diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index b881966..f5af366 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -1664,7 +1664,6 @@
 
     /* Depending on the key exchange method, compute |pms| and |pms_len|. */
     if (alg_k & SSL_kRSA) {
-      RSA *rsa;
       size_t enc_pms_len;
 
       pms_len = SSL_MAX_MASTER_KEY_LENGTH;
@@ -1675,16 +1674,18 @@
       }
 
       pkey = X509_get_pubkey(s->session->peer);
-      if (pkey == NULL ||
-          pkey->type != EVP_PKEY_RSA ||
-          pkey->pkey.rsa == NULL) {
+      if (pkey == NULL) {
+        goto err;
+      }
+
+      RSA *rsa = EVP_PKEY_get0_RSA(pkey);
+      if (rsa == NULL) {
         OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
         EVP_PKEY_free(pkey);
         goto err;
       }
 
       s->session->key_exchange_info = EVP_PKEY_bits(pkey);
-      rsa = pkey->pkey.rsa;
       EVP_PKEY_free(pkey);
 
       pms[0] = s->client_version >> 8;
@@ -2161,13 +2162,13 @@
   }
   ssl->rwstate = SSL_NOTHING;
 
-  if (EVP_PKEY_id(ssl->tlsext_channel_id_private) != EVP_PKEY_EC) {
+  EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(ssl->tlsext_channel_id_private);
+  if (ec_key == NULL) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return -1;
   }
 
   int ret = -1;
-  EC_KEY *ec_key = ssl->tlsext_channel_id_private->pkey.ec;
   BIGNUM *x = BN_new();
   BIGNUM *y = BN_new();
   ECDSA_SIG *sig = NULL;
diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
index 7bf223d..f6d400a 100644
--- a/ssl/s3_lib.c
+++ b/ssl/s3_lib.c
@@ -335,8 +335,9 @@
 }
 
 int SSL_set1_tls_channel_id(SSL *ssl, EVP_PKEY *private_key) {
-  if (EVP_PKEY_id(private_key) != EVP_PKEY_EC ||
-      EC_GROUP_get_curve_name(EC_KEY_get0_group(private_key->pkey.ec)) !=
+  EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(private_key);
+  if (ec_key == NULL ||
+      EC_GROUP_get_curve_name(EC_KEY_get0_group(ec_key)) !=
           NID_X9_62_prime256v1) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_CHANNEL_ID_NOT_P256);
     return 0;
diff --git a/ssl/ssl_rsa.c b/ssl/ssl_rsa.c
index b6ae370..990979b 100644
--- a/ssl/ssl_rsa.c
+++ b/ssl/ssl_rsa.c
@@ -401,20 +401,19 @@
                                           in_len);
   }
 
-  if (ssl_private_key_type(ssl) != EVP_PKEY_RSA) {
+  RSA *rsa = EVP_PKEY_get0_RSA(ssl->cert->privatekey);
+  if (rsa == NULL) {
     /* Decrypt operations are only supported for RSA keys. */
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
     return ssl_private_key_failure;
   }
 
-  enum ssl_private_key_result_t ret = ssl_private_key_failure;
-  RSA *rsa = ssl->cert->privatekey->pkey.rsa;
   /* Decrypt with no padding. PKCS#1 padding will be removed as part
    * of the timing-sensitive code by the caller. */
-  if (RSA_decrypt(rsa, out_len, out, max_out, in, in_len, RSA_NO_PADDING)) {
-    ret = ssl_private_key_success;
+  if (!RSA_decrypt(rsa, out_len, out, max_out, in, in_len, RSA_NO_PADDING)) {
+    return ssl_private_key_failure;
   }
-  return ret;
+  return ssl_private_key_success;
 }
 
 enum ssl_private_key_result_t ssl_private_key_decrypt_complete(
diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
index 2a3ba7f..c7e52a9 100644
--- a/ssl/t1_lib.c
+++ b/ssl/t1_lib.c
@@ -584,9 +584,12 @@
   uint16_t curve_id;
   uint8_t comp_id;
 
-  if (!pkey ||
-      pkey->type != EVP_PKEY_EC ||
-      !tls1_curve_params_from_ec_key(&curve_id, &comp_id, pkey->pkey.ec) ||
+  if (!pkey) {
+    goto done;
+  }
+  EC_KEY *ec_key = EVP_PKEY_get0_EC_KEY(pkey);
+  if (ec_key == NULL ||
+      !tls1_curve_params_from_ec_key(&curve_id, &comp_id, ec_key) ||
       !tls1_check_curve_id(s, curve_id) ||
       comp_id != TLSEXT_ECPOINTFORMAT_uncompressed) {
     goto done;
diff --git a/ssl/test/bssl_shim.cc b/ssl/test/bssl_shim.cc
index 22ce889..1321b2a 100644
--- a/ssl/test/bssl_shim.cc
+++ b/ssl/test/bssl_shim.cc
@@ -222,13 +222,12 @@
     abort();
   }
 
-  EVP_PKEY *pkey = test_state->private_key.get();
-  if (pkey->type != EVP_PKEY_RSA || pkey->pkey.rsa == NULL) {
+  RSA *rsa = EVP_PKEY_get0_RSA(test_state->private_key.get());
+  if (rsa == NULL) {
     fprintf(stderr,
             "AsyncPrivateKeyDecrypt called with incorrect key type.\n");
     abort();
   }
-  RSA *rsa = pkey->pkey.rsa;
   test_state->private_key_result.resize(RSA_size(rsa));
   if (!RSA_decrypt(rsa, out_len, test_state->private_key_result.data(),
                    RSA_size(rsa), in, in_len, RSA_NO_PADDING)) {