diff --git a/include/openssl/ssl3.h b/include/openssl/ssl3.h
index faf69ab..0694e56 100644
--- a/include/openssl/ssl3.h
+++ b/include/openssl/ssl3.h
@@ -634,6 +634,8 @@
 #define SSL3_ST_SW_CERT_B (0x141 | SSL_ST_ACCEPT)
 #define SSL3_ST_SW_KEY_EXCH_A (0x150 | SSL_ST_ACCEPT)
 #define SSL3_ST_SW_KEY_EXCH_B (0x151 | SSL_ST_ACCEPT)
+#define SSL3_ST_SW_KEY_EXCH_C (0x152 | SSL_ST_ACCEPT)
+#define SSL3_ST_SW_KEY_EXCH_D (0x153 | SSL_ST_ACCEPT)
 #define SSL3_ST_SW_CERT_REQ_A (0x160 | SSL_ST_ACCEPT)
 #define SSL3_ST_SW_CERT_REQ_B (0x161 | SSL_ST_ACCEPT)
 #define SSL3_ST_SW_SRVR_DONE_A (0x170 | SSL_ST_ACCEPT)
diff --git a/ssl/d1_srvr.c b/ssl/d1_srvr.c
index 32aa591..7a7d1ea 100644
--- a/ssl/d1_srvr.c
+++ b/ssl/d1_srvr.c
@@ -246,6 +246,8 @@
 
       case SSL3_ST_SW_KEY_EXCH_A:
       case SSL3_ST_SW_KEY_EXCH_B:
+      case SSL3_ST_SW_KEY_EXCH_C:
+      case SSL3_ST_SW_KEY_EXCH_D:
         alg_a = s->s3->tmp.new_cipher->algorithm_auth;
 
         /* Send a ServerKeyExchange message if:
diff --git a/ssl/internal.h b/ssl/internal.h
index f19a265..a1600f8 100644
--- a/ssl/internal.h
+++ b/ssl/internal.h
@@ -346,6 +346,10 @@
 
 /* Private key operations. */
 
+/* ssl_has_private_key returns one if |ssl| has a private key
+ * configured and zero otherwise. */
+int ssl_has_private_key(SSL *ssl);
+
 /* ssl_private_key_* call the corresponding function on the
  * |SSL_PRIVATE_KEY_METHOD| for |ssl|, if configured. Otherwise, they implement
  * the operation with |EVP_PKEY|. */
diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index cf98bb6..a1ed39a 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1959,7 +1959,7 @@
     uint8_t *p = ssl_handshake_start(s);
     size_t signature_length = 0;
     unsigned long n = 0;
-    assert(s->cert->privatekey != NULL || s->cert->key_method != NULL);
+    assert(ssl_has_private_key(s));
 
     if (s->state == SSL3_ST_CW_CERT_VRFY_A) {
       uint8_t *buf = (uint8_t *)s->init_buf->data;
@@ -2036,8 +2036,7 @@
 /* ssl3_has_client_certificate returns true if a client certificate is
  * configured. */
 static int ssl3_has_client_certificate(SSL *ssl) {
-  return ssl->cert && ssl->cert->x509 && (ssl->cert->privatekey ||
-                                          ssl->cert->key_method);
+  return ssl->cert && ssl->cert->x509 && ssl_has_private_key(ssl);
 }
 
 int ssl3_send_client_certificate(SSL *s) {
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index fba5bcb..dca6207 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -312,6 +312,8 @@
 
       case SSL3_ST_SW_KEY_EXCH_A:
       case SSL3_ST_SW_KEY_EXCH_B:
+      case SSL3_ST_SW_KEY_EXCH_C:
+      case SSL3_ST_SW_KEY_EXCH_D:
         alg_a = s->s3->tmp.new_cipher->algorithm_auth;
 
         /* Send a ServerKeyExchange message if:
@@ -1247,7 +1249,8 @@
   BN_CTX *bn_ctx = NULL;
   const char *psk_identity_hint = NULL;
   size_t psk_identity_hint_len = 0;
-  EVP_PKEY *pkey;
+  size_t sig_len;
+  size_t max_sig_len;
   uint8_t *p, *d;
   int al, i;
   uint32_t alg_k;
@@ -1255,10 +1258,20 @@
   int n;
   CERT *cert;
   BIGNUM *r[4];
-  int nr[4], kn;
+  int nr[4];
   BUF_MEM *buf;
   EVP_MD_CTX md_ctx;
 
