072);
 } else {
diff --git a/test/parallel/test-tls-client-renegotiation-13.js b/test/parallel/test-tls-client-renegotiation-13.js
index a32baed0249a0a..38a72fb525b430 100644
--- a/test/parallel/test-tls-client-renegotiation-13.js
+++ b/test/parallel/test-tls-client-renegotiation-13.js
@@ -1,6 +1,12 @@
 'use strict';
 
 const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+const { hasOpenSSL3 } = require('../common/crypto');
+
 const fixtures = require('../common/fixtures');
 
 // Confirm that for TLSv1.3, renegotiate() is disallowed.
@@ -29,7 +35,7 @@ connect({
 
   const ok = client.renegotiate({}, common.mustCall((err) => {
     assert.throws(() => { throw err; }, {
-      message: common.hasOpenSSL3 ?
+      message: hasOpenSSL3 ?
         'error:0A00010A:SSL routines::wrong ssl version' :
         'error:1420410A:SSL routines:SSL_renegotiate:wrong ssl version',
       code: 'ERR_SSL_WRONG_SSL_VERSION',
diff --git a/test/parallel/test-tls-client-renegotiation-limit.js b/test/parallel/test-tls-client-renegotiation-limit.js
index 71d7a85bae468b..b35140e8964ac1 100644
--- a/test/parallel/test-tls-client-renegotiation-limit.js
+++ b/test/parallel/test-tls-client-renegotiation-limit.js
@@ -21,11 +21,15 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const tls = require('tls');
diff --git a/test/parallel/test-tls-dhe.js b/test/parallel/test-tls-dhe.js
index 21739ce42428eb..25b58191e1d413 100644
--- a/test/parallel/test-tls-dhe.js
+++ b/test/parallel/test-tls-dhe.js
@@ -22,11 +22,18 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const {
+  hasOpenSSL,
+  opensslCli,
+} = require('../common/crypto');
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
@@ -43,7 +50,7 @@ const dheCipher = 'DHE-RSA-AES128-SHA256';
 const ecdheCipher = 'ECDHE-RSA-AES128-SHA256';
 const ciphers = `${dheCipher}:${ecdheCipher}`;
 
-if (!common.hasOpenSSL(3, 2)) {
+if (!hasOpenSSL(3, 2)) {
   // Test will emit a warning because the DH parameter size is < 2048 bits
   // when the test is run on versions lower than OpenSSL32
   common.expectWarning('SecurityWarning',
@@ -70,7 +77,7 @@ function test(dhparam, keylen, expectedCipher) {
     const args = ['s_client', '-connect', `127.0.0.1:${server.address().port}`,
                   '-cipher', `${ciphers}:@SECLEVEL=1`];
 
-    execFile(common.opensslCli, args, common.mustSucceed((stdout) => {
+    execFile(opensslCli, args, common.mustSucceed((stdout) => {
       assert(keylen === null ||
              stdout.includes(`Server Temp Key: DH, ${keylen} bits`));
       assert(stdout.includes(`Cipher    : ${expectedCipher}`));
@@ -107,7 +114,7 @@ function testCustomParam(keylen, expectedCipher) {
   }, /DH parameter is less than 1024 bits/);
 
   // Custom DHE parameters are supported (but discouraged).
-  if (!common.hasOpenSSL(3, 2)) {
+  if (!hasOpenSSL(3, 2)) {
     await testCustomParam(1024, dheCipher);
   } else {
     await testCustomParam(3072, dheCipher);
diff --git a/test/parallel/test-tls-ecdh-auto.js b/test/parallel/test-tls-ecdh-auto.js
index 11c588d8ac8ce1..adc7817b729aa8 100644
--- a/test/parallel/test-tls-ecdh-auto.js
+++ b/test/parallel/test-tls-ecdh-auto.js
@@ -4,11 +4,15 @@ const common = require('../common');
 // This test ensures that the value "auto" on ecdhCurve option is
 // supported to enable automatic curve selection in TLS server.
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -36,7 +40,7 @@ const server = tls.createServer(options, (conn) => {
                 '-cipher', `${options.ciphers}`,
                 '-connect', `127.0.0.1:${server.address().port}`];
 
