diff --git a/alibuild-recipe-tools.sh b/alibuild-recipe-tools.sh
new file mode 100644
index 0000000000..42c2a526f7
--- /dev/null
+++ b/alibuild-recipe-tools.sh
@@ -0,0 +1,26 @@
+package: alibuild-recipe-tools
+version: "0.2.3"
+tag: "v0.2.3"
+source: https://github.com/alisw/alibuild-recipe-tools
+---
+mkdir -p $INSTALLROOT/bin
+install $SOURCEDIR/alibuild-generate-module $INSTALLROOT/bin
+
+MODULEDIR="$INSTALLROOT/etc/modulefiles"
+MODULEFILE="$MODULEDIR/$PKGNAME"
+mkdir -p "$MODULEDIR"
+cat > "$MODULEFILE" <<EoF
+#%Module1.0
+proc ModulesHelp { } {
+  global version
+  puts stderr "ALICE Modulefile for $PKGNAME $PKGVERSION-@@PKGREVISION@$PKGHASH@@"
+}
+set version $PKGVERSION-@@PKGREVISION@$PKGHASH@@
+module-whatis "ALICE Modulefile for $PKGNAME $PKGVERSION-@@PKGREVISION@$PKGHASH@@"
+# Dependencies
+module load BASE/1.0
+# Our environment
+set ALIBUILD_RECIPE_TOOLS_ROOT \$::env(BASEDIR)/$PKGNAME/\$version
+prepend-path LD_LIBRARY_PATH \$ALIBUILD_RECIPE_TOOLS_ROOT/lib
+prepend-path PATH \$ALIBUILD_RECIPE_TOOLS_ROOT/bin
+EoF
diff --git a/openssl.sh b/openssl.sh
index fc76e8bde4..9b804ba66e 100644
--- a/openssl.sh
+++ b/openssl.sh
@@ -1,59 +1,69 @@
 package: OpenSSL
-version: v1.0.2o
-tag: OpenSSL_1_0_2o
+version: v1.1.1m
+tag: OpenSSL_1_1_1m
 source: https://github.com/openssl/openssl
 prefer_system: (?!slc5|slc6)
 prefer_system_check: |
-  if [ `uname` = Darwin ]; then test -d `brew --prefix openssl || echo /dev/nope` || exit 1; fi; echo '#include <openssl/bio.h>' | c++ -x c++ - -I`brew --prefix openssl`/include -c -o /dev/null || exit 1; echo -e "#include <openssl/opensslv.h>\n#if OPENSSL_VERSION_NUMBER >= 0x10100000L\n#error \"System's GCC cannot be used: we need OpenSSL 1.0.x to build XrootD. We are going to compile our own version.\"\n#endif\nint main() { }" | cc -x c++ - -I`brew --prefix openssl`/include -c -o /dev/null || exit 1
+  #!/bin/bash -e
+  case $(uname) in
+    Darwin) prefix=$(brew --prefix openssl@1.1); [ -d "$prefix" ] ;;
+    *) prefix= ;;
+  esac
+  cc -x c - ${prefix:+"-I$prefix/include"} -c -o /dev/null <<\EOF
+  #include <openssl/bio.h>
+  #include <openssl/opensslv.h>
+  #if OPENSSL_VERSION_NUMBER < 0x10101000L
+  #error "System's OpenSSL cannot be used: we need OpenSSL >= 1.1.1 for the Python ssl module. We are going to compile our own version."
+  #endif
+  int main() { }
+  EOF
 build_requires:
- - zlib
- - "GCC-Toolchain:(?!osx)"
+  - zlib
+  - alibuild-recipe-tools
+  - "GCC-Toolchain:(?!osx)"
 ---
 #!/bin/bash -e
 
-rsync -av --delete --exclude="**/.git" $SOURCEDIR/ .
+rsync -av --delete --exclude="**/.git" "$SOURCEDIR/" .
+case ${PKG_VERSION} in
+  v1.1*)
+    OPTS=""
+    OPENSSLDIRPREFIX="" ;;
+  *)
+    OPTS="no-krb5"
+    OPENSSLDIRPREFIX="etc/ssl"
+  ;;
+esac
 
 ./config --prefix="$INSTALLROOT"                   \
-         --openssldir="$INSTALLROOT/etc/ssl"       \
+         --openssldir="$INSTALLROOT/$OPENSSLDIRPREFIX"       \
          --libdir=lib                              \
          zlib                                      \
          no-idea                                   \
          no-mdc2                                   \
          no-rc5                                    \
-         no-ec                                     \
-         no-ecdh                                   \
-         no-ecdsa                                  \
          no-asm                                    \
-         no-krb5                                   \
+         ${OPTS}                                   \
          shared                                    \
          -fno-strict-aliasing                      \
          -L"$INSTALLROOT/lib"                      \
          -Wa,--noexecstack
 make depend
 make  # don't ever try to build in multicore
-make install
+make install_sw # no not install man pages
 
 # Remove static libraries and pkgconfig
-rm -rf $INSTALLROOT/lib/pkgconfig \
-       $INSTALLROOT/lib/*.a
+rm -rf "$INSTALLROOT/lib/pkgconfig" \
+       "$INSTALLROOT"/lib/*.a
 
 # Modulefile
 MODULEDIR="$INSTALLROOT/etc/modulefiles"
 MODULEFILE="$MODULEDIR/$PKGNAME"
+
 mkdir -p "$MODULEDIR"
-cat > "$MODULEFILE" <<EoF
-#%Module1.0
-proc ModulesHelp { } {
-  global version
-  puts stderr "ALICE Modulefile for $PKGNAME $PKGVERSION-@@PKGREVISION@$PKGHASH@@"
-}
-set version $PKGVERSION-@@PKGREVISION@$PKGHASH@@
-module-whatis "ALICE Modulefile for $PKGNAME $PKGVERSION-@@PKGREVISION@$PKGHASH@@"
-# Dependencies
-module load BASE/1.0 ${ZLIB_REVISION:+zlib/$ZLIB_VERSION-$ZLIB_REVISION} ${GCC_TOOLCHAIN_ROOT:+GCC-Toolchain/$GCC_TOOLCHAIN_VERSION-$GCC_TOOLCHAIN_REVISION}
-# Our environment
-set OPENSSL_ROOT \$::env(BASEDIR)/$PKGNAME/\$version
-setenv OPENSSL_ROOT \$OPENSSL_ROOT
-prepend-path PATH \$OPENSSL_ROOT/bin
-prepend-path LD_LIBRARY_PATH \$OPENSSL_ROOT/lib
-EoF
+alibuild-generate-module --lib --bin > "$MODULEFILE"
+cat << EOF >> "$MODULEFILE"
+prepend-path ROOT_INCLUDE_PATH \$PKG_ROOT/include
+EOF
+mkdir -p "$INSTALLROOT/etc/modulefiles"
+rsync -a --delete "$MODULEDIR/" "$INSTALLROOT/etc/modulefiles"