diff --git a/openssl/src/c_helpers.c b/openssl/src/c_helpers.c
index 402c36ec7e7f2fb594b631cb53e9bfc45dcc3ce2..1b48565e479440cabefc7798819cf53cd8fa71e8 100644
--- a/openssl/src/c_helpers.c
+++ b/openssl/src/c_helpers.c
@@ -7,3 +7,11 @@ void rust_SSL_clone(SSL *ssl) {
 void rust_SSL_CTX_clone(SSL_CTX *ctx) {
     CRYPTO_add(&ctx->references,1,CRYPTO_LOCK_SSL_CTX);
 }
+
+void rust_EVP_PKEY_clone(EVP_PKEY *pkey) {
+    CRYPTO_add(&pkey->references,1,CRYPTO_LOCK_EVP_PKEY);
+}
+
+void rust_X509_clone(X509 *x509) {
+    CRYPTO_add(&x509->references,1,CRYPTO_LOCK_X509);
+}
diff --git a/openssl/src/crypto/pkey.rs b/openssl/src/crypto/pkey.rs
index 7cfa1288e4d8f3799c3381ad39e8d808a9574f45..e556730d4c9d3361c16bb29445f6edb5391ec6e3 100644
--- a/openssl/src/crypto/pkey.rs
+++ b/openssl/src/crypto/pkey.rs
@@ -53,6 +53,10 @@ fn openssl_hash_nid(hash: HashType) -> c_int {
     }
 }
 
+extern "C" {
+    fn rust_EVP_PKEY_clone(pkey: *mut ffi::EVP_PKEY);
+}
+
 pub struct PKey {
     evp: *mut ffi::EVP_PKEY,
     parts: Parts,
@@ -585,6 +589,16 @@ impl Drop for PKey {
     }
 }
 
+impl Clone for PKey {
+    fn clone(&self) -> Self {
+        unsafe {
+            rust_EVP_PKEY_clone(self.evp);
+        }
+
+        PKey::from_handle(self.evp, self.parts)
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use std::path::Path;
diff --git a/openssl/src/x509/mod.rs b/openssl/src/x509/mod.rs
index 8cc34cad396ea0486746d1f063a22c38aac09774..a69f61d55ad8de1d230ef5667c139698ce06a844 100644
--- a/openssl/src/x509/mod.rs
+++ b/openssl/src/x509/mod.rs
@@ -509,6 +509,20 @@ impl<'ctx> X509<'ctx> {
     }
 }
 
+extern "C" {
+    fn rust_X509_clone(x509: *mut ffi::X509);
+}
+
+impl<'ctx> Clone for X509<'ctx> {
+    fn clone(&self) -> X509<'ctx> {
+        unsafe { rust_X509_clone(self.handle) }
+        /* FIXME: given that we now have refcounting control, 'owned' should be uneeded, the 'ctx
+         * is probably also uneeded. We can remove both to condense the x509 api quite a bit
+         */
+        X509::new(self.handle, true)
+    }
+}
+
 impl<'ctx> Drop for X509<'ctx> {
     fn drop(&mut self) {
         if self.owned {