-  execFile(common.opensslCli, args, common.mustSucceed((stdout) => {
+  execFile(opensslCli, args, common.mustSucceed((stdout) => {
     assert(stdout.includes(reply));
     server.close();
   }));
diff --git a/test/parallel/test-tls-ecdh-multiple.js b/test/parallel/test-tls-ecdh-multiple.js
index 5bf119f48bacad..957f8e0407a6de 100644
--- a/test/parallel/test-tls-ecdh-multiple.js
+++ b/test/parallel/test-tls-ecdh-multiple.js
@@ -4,11 +4,16 @@ const common = require('../common');
 // This test ensures that ecdhCurve option of TLS server supports colon
 // separated ECDH curve names as value.
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
+const crypto = require('crypto');
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -36,7 +41,7 @@ const server = tls.createServer(options, (conn) => {
                 '-cipher', `${options.ciphers}`,
                 '-connect', `127.0.0.1:${server.address().port}`];
 
-  execFile(common.opensslCli, args, common.mustSucceed((stdout) => {
+  execFile(opensslCli, args, common.mustSucceed((stdout) => {
     assert(stdout.includes(reply));
     server.close();
   }));
@@ -51,8 +56,9 @@ const server = tls.createServer(options, (conn) => {
   ];
 
   // Brainpool is not supported in FIPS mode.
-  if (common.hasFipsCrypto)
+  if (crypto.getFips()) {
     unsupportedCurves.push('brainpoolP256r1');
+  }
 
   unsupportedCurves.forEach((ecdhCurve) => {
     assert.throws(() => tls.createServer({ ecdhCurve }),
diff --git a/test/parallel/test-tls-ecdh.js b/test/parallel/test-tls-ecdh.js
index 276b713f5ecf70..4d45e7f024586e 100644
--- a/test/parallel/test-tls-ecdh.js
+++ b/test/parallel/test-tls-ecdh.js
@@ -23,11 +23,15 @@
 const common = require('../common');
 const fixtures = require('../common/fixtures');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (!common.opensslCli)
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -49,7 +53,7 @@ const server = tls.createServer(options, common.mustCall(function(conn) {
 }));
 
 server.listen(0, '127.0.0.1', common.mustCall(function() {
-  const cmd = common.escapePOSIXShell`"${common.opensslCli}" s_client -cipher ${
+  const cmd = common.escapePOSIXShell`"${opensslCli}" s_client -cipher ${
     options.ciphers} -connect 127.0.0.1:${this.address().port}`;
 
   exec(...cmd, common.mustSucceed((stdout, stderr) => {
diff --git a/test/parallel/test-tls-empty-sni-context.js b/test/parallel/test-tls-empty-sni-context.js
index 093e5cca712d2c..79f1ddd341d938 100644
--- a/test/parallel/test-tls-empty-sni-context.js
+++ b/test/parallel/test-tls-empty-sni-context.js
@@ -3,7 +3,7 @@
 const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
-
+const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
@@ -26,7 +26,7 @@ const server = tls.createServer(options, (c) => {
   }, common.mustNotCall());
 
   c.on('error', common.mustCall((err) => {
-    const expectedErr = common.hasOpenSSL(3, 2) ?
+    const expectedErr = hasOpenSSL(3, 2) ?
       'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
     assert.strictEqual(err.code, expectedErr);
   }));
diff --git a/test/parallel/test-tls-getprotocol.js b/test/parallel/test-tls-getprotocol.js
index a9c8775e2f112f..b1eab88fd6517e 100644
--- a/test/parallel/test-tls-getprotocol.js
+++ b/test/parallel/test-tls-getprotocol.js
@@ -3,6 +3,8 @@ const common = require('../common');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasOpenSSL } = require('../common/crypto');
+
 // This test ensures that `getProtocol` returns the right protocol
 // from a TLS connection
 
