--- Eternal-Lands-1.9.7.0-4/socket.cpp
+++ Eternal-Lands-1.9.7.0-4/socket.cpp
@@ -486,7 +486,13 @@
 		SSL_set_hostflags(_ssl, X509_CHECK_FLAG_NO_PARTIAL_WILDCARDS);
 	}
 
+// SSL_set1_host() and SSL_add1_host() were deprecated in OpenSSL 4.0;
+// X509_VERIFY_PARAM_add1_host() via SSL_get0_param() is the replacement.
+#if OPENSSL_VERSION_NUMBER >= 0x40000000L
+	if (!X509_VERIFY_PARAM_add1_host(SSL_get0_param(_ssl), hostname.c_str(), 0))
+#else
 	if (!SSL_set1_host(_ssl, hostname.c_str()))
+#endif
 	{
 		unsigned long err = ERR_get_error();
 		throw EncryptError(std::string("Failed to set host name for verification: ") + ERR_reason_error_string(err));
@@ -511,7 +517,13 @@
 		throw EncryptError(msg);
 	}
 
+// SSL_get_peer_certificate() was removed in OpenSSL 4.0; SSL_get0_peer_certificate()
+// (no ownership transfer, no X509_free() needed) was added in OpenSSL 3.0.
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	const X509* cert = SSL_get0_peer_certificate(_ssl);
+#else
 	X509* cert = SSL_get_peer_certificate(_ssl);
+#endif
 	if (!cert)
 	{
 		LOG_ERROR("The server did not present an encryption certificate");
@@ -527,16 +539,29 @@
 		{
 			case X509_V_ERR_HOSTNAME_MISMATCH:
 			{
-				// Mingw-w64 manages to confuse itself on the X509_NAME typedef somehow
-				//X509_NAME* name = X509_get_subject_name(cert);
+				// Mingw-w64 confuses itself on the X509_NAME typedef in older OpenSSL;
+				// OpenSSL 3.0+ made the type fully opaque so the typedef always works.
+// SSL_get0_peer_certificate() returns const X509*, so the chain is const in OpenSSL >= 3.0.
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				const X509_NAME* name = X509_get_subject_name(cert);
+#else
 				struct X509_name_st* name = X509_get_subject_name(cert);
+#endif
 				int loc = X509_NAME_get_index_by_NID(name, NID_commonName, -1);
 				if (loc < 0)
 					throw HostnameMismatch(hostname, "<unknown>");
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				const X509_NAME_ENTRY *entry = X509_NAME_get_entry(name, loc);
+#else
 				X509_NAME_ENTRY *entry = X509_NAME_get_entry(name, loc);
+#endif
 				if (!entry)
 					throw HostnameMismatch(hostname, "<unknown>");
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				const ASN1_STRING *cn = X509_NAME_ENTRY_get_data(entry);
+#else
 				ASN1_STRING *cn = X509_NAME_ENTRY_get_data(entry);
+#endif
 				throw HostnameMismatch(hostname, reinterpret_cast<const char*>(ASN1_STRING_get0_data(cn)));
 			}
 			default: