diff --git a/include/openssl/ssl.h b/include/openssl/ssl.h
index 7299cd2..3c64237 100644
--- a/include/openssl/ssl.h
+++ b/include/openssl/ssl.h
@@ -929,12 +929,6 @@
 	 */
 	unsigned int max_send_fragment;
 
-#ifndef OPENSSL_ENGINE
-	/* Engine to pass requests for client certs to
-	 */
-	ENGINE *client_cert_engine;
-#endif
-
 	/* TLS extensions servername callback */
 	int (*tlsext_servername_callback)(SSL*, int *, void *);
 	void *tlsext_servername_arg;
@@ -1091,9 +1085,6 @@
 OPENSSL_EXPORT int (*SSL_CTX_get_client_cert_cb(SSL_CTX *ctx))(SSL *ssl, X509 **x509, EVP_PKEY **pkey);
 OPENSSL_EXPORT void SSL_CTX_set_channel_id_cb(SSL_CTX *ctx, void (*channel_id_cb)(SSL *ssl, EVP_PKEY **pkey));
 OPENSSL_EXPORT void (*SSL_CTX_get_channel_id_cb(SSL_CTX *ctx))(SSL *ssl, EVP_PKEY **pkey);
-#ifndef OPENSSL_NO_ENGINE
-OPENSSL_EXPORT int SSL_CTX_set_client_cert_engine(SSL_CTX *ctx, ENGINE *e);
-#endif
 OPENSSL_EXPORT void SSL_CTX_set_cookie_generate_cb(SSL_CTX *ctx, int (*app_gen_cookie_cb)(SSL *ssl, uint8_t *cookie, size_t *cookie_len));
 OPENSSL_EXPORT void SSL_CTX_set_cookie_verify_cb(SSL_CTX *ctx, int (*app_verify_cookie_cb)(SSL *ssl, const uint8_t *cookie, size_t cookie_len));
 #ifndef OPENSSL_NO_NEXTPROTONEG
@@ -1302,9 +1293,6 @@
 
 	void (*info_callback)(const SSL *ssl,int type,int val); /* optional informational callback */
 
-	int error;		/* error bytes to be written */
-	int error_code;		/* actual code */
-
 	/* PSK identity hint is stored here only to enable setting a hint on an SSL object before an
 	 * SSL_SESSION is associated with it. Once an SSL_SESSION is associated with this SSL object,
 	 * the psk_identity_hint from the session takes precedence over this one. */
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index ce2758b..9c2129c 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -2774,19 +2774,6 @@
 int ssl_do_client_cert_cb(SSL *s, X509 **px509, EVP_PKEY **ppkey)
 	{
 	int i = 0;
-        /* TODO(fork): remove */
-#if 0
-#ifndef OPENSSL_NO_ENGINE
-	if (s->ctx->client_cert_engine)
-		{
-		i = ENGINE_load_ssl_client_cert(s->ctx->client_cert_engine, s,
-						SSL_get_client_CA_list(s),
-						px509, ppkey, NULL, NULL, NULL);
-		if (i != 0)
-			return i;
-		}
-#endif
-#endif
 	if (s->ctx->client_cert_cb)
 		i = s->ctx->client_cert_cb(s,px509,ppkey);
 	return i;
diff --git a/ssl/ssl_cert.c b/ssl/ssl_cert.c
index 3e82fdf..bab0eff 100644
--- a/ssl/ssl_cert.c
+++ b/ssl/ssl_cert.c
@@ -564,7 +564,6 @@
 
 	memset(ret, 0 ,sizeof *ret);
 	ret->peer_key = &(ret->peer_pkeys[SSL_PKEY_RSA_ENC]);
-	ret->references = 1;
 
 	return ret;
 	}
@@ -576,21 +575,6 @@
 	if (sc == NULL)
 		return;
 
-	i = CRYPTO_add(&sc->references, -1, CRYPTO_LOCK_SSL_SESS_CERT);
-#ifdef REF_PRINT
-	REF_PRINT("SESS_CERT", sc);
-#endif
-	if (i > 0)
-		return;
-#ifdef REF_CHECK
-	if (i < 0)
-		{
-		fprintf(stderr,"ssl_sess_cert_free, bad reference count\n");
-		abort(); /* ok */
-		}
-#endif
-
-	/* i == 0 */
 	if (sc->cert_chain != NULL)
 		sk_X509_pop_free(sc->cert_chain, X509_free);
 	for (i = 0; i < SSL_PKEY_NUM; i++)
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index 16b5b3d..43ce97b 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -187,7 +187,6 @@
 		s->session=NULL;
 		}
 
-	s->error=0;
 	s->hit=0;
 	s->shutdown=0;
 
@@ -2011,26 +2010,7 @@
 	ret->psk_identity_hint=NULL;
 	ret->psk_client_callback=NULL;
 	ret->psk_server_callback=NULL;
-#ifndef OPENSSL_NO_ENGINE
-	ret->client_cert_engine = NULL;
-#ifdef OPENSSL_SSL_CLIENT_ENGINE_AUTO
-#define eng_strx(x)	#x
-#define eng_str(x)	eng_strx(x)
-	/* Use specific client engine automatically... ignore errors */
-	{
-	ENGINE *eng;
-	eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
-	if (!eng)
-		{
-		ERR_clear_error();
-		ENGINE_load_builtin_engines();
-		eng = ENGINE_by_id(eng_str(OPENSSL_SSL_CLIENT_ENGINE_AUTO));
-		}
-	if (!eng || !SSL_CTX_set_client_cert_engine(ret, eng))
-		ERR_clear_error();
-	}
-#endif
-#endif
+
 	/* Default is to connect to non-RI servers. When RI is more widely
 	 * deployed might change this.
 	 */
@@ -2105,14 +2085,6 @@
 	if (a->psk_identity_hint)
 		OPENSSL_free(a->psk_identity_hint);
 