@@ -14,11 +16,11 @@ const clientConfigs = [
   {
     secureProtocol: 'TLSv1_method',
     version: 'TLSv1',
-    ciphers: (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
+    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
   }, {
     secureProtocol: 'TLSv1_1_method',
     version: 'TLSv1.1',
-    ciphers: (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
+    ciphers: (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT')
   }, {
     secureProtocol: 'TLSv1_2_method',
     version: 'TLSv1.2'
diff --git a/test/parallel/test-tls-junk-server.js b/test/parallel/test-tls-junk-server.js
index cc520383ede45f..0e536a66884e94 100644
--- a/test/parallel/test-tls-junk-server.js
+++ b/test/parallel/test-tls-junk-server.js
@@ -1,8 +1,11 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { hasOpenSSL } = require('../common/crypto');
 
 const assert = require('assert');
 const https = require('https');
@@ -21,7 +24,7 @@ server.listen(0, function() {
   req.end();
 
   let expectedErrorMessage = new RegExp('wrong version number');
-  if (common.hasOpenSSL(3, 2)) {
+  if (hasOpenSSL(3, 2)) {
     expectedErrorMessage = new RegExp('packet length too long');
   };
   req.once('error', common.mustCall(function(err) {
diff --git a/test/parallel/test-tls-key-mismatch.js b/test/parallel/test-tls-key-mismatch.js
index fdbb3676267a9d..df8848a03de4a9 100644
--- a/test/parallel/test-tls-key-mismatch.js
+++ b/test/parallel/test-tls-key-mismatch.js
@@ -22,14 +22,16 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const fixtures = require('../common/fixtures');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 const assert = require('assert');
 const tls = require('tls');
-const errorMessageRegex = common.hasOpenSSL3 ?
+const errorMessageRegex = hasOpenSSL3 ?
   /^Error: error:05800074:x509 certificate routines::key values mismatch$/ :
   /^Error: error:0B080074:x509 certificate routines:X509_check_private_key:key values mismatch$/;
 
diff --git a/test/parallel/test-tls-legacy-pfx.js b/test/parallel/test-tls-legacy-pfx.js
index 33b4c58fc6ccc3..5106217718dbdc 100644
--- a/test/parallel/test-tls-legacy-pfx.js
+++ b/test/parallel/test-tls-legacy-pfx.js
@@ -1,9 +1,14 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
-if (!common.hasOpenSSL3)
+}
+
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3) {
   common.skip('OpenSSL legacy failures are only testable with OpenSSL 3+');
+}
 
 const fixtures = require('../common/fixtures');
 
diff --git a/test/parallel/test-tls-min-max-version.js b/test/parallel/test-tls-min-max-version.js
index af32468eea6a68..4903d92f5c5700 100644
--- a/test/parallel/test-tls-min-max-version.js
+++ b/test/parallel/test-tls-min-max-version.js
@@ -1,5 +1,13 @@
 'use strict';
 const common = require('../common');
+
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+const {
+  hasOpenSSL,
+  hasOpenSSL3,
+} = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const { inspect } = require('util');
 
@@ -16,13 +24,13 @@ function test(cmin, cmax, cprot, smin, smax, sprot, proto, cerr, serr) {
   assert(proto || cerr || serr, 'test missing any expectations');
 
   let ciphers;
-  if (common.hasOpenSSL3 && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
+  if (hasOpenSSL3 && (proto === 'TLSv1' || proto === 'TLSv1.1' ||
       proto === 'TLSv1_1_method' || proto === 'TLSv1_method' ||
       sprot === 'TLSv1_1_method' || sprot === 'TLSv1_method')) {
     if (serr !== 'ERR_SSL_UNSUPPORTED_PROTOCOL')
       ciphers = 'ALL@SECLEVEL=0';
   }
-  if (common.hasOpenSSL(3, 1) && cerr === 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION') {
+  if (hasOpenSSL(3, 1) && cerr === 'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION') {
     ciphers = 'DEFAULT@SECLEVEL=0';
   }
   // Report where test was called from. Strip leading garbage from
@@ -125,9 +133,9 @@ test(U, U, 'TLS_method', U, U, 'TLSv1_method', 'TLSv1');
 