+  if (ssl_cipher_has_server_public_key(s->s3->tmp.new_cipher)) {
+    if (!ssl_has_private_key(s)) {
+      al = SSL_AD_INTERNAL_ERROR;
+      goto f_err;
+    }
+    max_sig_len = ssl_private_key_max_signature_len(s);
+  } else {
+    max_sig_len = 0;
+  }
+
   EVP_MD_CTX_init(&md_ctx);
   if (s->state == SSL3_ST_SW_KEY_EXCH_A) {
     alg_k = s->s3->tmp.new_cipher->algorithm_mkey;
@@ -1400,19 +1413,7 @@
       n += 2 + nr[i];
     }
 
-    if (ssl_cipher_has_server_public_key(s->s3->tmp.new_cipher)) {
-      pkey = s->cert->privatekey;
-      if (pkey == NULL) {
-        al = SSL_AD_DECODE_ERROR;
-        goto f_err;
-      }
-      kn = EVP_PKEY_size(pkey);
-    } else {
-      pkey = NULL;
-      kn = 0;
-    }
-
-    if (!BUF_MEM_grow_clean(buf, n + SSL_HM_HEADER_LENGTH(s) + kn)) {
+    if (!BUF_MEM_grow_clean(buf, n + SSL_HM_HEADER_LENGTH(s) + max_sig_len)) {
       OPENSSL_PUT_ERROR(SSL, ERR_LIB_BUF);
       goto err;
     }
@@ -1453,11 +1454,14 @@
     }
 
     /* not anonymous */
-    if (pkey != NULL) {
-      /* n is the length of the params, they start at &(d[4]) and p points to
+    if (ssl_cipher_has_server_public_key(s->s3->tmp.new_cipher)) {
+      /* n is the length of the params, they start at d and p points to
        * the space at the end. */
       const EVP_MD *md;
-      size_t sig_len = EVP_PKEY_size(pkey);
+      uint8_t digest[EVP_MAX_MD_SIZE];
+      unsigned int digest_length;
+
+      const int pkey_type = ssl_private_key_type(s);
 
       /* Determine signature algorithm. */
       if (SSL_USE_SIGALGS(s)) {
@@ -1469,36 +1473,66 @@
           goto f_err;
         }
         p += 2;
-      } else if (pkey->type == EVP_PKEY_RSA) {
+      } else if (pkey_type == EVP_PKEY_RSA) {
         md = EVP_md5_sha1();
       } else {
         md = EVP_sha1();
       }
 
-      if (!EVP_DigestSignInit(&md_ctx, NULL, md, NULL, pkey) ||
-          !EVP_DigestSignUpdate(&md_ctx, s->s3->client_random,
-                                SSL3_RANDOM_SIZE) ||
-          !EVP_DigestSignUpdate(&md_ctx, s->s3->server_random,
-                                SSL3_RANDOM_SIZE) ||
-          !EVP_DigestSignUpdate(&md_ctx, d, n) ||
-          !EVP_DigestSignFinal(&md_ctx, &p[2], &sig_len)) {
+      if (!EVP_DigestInit_ex(&md_ctx, md, NULL) ||
+          !EVP_DigestUpdate(&md_ctx, s->s3->client_random, SSL3_RANDOM_SIZE) ||
+          !EVP_DigestUpdate(&md_ctx, s->s3->server_random, SSL3_RANDOM_SIZE) ||
+          !EVP_DigestUpdate(&md_ctx, d, n) ||
+          !EVP_DigestFinal_ex(&md_ctx, digest, &digest_length)) {
         OPENSSL_PUT_ERROR(SSL, ERR_LIB_EVP);
         goto err;
       }
 
-      s2n(sig_len, p);
-      n += sig_len + 2;
-      if (SSL_USE_SIGALGS(s)) {
-        n += 2;
+      const enum ssl_private_key_result_t sign_result = ssl_private_key_sign(
+          s, &p[2], &sig_len, max_sig_len, EVP_MD_CTX_md(&md_ctx),
+          digest, digest_length);
+      if (sign_result == ssl_private_key_retry) {
+        s->rwstate = SSL_PRIVATE_KEY_OPERATION;
+        /* Stash away |p|. */
+        s->init_num = p - ssl_handshake_start(s) + SSL_HM_HEADER_LENGTH(s);
+        s->state = SSL3_ST_SW_KEY_EXCH_B;
+        goto err;
+      } else if (sign_result != ssl_private_key_success) {
+        goto err;
       }
     }
 
