diff --git a/openssl/src/pkcs12.rs b/openssl/src/pkcs12.rs
index ab0934a81720b7efbbce4484ca28c16a97857917..1318f7f79ce6fe3944414c6f282fcad257323e0d 100644
--- a/openssl/src/pkcs12.rs
+++ b/openssl/src/pkcs12.rs
@@ -10,6 +10,7 @@ use {cvt, cvt_p};
 use pkey::PKey;
 use error::ErrorStack;
 use x509::X509;
+use types::OpenSslType;
 
 /// A PKCS #12 archive.
 pub struct Pkcs12(*mut ffi::PKCS12);
diff --git a/openssl/src/pkey.rs b/openssl/src/pkey.rs
index 8e4041b12407fb577f1efed15bb3b504ee70c755..2561ab290f61d82e03aebd3dfd81b433576739a4 100644
--- a/openssl/src/pkey.rs
+++ b/openssl/src/pkey.rs
@@ -1,7 +1,6 @@
 use libc::{c_void, c_char, c_int};
 use std::ptr;
 use std::mem;
-use std::ops::Deref;
 use ffi;
 
 use {cvt, cvt_p};
@@ -10,20 +9,11 @@ use dsa::Dsa;
 use rsa::{Rsa, RsaRef};
 use error::ErrorStack;
 use util::{CallbackState, invoke_passwd_cb};
-use opaque::Opaque;
+use types::{OpenSslType, Ref};
 
-/// A borrowed `PKey`.
-pub struct PKeyRef(Opaque);
-
-impl PKeyRef {
-    pub unsafe fn from_ptr<'a>(ptr: *mut ffi::EVP_PKEY) -> &'a PKeyRef {
-        &*(ptr as *mut _)
-    }
-
-    pub fn as_ptr(&self) -> *mut ffi::EVP_PKEY {
-        self as *const _ as *mut _
-    }
+type_!(PKey, ffi::EVP_PKEY, ffi::EVP_PKEY_free);
 
+impl Ref<PKey> {
     /// Get a reference to the interal RSA key for direct access to the key components
     pub fn rsa(&self) -> Result<Rsa, ErrorStack> {
         unsafe {
@@ -59,14 +49,11 @@ impl PKeyRef {
         Ok(mem_bio.get_buf().to_owned())
     }
 
-    pub fn public_eq(&self, other: &PKeyRef) -> bool {
+    pub fn public_eq(&self, other: &Ref<PKey>) -> bool {
         unsafe { ffi::EVP_PKEY_cmp(self.as_ptr(), other.as_ptr()) == 1 }
     }
 }
 
-/// Represents a public key, optionally with a private key attached.
-pub struct PKey(*mut ffi::EVP_PKEY);
-
 unsafe impl Send for PKey {}
 unsafe impl Sync for PKey {}
 
@@ -105,10 +92,6 @@ impl PKey {
         }
     }
 
-    pub unsafe fn from_ptr(handle: *mut ffi::EVP_PKEY) -> PKey {
-        PKey(handle)
-    }
-
     /// Reads private key from PEM, takes ownership of handle
     pub fn private_key_from_pem(buf: &[u8]) -> Result<PKey, ErrorStack> {
         ffi::init();
@@ -166,22 +149,6 @@ impl PKey {
     }
 }
 
-impl Drop for PKey {
-    fn drop(&mut self) {
-        unsafe {
-            ffi::EVP_PKEY_free(self.0);
-        }
-    }
-}
-
-impl Deref for PKey {
-    type Target = PKeyRef;
-
-    fn deref(&self) -> &PKeyRef {
-        unsafe { PKeyRef::from_ptr(self.0) }
-    }
-}
-
 #[cfg(test)]
 mod tests {
     #[test]
diff --git a/openssl/src/ssl/connector.rs b/openssl/src/ssl/connector.rs
index c7bfb209a1dfab0e60c7d0434031c9d6b4fc72aa..752126e0d3dfd1799ad339acf20e2447520ba5ac 100644
--- a/openssl/src/ssl/connector.rs
+++ b/openssl/src/ssl/connector.rs
@@ -4,8 +4,9 @@ use dh::Dh;
 use error::ErrorStack;
 use ssl::{self, SslMethod, SslContextBuilder, SslContext, Ssl, SSL_VERIFY_PEER, SslStream,
           HandshakeError};
-use pkey::PKeyRef;
+use pkey::PKey;
 use x509::X509Ref;
+use types::Ref;
 