 // OpenSSL 1.1.1 and 3.0 use a different error code and alert (sent to the
 // client) when no protocols are enabled on the server.
-const NO_PROTOCOLS_AVAILABLE_SERVER = common.hasOpenSSL3 ?
+const NO_PROTOCOLS_AVAILABLE_SERVER = hasOpenSSL3 ?
   'ERR_SSL_NO_PROTOCOLS_AVAILABLE' : 'ERR_SSL_INTERNAL_ERROR';
-const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = common.hasOpenSSL3 ?
+const NO_PROTOCOLS_AVAILABLE_SERVER_ALERT = hasOpenSSL3 ?
   'ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION' : 'ERR_SSL_TLSV1_ALERT_INTERNAL_ERROR';
 
 // SSLv23 also means "any supported protocol" greater than the default
diff --git a/test/parallel/test-tls-no-sslv3.js b/test/parallel/test-tls-no-sslv3.js
index 9282beb4bdac2c..cd5f4ad944a6c5 100644
--- a/test/parallel/test-tls-no-sslv3.js
+++ b/test/parallel/test-tls-no-sslv3.js
@@ -1,10 +1,14 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
-if (common.opensslCli === false)
+const { opensslCli } = require('../common/crypto');
+
+if (opensslCli === false) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -23,7 +27,7 @@ server.listen(0, '127.0.0.1', function() {
                 '-ssl3',
                 '-connect', address];
 
-  const client = spawn(common.opensslCli, args, { stdio: 'pipe' });
+  const client = spawn(opensslCli, args, { stdio: 'pipe' });
   client.stdout.pipe(process.stdout);
   client.stderr.pipe(process.stderr);
   client.stderr.setEncoding('utf8');
diff --git a/test/parallel/test-tls-ocsp-callback.js b/test/parallel/test-tls-ocsp-callback.js
index 04a60a0890c506..bdf622d4686ec1 100644
--- a/test/parallel/test-tls-ocsp-callback.js
+++ b/test/parallel/test-tls-ocsp-callback.js
@@ -22,12 +22,17 @@
 'use strict';
 const common = require('../common');
 
-if (!common.opensslCli)
-  common.skip('node compiled without OpenSSL CLI.');
-
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
+  common.skip('node compiled without OpenSSL CLI.');
+}
 
+const crypto = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
 
@@ -108,6 +113,6 @@ test({ ocsp: true, response: false });
 test({ ocsp: true, response: 'hello world' });
 test({ ocsp: false });
 
-if (!common.hasFipsCrypto) {
+if (!crypto.getFips()) {
   test({ ocsp: true, response: 'hello pfx', pfx: pfx, passphrase: 'sample' });
 }
diff --git a/test/parallel/test-tls-psk-circuit.js b/test/parallel/test-tls-psk-circuit.js
index c06e61c321ef67..61861ecf4dafa6 100644
--- a/test/parallel/test-tls-psk-circuit.js
+++ b/test/parallel/test-tls-psk-circuit.js
@@ -1,9 +1,11 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
+const { hasOpenSSL } = require('../common/crypto');
 const assert = require('assert');
 const tls = require('tls');
 
@@ -62,12 +64,12 @@ test({ psk: USERS.UserA, identity: 'UserA' }, { minVersion: 'TLSv1.3' });
 test({ psk: USERS.UserB, identity: 'UserB' });
 test({ psk: USERS.UserB, identity: 'UserB' }, { minVersion: 'TLSv1.3' });
 // Unrecognized user should fail handshake
-const expectedHandshakeErr = common.hasOpenSSL(3, 2) ?
+const expectedHandshakeErr = hasOpenSSL(3, 2) ?
   'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
 test({ psk: USERS.UserB, identity: 'UserC' }, {}, expectedHandshakeErr);
 // Recognized user but incorrect secret should fail handshake
-const expectedIllegalParameterErr = common.hasOpenSSL(3, 4) ? 'ERR_SSL_TLSV1_ALERT_DECRYPT_ERROR' :
-  common.hasOpenSSL(3, 2) ?
+const expectedIllegalParameterErr = hasOpenSSL(3, 4) ? 'ERR_SSL_TLSV1_ALERT_DECRYPT_ERROR' :
+  hasOpenSSL(3, 2) ?
     'ERR_SSL_SSL/TLS_ALERT_ILLEGAL_PARAMETER' : 'ERR_SSL_SSLV3_ALERT_ILLEGAL_PARAMETER';
 test({ psk: USERS.UserA, identity: 'UserB' }, {}, expectedIllegalParameterErr);
 test({ psk: USERS.UserB, identity: 'UserB' });
diff --git a/test/parallel/test-tls-psk-server.js b/test/parallel/test-tls-psk-server.js
index b9260958401522..87fad86083e1ab 100644
--- a/test/parallel/test-tls-psk-server.js
+++ b/test/parallel/test-tls-psk-server.js
@@ -1,10 +1,15 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
-if (!common.opensslCli)
+}
+
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl cli');
+}
 
