diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 195db426..11c06aae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,10 +36,14 @@ jobs:
         with:
           packages: libgnutls28-dev libgnutls30
           version: 1.0
-      - if: matrix.crate == 'libcoap-rs' && matrix.dtls_backend != 'gnutls'
-        run: cargo test -p ${{ matrix.crate }} --no-default-features --features dtls,tcp,vendored --features dtls_${{ matrix.dtls_backend }} --features dtls_${{ matrix.dtls_backend }}_vendored --no-fail-fast
+      - if: matrix.crate == 'libcoap-rs' && matrix.dtls_backend == 'tinydtls'
+        run: cargo test -p ${{ matrix.crate }} --no-default-features --features tcp,vendored,dtls-psk,dtls-rpk --features dtls_${{ matrix.dtls_backend }} --features dtls_${{ matrix.dtls_backend }}_vendored --no-fail-fast
+      - if: matrix.crate == 'libcoap-rs' && matrix.dtls_backend == 'mbedtls'
+        run: cargo test -p ${{ matrix.crate }} --no-default-features --features tcp,vendored,dtls-psk,dtls-pki --features dtls_${{ matrix.dtls_backend }} --features dtls_${{ matrix.dtls_backend }}_vendored --no-fail-fast
+      - if: matrix.crate == 'libcoap-rs' && matrix.dtls_backend == 'openssl'
+        run: cargo test -p ${{ matrix.crate }} --no-default-features --features tcp,vendored,dtls-psk,dtls-pki --features dtls_${{ matrix.dtls_backend }} --features dtls_${{ matrix.dtls_backend }}_vendored --no-fail-fast
       - if: matrix.crate == 'libcoap-rs' && matrix.dtls_backend == 'gnutls'
-        run: cargo test -p ${{ matrix.crate }} --no-default-features --features dtls,tcp,vendored --features dtls_${{ matrix.dtls_backend }} --no-fail-fast
+        run: cargo test -p ${{ matrix.crate }} --no-default-features --features tcp,vendored,dtls-psk,dtls-pki,dtls-rpk --features dtls_${{ matrix.dtls_backend }} --no-fail-fast
       - if: matrix.crate == 'libcoap-sys' && matrix.dtls_backend != 'gnutls'
         run: cargo test -p ${{ matrix.crate }} --features dtls,dtls_backend_${{ matrix.dtls_backend }},dtls_backend_${{ matrix.dtls_backend }}_vendored --no-fail-fast
       - if: matrix.crate == 'libcoap-sys' && matrix.dtls_backend == 'gnutls'
@@ -61,7 +65,7 @@ jobs:
       - uses: giraffate/clippy-action@main
         with:
           reporter: 'github-check'
-          clippy_flags: -p ${{ matrix.crate }} --no-deps
+          clippy_flags: -p ${{ matrix.crate }} --no-deps --all-features
           level: warning
           fail_on_error: true
           tool_name: clippy (${{ matrix.crate }})
@@ -81,7 +85,11 @@ jobs:
       - uses: baptiste0928/cargo-install@v3
         with:
           crate: cargo-tarpaulin
-      - run: cargo tarpaulin --no-fail-fast --workspace --verbose --features dtls,tcp,vendored --exclude-files libcoap-sys/tests,libcoap/tests --timeout 120 --out Xml
+      - uses: awalsh128/cache-apt-pkgs-action@latest
+        with:
+          packages: libgnutls28-dev libgnutls30
+          version: 1.0
+      - run: cargo tarpaulin --no-fail-fast --workspace --verbose --features tcp,vendored,dtls_gnutls,dtls-psk,dtls-rpk,dtls-pki --exclude-files libcoap-sys/tests,libcoap/tests --timeout 120 --out Xml
       - id: cov-report
         name: Produce the coverage report
         uses: pulsastrix/coverage-action@always_generate_comment_body
diff --git a/.idea/runConfigurations/Test.xml b/.idea/runConfigurations/Test.xml
index dfa2f15a..4f6e6f9d 100644
--- a/.idea/runConfigurations/Test.xml
+++ b/.idea/runConfigurations/Test.xml
@@ -1,6 +1,6 @@
 <component name="ProjectRunConfigurationManager">
   <configuration default="false" name="Test" type="CargoCommandRunConfiguration" factoryName="Cargo Command">
-    <option name="command" value="test -p libcoap-rs" />
+    <option name="command" value="test -p libcoap-rs --features vendored,dtls_openssl,dtls-pki --no-default-features" />
     <option name="workingDirectory" value="file://$PROJECT_DIR$" />
     <envs />
     <option name="emulateTerminal" value="false" />
diff --git a/.idea/scopes/Actual_Project_Files.xml b/.idea/scopes/Actual_Project_Files.xml
new file mode 100644
index 00000000..7bc20577
--- /dev/null
+++ b/.idea/scopes/Actual_Project_Files.xml
@@ -0,0 +1,3 @@
+<component name="DependencyValidationManager">
+  <scope name="Actual Project Files" pattern="file[libcoap-rs]:*/&amp;&amp;!file[libcoap-rs]:libcoap-sys/src/libcoap/*&amp;&amp;!file[libcoap-rs]:.idea/*&amp;&amp;!file[libcoap-rs]:libcoap-sys/src/libcoap//*" />
+</component>
\ No newline at end of file
diff --git a/libcoap-sys/src/lib.rs b/libcoap-sys/src/lib.rs
index 352a376d..1444fdf8 100644
--- a/libcoap-sys/src/lib.rs
+++ b/libcoap-sys/src/lib.rs
@@ -200,27 +200,27 @@ pub fn coap_startup_with_feature_checks() {
         #[cfg(feature = "dtls-cid")]
         // SAFETY: Function is always safe to call.
