diff --git a/ChangeLog b/ChangeLog
index 05005fc..7f78f7f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,4 @@
+ * OpenSSL 4 compatibility.
  * Allow the MDHttpProxy setting to be set per MDomain. The global MDHttpProxy
    setting is used by default. [Michael Kaufmann]
 
diff --git a/src/md_ocsp.c b/src/md_ocsp.c
index 74dd490..996da91 100644
--- a/src/md_ocsp.c
+++ b/src/md_ocsp.c
@@ -519,13 +519,23 @@ static const char *certid_summary(const OCSP_CERTID *certid, apr_pool_t *p)
     serial = issuer = key = "???";
     OCSP_id_get0_info(&aname_hash, &amd_nid, &akey_hash, &aserial, (OCSP_CERTID*)certid);
     if (aname_hash) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
         data.len = (apr_size_t)aname_hash->length;
         data.data = (const char*)aname_hash->data;
+#else
+        data.len = (apr_size_t)ASN1_STRING_length(aname_hash);
+        data.data = (const char*)ASN1_STRING_get0_data(aname_hash);
+#endif
         md_data_to_hex(&issuer, 0, p, &data);
     }
     if (akey_hash) {
+#if OPENSSL_VERSION_NUMBER < 0x10100000L
         data.len = (apr_size_t)akey_hash->length;
         data.data = (const char*)akey_hash->data;
+#else
+        data.len = (apr_size_t)ASN1_STRING_length(akey_hash);
+        data.data = (const char*)ASN1_STRING_get0_data(akey_hash);
+#endif
         md_data_to_hex(&key, 0, p, &data);
     }
     if (aserial) {