-    if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_KEY_EXCHANGE, n)) {
+    s->state = SSL3_ST_SW_KEY_EXCH_C;
+  } else if (s->state == SSL3_ST_SW_KEY_EXCH_B) {
+    /* Complete async sign. */
+    /* Restore |p|. */
+    p = ssl_handshake_start(s) + s->init_num - SSL_HM_HEADER_LENGTH(s);
+    const enum ssl_private_key_result_t sign_result =
+        ssl_private_key_sign_complete(s, &p[2], &sig_len, max_sig_len);
+    if (sign_result == ssl_private_key_retry) {
+      s->rwstate = SSL_PRIVATE_KEY_OPERATION;
+      goto err;
+    } else if (sign_result != ssl_private_key_success) {
       goto err;
     }
+
+    s->rwstate = SSL_NOTHING;
+    s->state = SSL3_ST_SW_KEY_EXCH_C;
   }
 
-  s->state = SSL3_ST_SW_KEY_EXCH_B;
+  if (s->state == SSL3_ST_SW_KEY_EXCH_C) {
+    if (ssl_cipher_has_server_public_key(s->s3->tmp.new_cipher)) {
+      s2n(sig_len, p);
+      p += sig_len;
+    }
+    if (!ssl_set_handshake_header(s, SSL3_MT_SERVER_KEY_EXCHANGE,
+                                  p - ssl_handshake_start(s))) {
+      goto err;
+    }
+    s->state = SSL3_ST_SW_KEY_EXCH_D;
+  }
+
+  /* state SSL3_ST_SW_KEY_EXCH_D */
   EVP_MD_CTX_cleanup(&md_ctx);
   return ssl_do_write(s);
 
diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
index a7d5d5b..72b4c79 100644
--- a/ssl/ssl_lib.c
+++ b/ssl/ssl_lib.c
@@ -1834,13 +1834,14 @@
 
   dh_tmp = (c->dh_tmp != NULL || c->dh_tmp_cb != NULL);
 
-  if (s->cert->x509 != NULL && s->cert->privatekey != NULL) {
-    if (s->cert->privatekey->type == EVP_PKEY_RSA) {
+  if (s->cert->x509 != NULL && ssl_has_private_key(s)) {
+    if (ssl_private_key_type(s) == EVP_PKEY_RSA) {
       have_rsa_cert = 1;
-    } else if (s->cert->privatekey->type == EVP_PKEY_EC) {
+    } else if (ssl_private_key_type(s) == EVP_PKEY_EC) {
       have_ecc_cert = 1;
     }
   }
+
   mask_k = 0;
   mask_a = 0;
 
diff --git a/ssl/ssl_rsa.c b/ssl/ssl_rsa.c
index 7b6cd75..da69f8b 100644
--- a/ssl/ssl_rsa.c
+++ b/ssl/ssl_rsa.c
@@ -632,6 +632,10 @@
   ssl->cert->key_method = key_method;
 }
 
+int ssl_has_private_key(SSL *ssl) {
+  return ssl->cert->privatekey != NULL || ssl->cert->key_method != NULL;
+}
+
 int ssl_private_key_type(SSL *ssl) {
   if (ssl->cert->key_method != NULL) {
     return ssl->cert->key_method->type(ssl);
diff --git a/ssl/test/bssl_shim.cc b/ssl/test/bssl_shim.cc
index 571680b..c0d5475 100644
--- a/ssl/test/bssl_shim.cc
+++ b/ssl/test/bssl_shim.cc
@@ -205,6 +205,7 @@
   }
   memcpy(out, bssl::vector_data(&test_state->signature),
          test_state->signature.size());
+  *out_len = test_state->signature.size();
 
   test_state->signature.clear();
   test_state->signature_retries = 0;
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index d66dc74..35d0bc6 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -2234,6 +2234,24 @@
 				"-use-async-private-key",
 			},
 		})
+		tests = append(tests, testCase{
+			testType: serverTest,
+			name:     "Basic-Server-RSAAsyncKey",
+			flags: []string{
+				"-cert-file", path.Join(*resourceDir, rsaCertificateFile),
+				"-key-file", path.Join(*resourceDir, rsaKeyFile),
+				"-use-async-private-key",
+			},
+		})
+		tests = append(tests, testCase{
+			testType: serverTest,
+			name:     "Basic-Server-ECDSAAsyncKey",
+			flags: []string{
+				"-cert-file", path.Join(*resourceDir, ecdsaCertificateFile),
+				"-key-file", path.Join(*resourceDir, ecdsaKeyFile),
+				"-use-async-private-key",
+			},
+		})
 	}
 	tests = append(tests, testCase{
 		testType: serverTest,