 const assert = require('assert');
 
@@ -41,7 +46,7 @@ let sentWorld = false;
 let gotWorld = false;
 
 server.listen(0, () => {
-  const client = spawn(common.opensslCli, [
+  const client = spawn(opensslCli, [
     's_client',
     '-connect', `127.0.0.1:${server.address().port}`,
     '-cipher', CIPHERS,
diff --git a/test/parallel/test-tls-securepair-server.js b/test/parallel/test-tls-securepair-server.js
index 78cd9f725401ed..fb4ebe6a2511cf 100644
--- a/test/parallel/test-tls-securepair-server.js
+++ b/test/parallel/test-tls-securepair-server.js
@@ -21,11 +21,15 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('missing openssl-cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -109,7 +113,7 @@ server.listen(0, common.mustCall(function() {
 
   const args = ['s_client', '-connect', `127.0.0.1:${this.address().port}`];
 
-  const client = spawn(common.opensslCli, args);
+  const client = spawn(opensslCli, args);
 
 
   let out = '';
diff --git a/test/parallel/test-tls-server-verify.js b/test/parallel/test-tls-server-verify.js
index 51ccd0d747fdf5..2517c7c8dbbb1f 100644
--- a/test/parallel/test-tls-server-verify.js
+++ b/test/parallel/test-tls-server-verify.js
@@ -22,11 +22,15 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 // This is a rather complex test which sets up various TLS servers with node
 // and connects to them using the 'openssl s_client' command line utility
@@ -188,7 +192,7 @@ function runClient(prefix, port, options, cb) {
   }
 
   // To test use: openssl s_client -connect localhost:8000
-  const client = spawn(common.opensslCli, args);
+  const client = spawn(opensslCli, args);
 
   let out = '';
 
diff --git a/test/parallel/test-tls-session-cache.js b/test/parallel/test-tls-session-cache.js
index b55e150401d8a2..9524764aa609ee 100644
--- a/test/parallel/test-tls-session-cache.js
+++ b/test/parallel/test-tls-session-cache.js
@@ -21,17 +21,23 @@
 
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+const {
+  hasOpenSSL,
+  opensslCli,
+} = require('../common/crypto');
+
+if (!opensslCli) {
+  common.skip('node compiled without OpenSSL CLI.');
+}
+
 const fixtures = require('../common/fixtures');
 const assert = require('assert');
 const tls = require('tls');
 const { spawn } = require('child_process');
 
-if (!common.opensslCli)
-  common.skip('node compiled without OpenSSL CLI.');
-
-
 doTest({ tickets: false }, function() {
   doTest({ tickets: true }, function() {
     doTest({ tickets: false, invalidSession: true }, function() {
@@ -100,7 +106,7 @@ function doTest(testOptions, callback) {
     const args = [
       's_client',
       '-tls1',
-      '-cipher', (common.hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
+      '-cipher', (hasOpenSSL(3, 1) ? 'DEFAULT:@SECLEVEL=0' : 'DEFAULT'),
       '-connect', `localhost:${this.address().port}`,
       '-servername', 'ohgod',
       '-key', fixtures.path('keys/rsa_private.pem'),
@@ -109,7 +115,7 @@ function doTest(testOptions, callback) {
     ].concat(testOptions.tickets ? [] : '-no_ticket');
 