 // apps/dh2048.pem
 const DHPARAM_PEM: &'static str = r#"
@@ -116,7 +117,7 @@ impl SslAcceptorBuilder {
     ///
     /// [docs]: https://wiki.mozilla.org/Security/Server_Side_TLS
     pub fn mozilla_intermediate<I>(method: SslMethod,
-                                   private_key: &PKeyRef,
+                                   private_key: &Ref<PKey>,
                                    certificate: &X509Ref,
                                    chain: I)
                                    -> Result<SslAcceptorBuilder, ErrorStack>
@@ -151,7 +152,7 @@ impl SslAcceptorBuilder {
     ///
     /// [docs]: https://wiki.mozilla.org/Security/Server_Side_TLS
     pub fn mozilla_modern<I>(method: SslMethod,
-                             private_key: &PKeyRef,
+                             private_key: &Ref<PKey>,
                              certificate: &X509Ref,
                              chain: I)
                              -> Result<SslAcceptorBuilder, ErrorStack>
@@ -169,7 +170,7 @@ impl SslAcceptorBuilder {
     }
 
     fn finish_setup<I>(mut ctx: SslContextBuilder,
-                       private_key: &PKeyRef,
+                       private_key: &Ref<PKey>,
                        certificate: &X509Ref,
                        chain: I)
                        -> Result<SslAcceptorBuilder, ErrorStack>
diff --git a/openssl/src/ssl/mod.rs b/openssl/src/ssl/mod.rs
index 97b0fe6e97ba8b9413bfb7c99b3e611bcb389e58..6a6916fc61c44da8865854f94d992c71cfe51247 100644
--- a/openssl/src/ssl/mod.rs
+++ b/openssl/src/ssl/mod.rs
@@ -96,7 +96,7 @@ use ec_key::EcKey;
 use x509::{X509StoreContextRef, X509FileType, X509, X509Ref, X509VerifyError};
 #[cfg(any(ossl102, ossl110))]
 use verify::X509VerifyParamRef;
-use pkey::PKeyRef;
+use pkey::PKey;
 use error::ErrorStack;
 use opaque::Opaque;
 use types::Ref;
@@ -615,7 +615,7 @@ impl SslContextBuilder {
     }
 
     /// Specifies the private key
-    pub fn set_private_key(&mut self, key: &PKeyRef) -> Result<(), ErrorStack> {
+    pub fn set_private_key(&mut self, key: &Ref<PKey>) -> Result<(), ErrorStack> {
         unsafe { cvt(ffi::SSL_CTX_use_PrivateKey(self.as_ptr(), key.as_ptr())).map(|_| ()) }
     }
 
diff --git a/openssl/src/x509/mod.rs b/openssl/src/x509/mod.rs
index 8a4941eacc6626def60c6cad190c7be794dbd8e0..d3f7fbc02811aed77cdfed4f23db2a73ad033455 100644
--- a/openssl/src/x509/mod.rs
+++ b/openssl/src/x509/mod.rs
@@ -17,13 +17,13 @@ use asn1::Asn1Time;
 use bio::{MemBio, MemBioSlice};
 use crypto::CryptoString;
 use hash::MessageDigest;
-use pkey::{PKey, PKeyRef};
+use pkey::PKey;
 use rand::rand_bytes;
 use error::ErrorStack;
 use ffi;
 use nid::Nid;
 use opaque::Opaque;
-use types::Ref;
+use types::{OpenSslType, Ref};
 
 #[cfg(ossl10x)]
 use ffi::{X509_set_notBefore, X509_set_notAfter, ASN1_STRING_data};
@@ -269,7 +269,7 @@ impl X509Generator {
     }
 
     /// Sets the certificate public-key, then self-sign and return it
-    pub fn sign(&self, p_key: &PKeyRef) -> Result<X509, ErrorStack> {
+    pub fn sign(&self, p_key: &Ref<PKey>) -> Result<X509, ErrorStack> {
         ffi::init();
 
         unsafe {
@@ -321,7 +321,7 @@ impl X509Generator {
     }
 
     /// Obtain a certificate signing request (CSR)
-    pub fn request(&self, p_key: &PKeyRef) -> Result<X509Req, ErrorStack> {
+    pub fn request(&self, p_key: &Ref<PKey>) -> Result<X509Req, ErrorStack> {
         let cert = match self.sign(p_key) {
             Ok(c) => c,
             Err(x) => return Err(x),