diff --git a/conf/lenses/corosync.aug b/conf/lenses/corosync.aug
index 1418c30..5a6e4b2 100644
--- a/conf/lenses/corosync.aug
+++ b/conf/lenses/corosync.aug
@@ -50,10 +50,10 @@ let totem =
     |kv "rrp_mode" /none|active|passive/
     |kv "vsftype" /none|ykd/
     |kv "secauth" /on|off/
-    |kv "crypto_type" /nss|aes256|aes192|aes128|3des/
-    |kv "crypto_cipher" /none|nss|aes256|aes192|aes128|3des/
+    |kv "crypto_type" /none|nss|openssl/
+    |kv "crypto_cipher" /none|aes256|aes192|aes128|3des/
     |kv "crypto_hash" /none|md5|sha1|sha256|sha384|sha512/
-    |kv "transport" /udp|iba/
+    |kv "transport" /knet|udp|udpu/
     |kv "version" Rx.integer
     |kv "nodeid" Rx.integer
     |kv "threads" Rx.integer
diff --git a/conf/lenses/tests/test_corosync.aug b/conf/lenses/tests/test_corosync.aug
index 486b543..871c1d3 100644
--- a/conf/lenses/tests/test_corosync.aug
+++ b/conf/lenses/tests/test_corosync.aug
@@ -5,6 +5,7 @@ module Test_corosync =
 totem {
 	version: 2
 	secauth: off
+	crypto_type: none
 	crypto_cipher: none
 	crypto_hash: none
 	threads: 0
diff --git a/corosync.spec.in b/corosync.spec.in
index 49d7b7e..732dac5 100644
--- a/corosync.spec.in
+++ b/corosync.spec.in
@@ -44,6 +44,7 @@ Conflicts: openais <= 0.89, openais-devel <= 0.89
 BuildRequires: groff
 BuildRequires: libqb-devel
 BuildRequires: nss-devel
+BuildRequires: libknet1-devel
 BuildRequires: zlib-devel
 %if %{with runautogen}
 BuildRequires: autoconf automake libtool
diff --git a/exec/coroparse.c b/exec/coroparse.c
index 01b3a5b..bf45e55 100644
--- a/exec/coroparse.c
+++ b/exec/coroparse.c
@@ -643,10 +643,7 @@ static int main_config_parser_cb(const char *path,
 			}
 			if (strcmp(path, "totem.crypto_type") == 0) {
 				if ((strcmp(value, "nss") != 0) &&
-				    (strcmp(value, "aes256") != 0) &&
-				    (strcmp(value, "aes192") != 0) &&
-				    (strcmp(value, "aes128") != 0) &&
-				    (strcmp(value, "3des") != 0)) {
+				    (strcmp(value, "openssl") != 0)) {
 					*error_string = "Invalid crypto type";
 
 					return (0);
diff --git a/exec/totemconfig.c b/exec/totemconfig.c
index b80fbd4..211ecef 100644
--- a/exec/totemconfig.c
+++ b/exec/totemconfig.c
@@ -306,12 +306,27 @@ parse_error:
 static int totem_get_crypto(struct totem_config *totem_config)
 {
 	char *str;
+	const char *tmp_type;
 	const char *tmp_cipher;
 	const char *tmp_hash;
 
+	tmp_type = "none";
 	tmp_hash = "none";
 	tmp_cipher = "none";
 
+	if (icmap_get_string("totem.crypto_type", &str) == CS_OK) {
+		if (strcmp(str, "none") == 0) {
+			tmp_type = "none";
+		}
+		if (strcmp(str, "nss") == 0) {
+			tmp_type = "nss";
+		}
+		if (strcmp(str, "openssl") == 0) {
+			tmp_type = "openssl";
+		}
+		free(str);
+	}
+
 	if (icmap_get_string("totem.crypto_cipher", &str) == CS_OK) {
 		if (strcmp(str, "none") == 0) {
 			tmp_cipher = "none";
@@ -361,9 +376,11 @@ static int totem_get_crypto(struct totem_config *totem_config)
 		return -1;
 	}
 
+	free(totem_config->crypto_model_type);
 	free(totem_config->crypto_cipher_type);
 	free(totem_config->crypto_hash_type);
 
+	totem_config->crypto_model_type = strdup(tmp_type);
 	totem_config->crypto_cipher_type = strdup(tmp_cipher);
 	totem_config->crypto_hash_type = strdup(tmp_hash);
 
diff --git a/exec/totemknet.c b/exec/totemknet.c
index a31d513..1e1344f 100644
--- a/exec/totemknet.c
+++ b/exec/totemknet.c
@@ -70,11 +70,6 @@
 
 #include "util.h"
 
-#include <nss.h>
-#include <pk11pub.h>
-#include <pkcs11.h>
-#include <prerror.h>
-
 #include <libknet.h>
 #include <corosync/totem/totemstats.h>
 
@@ -891,10 +886,10 @@ int totemknet_initialize (
 	}
 
 	/* Enable crypto if requested */
-	if (strcmp(instance->totem_config->crypto_cipher_type, "none") != 0) {
+	if (strcmp(instance->totem_config->crypto_model_type, "none") != 0) {
 		struct knet_handle_crypto_cfg crypto_cfg;
 
-		strcpy(crypto_cfg.crypto_model, "nss");
+		strcpy(crypto_cfg.crypto_model, instance->totem_config->crypto_model_type);
 		strcpy(crypto_cfg.crypto_cipher_type, instance->totem_config->crypto_cipher_type);
 		strcpy(crypto_cfg.crypto_hash_type, instance->totem_config->crypto_hash_type);
 		memcpy(crypto_cfg.private_key, instance->totem_config->private_key, instance->totem_config->private_key_len);
diff --git a/exec/totemudp.c b/exec/totemudp.c
index e3009f1..2f986da 100644
--- a/exec/totemudp.c
+++ b/exec/totemudp.c
@@ -69,11 +69,6 @@
 
 #include "util.h"
 
-#include <nss.h>
-#include <pk11pub.h>
-#include <pkcs11.h>
-#include <prerror.h>
-
 #ifndef MSG_NOSIGNAL
 #define MSG_NOSIGNAL 0
 #endif
diff --git a/exec/totemudpu.c b/exec/totemudpu.c
index 4b1a488..bddb8a9 100644
--- a/exec/totemudpu.c
+++ b/exec/totemudpu.c
@@ -70,11 +70,6 @@
 
 #include "util.h"
 
-#include <nss.h>
-#include <pk11pub.h>
-#include <pkcs11.h>
-#include <prerror.h>
-
 #ifndef MSG_NOSIGNAL
 #define MSG_NOSIGNAL 0
 #endif
diff --git a/include/corosync/totem/totem.h b/include/corosync/totem/totem.h
index 914656b..753c4c3 100644
--- a/include/corosync/totem/totem.h
+++ b/include/corosync/totem/totem.h
@@ -195,6 +195,8 @@ struct totem_config {
 
 	unsigned int broadcast_use;
 
+	char *crypto_model_type;
+
 	char *crypto_cipher_type;
 
 	char *crypto_hash_type;