     function spawnClient() {
-      const client = spawn(common.opensslCli, args, {
+      const client = spawn(opensslCli, args, {
         stdio: [ 0, 1, 'pipe' ]
       });
       let err = '';
diff --git a/test/parallel/test-tls-set-ciphers.js b/test/parallel/test-tls-set-ciphers.js
index f7062e73c9403c..1e63e9376e134b 100644
--- a/test/parallel/test-tls-set-ciphers.js
+++ b/test/parallel/test-tls-set-ciphers.js
@@ -1,7 +1,17 @@
 'use strict';
 const common = require('../common');
-if (!common.hasOpenSSL3)
+if (!common.hasCrypto) {
   common.skip('missing crypto, or OpenSSL version lower than 3');
+}
+
+const {
+  hasOpenSSL,
+  hasOpenSSL3,
+} = require('../common/crypto');
+
+if (!hasOpenSSL3) {
+  common.skip('missing crypto, or OpenSSL version lower than 3');
+}
 
 const fixtures = require('../common/fixtures');
 const { inspect } = require('util');
@@ -80,7 +90,7 @@ function test(cciphers, sciphers, cipher, cerr, serr, options) {
 const U = undefined;
 
 let expectedTLSAlertError = 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
-if (common.hasOpenSSL(3, 2)) {
+if (hasOpenSSL(3, 2)) {
   expectedTLSAlertError = 'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE';
 }
 
@@ -117,7 +127,7 @@ test(U, 'AES256-SHA', 'TLS_AES_256_GCM_SHA384', U, U, { maxVersion: 'TLSv1.3' })
 // default, but work.
 // However, for OpenSSL32 AES_128 is not enabled due to the
 // default security level
-if (!common.hasOpenSSL(3, 2)) {
+if (!hasOpenSSL(3, 2)) {
   test('TLS_AES_128_CCM_8_SHA256', U,
        U, 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE', 'ERR_SSL_NO_SHARED_CIPHER');
 
diff --git a/test/parallel/test-tls-set-secure-context.js b/test/parallel/test-tls-set-secure-context.js
index c056875e14ddfb..3d2de6b3321414 100644
--- a/test/parallel/test-tls-set-secure-context.js
+++ b/test/parallel/test-tls-set-secure-context.js
@@ -1,8 +1,9 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 // This test verifies the behavior of the tls setSecureContext() method.
 // It also verifies that existing connections are not disrupted when the
@@ -12,6 +13,7 @@ const assert = require('assert');
 const events = require('events');
 const https = require('https');
 const timers = require('timers/promises');
+const { hasOpenSSL3 } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 const credentialOptions = [
   {
@@ -55,7 +57,7 @@ server.listen(0, common.mustCall(() => {
 
     server.setSecureContext(credentialOptions[1]);
     firstResponse.write('request-');
-    const errorMessageRegex = common.hasOpenSSL3 ?
+    const errorMessageRegex = hasOpenSSL3 ?
       /^Error: self-signed certificate$/ :
       /^Error: self signed certificate$/;
     await assert.rejects(makeRequest(port, 3), errorMessageRegex);
diff --git a/test/parallel/test-tls-set-sigalgs.js b/test/parallel/test-tls-set-sigalgs.js
index 3f3d152f4d877e..985ca13ba2ac7d 100644
--- a/test/parallel/test-tls-set-sigalgs.js
+++ b/test/parallel/test-tls-set-sigalgs.js
@@ -1,6 +1,9 @@
 'use strict';
 const common = require('../common');
-if (!common.hasCrypto) common.skip('missing crypto');
+if (!common.hasCrypto) {
+  common.skip('missing crypto');
+}
+const { hasOpenSSL } = require('../common/crypto');
 const fixtures = require('../common/fixtures');
 
 // Test sigalgs: option for TLS.
@@ -63,7 +66,7 @@ test('RSA-PSS+SHA256:RSA-PSS+SHA512:ECDSA+SHA256',
      ['RSA-PSS+SHA256', 'ECDSA+SHA256']);
 
