diff --git a/test/addons/openssl-client-cert-engine/test.js b/test/addons/openssl-client-cert-engine/test.js
index 4f7c7d7ac0f1..bad751202ca0 100644
--- a/test/addons/openssl-client-cert-engine/test.js
+++ b/test/addons/openssl-client-cert-engine/test.js
@@ -5,6 +5,11 @@ const fixture = require('../../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasOpenSSL } = require('../../common/crypto');
+
+if (hasOpenSSL(4))
+  common.skip('OpenSSL 4 does not support engines');
+
 const fs = require('fs');
 const path = require('path');
 
diff --git a/test/addons/openssl-key-engine/test.js b/test/addons/openssl-key-engine/test.js
index 92b7bb558ad7..db05b6cea62b 100644
--- a/test/addons/openssl-key-engine/test.js
+++ b/test/addons/openssl-key-engine/test.js
@@ -5,6 +5,11 @@ const fixture = require('../../common/fixtures');
 if (!common.hasCrypto)
   common.skip('missing crypto');
 
+const { hasOpenSSL } = require('../../common/crypto');
+
+if (hasOpenSSL(4))
+  common.skip('OpenSSL 4 does not support engines');
+
 const fs = require('fs');
 const path = require('path');
 
diff --git a/test/parallel/test-x509-escaping.js b/test/parallel/test-x509-escaping.js
index 47901140cac0..daa51e28191a 100644
--- a/test/parallel/test-x509-escaping.js
+++ b/test/parallel/test-x509-escaping.js
@@ -472,7 +472,7 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
   })).unref();
 }
 
-// The subject MUST NOT be ignored if no dNSName subject alternative name
+// TLS MUST NOT ignore the subject if no dNSName subject alternative name
 // exists, even if other subject alternative names exist.
 {
   const key = fixtures.readKey('irrelevant_san_correct_subject-key.pem');
@@ -485,13 +485,12 @@ const { hasOpenSSL, isBoringSSL } = require('../common/crypto');
   assert.strictEqual(certX509.subjectAltName, 'IP Address:1.2.3.4');
 
   // The newer X509Certificate API allows customizing this behavior:
-  const cnFallback = isBoringSSL ? undefined :
-    servername;
+  const cnFallback = isBoringSSL || hasOpenSSL(4, 1) ? undefined : servername;
   assert.strictEqual(certX509.checkHost(servername), cnFallback);
   assert.strictEqual(certX509.checkHost(servername, { subject: 'default' }),
                      cnFallback);
   assert.strictEqual(certX509.checkHost(servername, { subject: 'always' }),
-                     cnFallback);
+                     isBoringSSL ? undefined : servername);
   assert.strictEqual(certX509.checkHost(servername, { subject: 'never' }),
                      undefined);