diff --git a/.DS_Store b/.DS_Store
new file mode 100644
index 0000000..0d7b507
Binary files /dev/null and b/.DS_Store differ
diff --git a/Sources/websocket.cpp b/Sources/websocket.cpp
index d057799..e76cd02 100644
--- a/Sources/websocket.cpp
+++ b/Sources/websocket.cpp
@@ -1591,9 +1591,13 @@ namespace WebSocketWrapper {
             return result;
         }
         #else
-        // TODO: SHA1
-        kinc_log(KINC_LOG_LEVEL_WARNING, "WebSocket: SHA1 not implemented for this platform");
-        return std::vector<uint8_t>(20, 0);
+        std::vector<uint8_t> result(SHA_DIGEST_LENGTH, 0);
+        SHA1(reinterpret_cast<const unsigned char*>(data.data()),
+             data.size(), result.data());
+        #ifdef DEBUG_NETWORK
+        kinc_log(KINC_LOG_LEVEL_INFO, "WebSocket: SHA1 hash computed successfully");
+        #endif
+        return result;
         #endif
     }
     
@@ -1666,12 +1670,24 @@ namespace WebSocketWrapper {
 		#endif
         return true;
         #else
-        if (ssl_initialized_) {
-            return true;
+        ssl_socket_ = sock;
+
+        if (!initWSL()) {
+            kinc_log(KINC_LOG_LEVEL_ERROR, "WebSocket: Failed to initialize SSL context");
+            return false;
         }
-        // TODO: OpenSSL 
-        kinc_log(KINC_LOG_LEVEL_ERROR, "WebSocket: SSL not supported on this platform");
-        return false;
+
+        if (!performWSLHandshake(sock, host)) {
+            kinc_log(KINC_LOG_LEVEL_ERROR, "WebSocket: SSL handshake failed");
+            cleanupWSL();
+            return false;
+        }
+
+        ssl_initialized_ = true;
+		#ifdef DEBUG_NETWORK
+        kinc_log(KINC_LOG_LEVEL_INFO, "WebSocket: SSL/TLS initialized successfully");
+		#endif
+        return true;
         #endif
         #else
         kinc_log(KINC_LOG_LEVEL_ERROR, "WebSocket: SSL not compiled in");
diff --git a/kfile.js b/kfile.js
index abf4db1..42b917a 100644
--- a/kfile.js
+++ b/kfile.js
@@ -140,16 +140,27 @@ if (flags.with_rtc && (platform === Platform.Windows || platform === Platform.Li
 		project.addLib('bcrypt');
 	}
 	else {
-		project.addLib(root + '/libdatachannel/lib/libdatachannel-static.a');
-		project.addLib(root + '/libdatachannel/lib/libjuice-static.a');
-		project.addLib(root + '/libdatachannel/lib/libusrsctp.a');
-		project.addLib(root + '/libdatachannel/lib/libMbedTLS.a');
+		project.addLinkerFlag(root + '/libdatachannel/lib/libdatachannel-static.a');
+		project.addLinkerFlag(root + '/libdatachannel/lib/libjuice-static.a');
+		project.addLinkerFlag(root + '/libdatachannel/lib/libusrsctp.a');
+		project.addLinkerFlag(root + '/libdatachannel/lib/libsrtp2.a');
+		project.addLinkerFlag(root + '/libdatachannel/lib/libMbedTLS.a');
+		if (platform === Platform.OSX) {
+			const odir = '/opt/homebrew/opt/openssl@3/lib';
+			project.addLinkerFlag(path.join(odir, 'libssl.a'));
+			project.addLinkerFlag(path.join(odir, 'libcrypto.a'));
+		}
 	}
 }
 
 if (flags.with_networking && platform !== Platform.Windows) {
-	project.addLib('ssl');
-	project.addLib('crypto');
+	// On macOS with RTC, libdatachannel's static OpenSSL must be the only
+	// TLS impl; adding -lssl/-lcrypto would bind some EVP symbols to the
+	// system LibreSSL dylibs and crash inside srtp_init.
+	if (!(flags.with_rtc && platform === Platform.OSX)) {
+		project.addLib('ssl');
+		project.addLib('crypto');
+	}
 }
 
 if (flags.with_worker) {
@@ -200,10 +211,15 @@ else if (platform === Platform.OSX) {
 		project.addLinkerFlag('-framework AppKit');
 	}
 	if (flags.with_networking) {
-		project.addIncludeDir('apple-libressl-sdk/include');
-		project.addLinkerFlag('-L' + root + '/apple-libressl-sdk/lib');
-		project.addLinkerFlag('-lssl');
-		project.addLinkerFlag('-lcrypto');
+		if (flags.with_rtc) {
+			project.addIncludeDir('/opt/homebrew/opt/openssl@3/include');
+		}
+		else {
+			project.addIncludeDir('apple-libressl-sdk/include');
+			project.addLinkerFlag('-L' + root + '/apple-libressl-sdk/lib');
+			project.addLinkerFlag('-lssl');
+			project.addLinkerFlag('-lcrypto');
+		}
 		project.addLinkerFlag('-framework Security');
 		project.addLinkerFlag('-framework SystemConfiguration');
 	}
diff --git a/libdatachannel/lib/libMbedTLS.a b/libdatachannel/lib/libMbedTLS.a
new file mode 100644
index 0000000..06a4998
Binary files /dev/null and b/libdatachannel/lib/libMbedTLS.a differ
diff --git a/libdatachannel/lib/libdatachannel-static.a b/libdatachannel/lib/libdatachannel-static.a
new file mode 100644
index 0000000..e1e14ad
Binary files /dev/null and b/libdatachannel/lib/libdatachannel-static.a differ
diff --git a/libdatachannel/lib/libjuice-static.a b/libdatachannel/lib/libjuice-static.a
new file mode 100644
index 0000000..1226558
Binary files /dev/null and b/libdatachannel/lib/libjuice-static.a differ
diff --git a/libdatachannel/lib/libsrtp2.a b/libdatachannel/lib/libsrtp2.a
new file mode 100644
index 0000000..ebf78fe
Binary files /dev/null and b/libdatachannel/lib/libsrtp2.a differ
diff --git a/libdatachannel/lib/libusrsctp.a b/libdatachannel/lib/libusrsctp.a
new file mode 100644
index 0000000..abf7227
Binary files /dev/null and b/libdatachannel/lib/libusrsctp.a differ