-	/* TODO(fork): remove. */
-#if 0
-#ifndef OPENSSL_NO_ENGINE
-	if (a->client_cert_engine)
-		ENGINE_finish(a->client_cert_engine);
-#endif
-#endif
-
 # ifndef OPENSSL_NO_EC
 	if (a->tlsext_ecpointformatlist)
 		OPENSSL_free(a->tlsext_ecpointformatlist);
diff --git a/ssl/ssl_locl.h b/ssl/ssl_locl.h
index 952805b..3bc618e 100644
--- a/ssl/ssl_locl.h
+++ b/ssl/ssl_locl.h
@@ -551,8 +551,6 @@
 #ifndef OPENSSL_NO_ECDH
 	EC_KEY *peer_ecdh_tmp;
 #endif
-
-	int references; /* actually always 1 at the moment */
 	} SESS_CERT;
 /* Structure containing decoded values of signature algorithms extension */
 struct tls_sigalgs_st
@@ -833,7 +831,6 @@
 int ssl_cipher_get_evp(const SSL_SESSION *s,const EVP_CIPHER **enc,
 		       const EVP_MD **md,int *mac_pkey_type,int *mac_secret_size);
 int ssl_cipher_get_mac(const SSL_SESSION *s, const EVP_MD **md, int *mac_pkey_type, int *mac_secret_size);
-int ssl_get_handshake_digest(int i,long *mask,const EVP_MD **md);			   
 int ssl_get_handshake_digest(int i,long *mask,const EVP_MD **md);
 int ssl_cipher_get_cert_index(const SSL_CIPHER *c);
 int ssl_cipher_has_server_public_key(const SSL_CIPHER *cipher);
@@ -1146,8 +1143,4 @@
 	unsigned mac_secret_length,
 	char is_sslv3);
 
-void tls_fips_digest_extra(
-	const EVP_CIPHER_CTX *cipher_ctx, EVP_MD_CTX *mac_ctx,
-	const unsigned char *data, size_t data_len, size_t orig_len);
-
 #endif
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index d5cb5f4..855d1d0 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -3141,73 +3141,6 @@
 	return 1;
 	}
 
-/* TODO(fork): remove */
-#if 0
-#define MAX_SIGALGLEN	(TLSEXT_hash_num * TLSEXT_signature_num * 2)
-
-typedef struct
-	{
-	size_t sigalgcnt;
-	int sigalgs[MAX_SIGALGLEN];
-	} sig_cb_st;
-
-static int sig_cb(const char *elem, int len, void *arg)
-	{
-	sig_cb_st *sarg = arg;
-	size_t i;
-	char etmp[20], *p;
-	int sig_alg, hash_alg;
-	if (sarg->sigalgcnt == MAX_SIGALGLEN)
-		return 0;
-	if (len > (int)(sizeof(etmp) - 1))
-		return 0;
-	memcpy(etmp, elem, len);
-	etmp[len] = 0;
-	p = strchr(etmp, '+');
-	if (!p)
-		return 0;
-	*p = 0;
-	p++;
-	if (!*p)
-		return 0;
-
-	if (!strcmp(etmp, "RSA"))
-		sig_alg = EVP_PKEY_RSA;
-	else if (!strcmp(etmp, "ECDSA"))
-		sig_alg = EVP_PKEY_EC;
-	else return 0;
-
-	hash_alg = OBJ_sn2nid(p);
-	if (hash_alg == NID_undef)
-		hash_alg = OBJ_ln2nid(p);
-	if (hash_alg == NID_undef)
-		return 0;
-
-	for (i = 0; i < sarg->sigalgcnt; i+=2)
-		{
-		if (sarg->sigalgs[i] == sig_alg
-			&& sarg->sigalgs[i + 1] == hash_alg)
-			return 0;
-		}
-	sarg->sigalgs[sarg->sigalgcnt++] = hash_alg;
-	sarg->sigalgs[sarg->sigalgcnt++] = sig_alg;
-	return 1;
-	}
-
-/* Set suppored signature algorithms based on a colon separated list
- * of the form sig+hash e.g. RSA+SHA512:DSA+SHA512 */
-int tls1_set_sigalgs_list(CERT *c, const char *str, int client)
-	{
-	sig_cb_st sig;
-	sig.sigalgcnt = 0;
-	if (!CONF_parse_list(str, ':', 1, sig_cb, &sig))
-		return 0;
-	if (c == NULL)
-		return 1;
-	return tls1_set_sigalgs(c, sig.sigalgs, sig.sigalgcnt, client);
-	}
-#endif
-
 int tls1_set_sigalgs(CERT *c, const int *psig_nids, size_t salglen, int client)
 	{
 	unsigned char *sigalgs, *sptr;