 // Do not have shared sigalgs.
-const handshakeErr = common.hasOpenSSL(3, 2) ?
+const handshakeErr = hasOpenSSL(3, 2) ?
   'ERR_SSL_SSL/TLS_ALERT_HANDSHAKE_FAILURE' : 'ERR_SSL_SSLV3_ALERT_HANDSHAKE_FAILURE';
 test('RSA-PSS+SHA384', 'ECDSA+SHA256',
      undefined, handshakeErr,
diff --git a/test/parallel/test-trace-env.js b/test/parallel/test-trace-env.js
index ba08e0af2aad1d..7a7b80fa4c1094 100644
--- a/test/parallel/test-trace-env.js
+++ b/test/parallel/test-trace-env.js
@@ -18,9 +18,11 @@ spawnSyncAndAssert(process.execPath, ['--trace-env', fixtures.path('empty.js')],
     }
     if (common.hasCrypto) {
       assert.match(output, /get "NODE_EXTRA_CA_CERTS"/);
-    }
-    if (common.hasOpenSSL3) {
-      assert.match(output, /get "OPENSSL_CONF"/);
+
+      const { hasOpenSSL3 } = require('../common/crypto');
+      if (hasOpenSSL3) {
+        assert.match(output, /get "OPENSSL_CONF"/);
+      }
     }
     assert.match(output, /get "NODE_DEBUG_NATIVE"/);
     assert.match(output, /get "NODE_COMPILE_CACHE"/);
diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js
index e6ae4d886908cb..b507af88e1f7f3 100644
--- a/test/parallel/test-x509-escaping.js
+++ b/test/parallel/test-x509-escaping.js
@@ -1,15 +1,16 @@
 'use strict';
 
 const common = require('../common');
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
 
 const assert = require('assert');
 const { X509Certificate } = require('crypto');
 const tls = require('tls');
 const fixtures = require('../common/fixtures');
 
-const { hasOpenSSL3 } = common;
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // Test that all certificate chains provided by the reporter are rejected.
 {
diff --git a/test/pummel/test-crypto-dh-hash.js b/test/pummel/test-crypto-dh-hash.js
index ef5a640688c9bb..b59f556a2042b9 100644
--- a/test/pummel/test-crypto-dh-hash.js
+++ b/test/pummel/test-crypto-dh-hash.js
@@ -30,7 +30,9 @@ if (common.isPi) {
   common.skip('Too slow for Raspberry Pi devices');
 }
 
-if (!common.hasOpenSSL3) {
+const { hasOpenSSL3 } = require('../common/crypto');
+
+if (!hasOpenSSL3) {
   common.skip('Too slow when dynamically linked against OpenSSL 1.1.1');
 }
 
diff --git a/test/pummel/test-crypto-dh-keys.js b/test/pummel/test-crypto-dh-keys.js
index 2caa4e244a9859..abce6a07acf4ac 100644
--- a/test/pummel/test-crypto-dh-keys.js
+++ b/test/pummel/test-crypto-dh-keys.js
@@ -36,8 +36,9 @@ const crypto = require('crypto');
 [ 'modp1', 'modp2', 'modp5', 'modp14', 'modp15', 'modp16', 'modp17' ]
 .forEach((name) => {
   // modp1 is 768 bits, FIPS requires >= 1024
-  if (name === 'modp1' && common.hasFipsCrypto)
+  if (name === 'modp1' && crypto.getFips()) {
     return;
+  }
   const group1 = crypto.getDiffieHellman(name);
   const group2 = crypto.getDiffieHellman(name);
   group1.generateKeys();
diff --git a/test/pummel/test-dh-regr.js b/test/pummel/test-dh-regr.js
index 41d5bf872f97ec..cfae57d0728bdb 100644
--- a/test/pummel/test-dh-regr.js
+++ b/test/pummel/test-dh-regr.js
@@ -32,10 +32,11 @@ if (common.isPi) {
 
 const assert = require('assert');
 const crypto = require('crypto');
+const { hasOpenSSL3 } = require('../common/crypto');
 
 // FIPS requires length >= 1024 but we use 512/256 in this test to keep it from
 // taking too long and timing out in CI.
-const length = (common.hasFipsCrypto) ? 1024 : common.hasOpenSSL3 ? 512 : 256;
+const length = crypto.getFips() ? 1024 : hasOpenSSL3 ? 512 : 256;
 
 const p = crypto.createDiffieHellman(length).getPrime();
 
diff --git a/test/sequential/test-tls-psk-client.js b/test/sequential/test-tls-psk-client.js
index ddebc8f8cc9807..c07b1f92d98376 100644
--- a/test/sequential/test-tls-psk-client.js
+++ b/test/sequential/test-tls-psk-client.js
@@ -1,10 +1,15 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
-if (!common.opensslCli)
+}
+
+const { opensslCli } = require('../common/crypto');
+
+if (!opensslCli) {
   common.skip('missing openssl cli');
+}
 
 const assert = require('assert');
 const tls = require('tls');
@@ -16,7 +21,7 @@ const KEY = 'd731ef57be09e5204f0b205b60627028';
 const IDENTITY = 'Client_identity';  // Hardcoded by `openssl s_server`
 const useIPv4 = !common.hasIPv6;
 
-const server = spawn(common.opensslCli, [
+const server = spawn(opensslCli, [
   's_server',
   '-accept', common.PORT,
   '-cipher', CIPHERS,
diff --git a/test/sequential/test-tls-securepair-client.js b/test/sequential/test-tls-securepair-client.js
index f3ca42ad6edfb0..262518621b5f3f 100644
--- a/test/sequential/test-tls-securepair-client.js
+++ b/test/sequential/test-tls-securepair-client.js
@@ -23,14 +23,19 @@
 
 const common = require('../common');
 
-if (!common.opensslCli)
-  common.skip('node compiled without OpenSSL CLI.');
-
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
 
-if (common.isWindows)
+if (!opensslCli) {
+  common.skip('node compiled without OpenSSL CLI.');
+}
+
+if (common.isWindows) {
   common.skip('test does not work on Windows'); // ...but it should!
+}
 
 const net = require('net');
 const assert = require('assert');
@@ -63,11 +68,11 @@ function test(keyPath, certPath, check, next) {
   const key = fixtures.readSync(keyPath).toString();
   const cert = fixtures.readSync(certPath).toString();
 
-  const server = spawn(common.opensslCli, ['s_server',
-                                           '-accept', 0,
-                                           '-cert', fixtures.path(certPath),
-                                           '-key', fixtures.path(keyPath),
-                                           ...(useIPv4 ? ['-4'] : []),
+  const server = spawn(opensslCli, ['s_server',
+                                    '-accept', 0,
+                                    '-cert', fixtures.path(certPath),
+                                    '-key', fixtures.path(keyPath),
+                                    ...(useIPv4 ? ['-4'] : []),
   ]);
   server.stdout.pipe(process.stdout);
   server.stderr.pipe(process.stdout);
diff --git a/test/sequential/test-tls-session-timeout.js b/test/sequential/test-tls-session-timeout.js
index 09107011aeda52..a93cdc793a2337 100644
--- a/test/sequential/test-tls-session-timeout.js
+++ b/test/sequential/test-tls-session-timeout.js
@@ -22,8 +22,11 @@
 'use strict';
 const common = require('../common');
 
-if (!common.hasCrypto)
+if (!common.hasCrypto) {
   common.skip('missing crypto');
+}
+
+const { opensslCli } = require('../common/crypto');
 
 const tmpdir = require('../common/tmpdir');
 tmpdir.refresh();
@@ -56,8 +59,9 @@ const cert = fixtures.readKey('rsa_cert.crt');
   }
 }
 
-if (!common.opensslCli)
+if (!opensslCli) {
   common.skip('node compiled without OpenSSL CLI.');
+}
 
 doTest();
 
@@ -105,7 +109,7 @@ function doTest() {
       '-sess_in', sessionFileName,
       '-sess_out', sessionFileName,
     ];
-    const client = spawn(common.opensslCli, flags, {
+    const client = spawn(opensslCli, flags, {
       stdio: ['ignore', 'pipe', 'ignore']
     });