         if unsafe { coap_dtls_cid_is_supported() != 1 } {
-            panic!("Required feature \"dtls\" is not supported by libcoap")
+            panic!("Required feature \"dtls-cid\" is not supported by libcoap")
         }
         #[cfg(feature = "dtls-psk")]
         // SAFETY: Function is always safe to call.
         if unsafe { coap_dtls_psk_is_supported() != 1 } {
-            panic!("Required feature \"dtls\" is not supported by libcoap")
+            panic!("Required feature \"dtls-psk\" is not supported by libcoap")
         }
         #[cfg(feature = "dtls-pki")]
         // SAFETY: Function is always safe to call.
         if unsafe { coap_dtls_pki_is_supported() != 1 } {
-            panic!("Required feature \"dtls\" is not supported by libcoap")
+            panic!("Required feature \"dtls-pki\" is not supported by libcoap")
         }
         #[cfg(feature = "dtls-pkcs11")]
         // SAFETY: Function is always safe to call.
         if !unsafe { coap_dtls_pkcs11_is_supported() == 1 } {
-            panic!("Required feature \"dtls\" is not supported by libcoap")
+            panic!("Required feature \"dtls-pkcs11\" is not supported by libcoap")
         }
         #[cfg(feature = "dtls-rpk")]
         // SAFETY: Function is always safe to call.
         if unsafe { coap_dtls_rpk_is_supported() != 1 } {
-            panic!("Required feature \"dtls\" is not supported by libcoap")
+            panic!("Required feature \"dtls-rpk\" is not supported by libcoap")
         }
         #[cfg(feature = "epoll")]
         // SAFETY: Function is always safe to call.
diff --git a/libcoap/Cargo.toml b/libcoap/Cargo.toml
index c2bc1de0..6087048c 100644
--- a/libcoap/Cargo.toml
+++ b/libcoap/Cargo.toml
@@ -18,8 +18,7 @@ keywords = ["coap", "libcoap"]
 resolver = "2"
 
 [features]
-default = ["dtls", "tcp", "dtls_openssl", "vendored", "libcoap-sys/default"]
-dtls = ["libcoap-sys/dtls"]
+default = ["dtls-psk", "tcp", "dtls_openssl", "vendored", "libcoap-sys/default"]
 dtls_tinydtls = ["libcoap-sys/dtls_backend_tinydtls"]
 dtls_tinydtls_vendored = ["dtls_tinydtls", "libcoap-sys/dtls_backend_tinydtls_vendored"]
 dtls_openssl = ["libcoap-sys/dtls_backend_openssl"]
@@ -27,6 +26,9 @@ dtls_openssl_vendored = ["dtls_openssl", "libcoap-sys/dtls_backend_openssl_vendo
 dtls_gnutls = ["libcoap-sys/dtls_backend_gnutls"]
 dtls_mbedtls = ["libcoap-sys/dtls_backend_mbedtls"]
 dtls_mbedtls_vendored = ["dtls_mbedtls", "libcoap-sys/dtls_backend_mbedtls_vendored"]
+dtls-psk = ["libcoap-sys/dtls", "libcoap-sys/dtls-psk"]
+dtls-pki = ["libcoap-sys/dtls", "libcoap-sys/dtls-pki"]
+dtls-rpk = ["libcoap-sys/dtls", "libcoap-sys/dtls-rpk"]
 tcp = ["libcoap-sys/tcp"]
 tls = ["libcoap-sys/tls"]
 rand = ["dep:rand", "dep:rand_core"]
diff --git a/libcoap/build.rs b/libcoap/build.rs
index a1d64af5..22c63928 100644
--- a/libcoap/build.rs
+++ b/libcoap/build.rs
@@ -6,6 +6,7 @@ fn main() {
     println!("cargo::rustc-check-cfg=cfg(dtls_ec_jpake_support)");
     println!("cargo::rustc-check-cfg=cfg(dtls_cid_support)");
     println!("cargo::rustc-check-cfg=cfg(coap_uri_buf_unused)");
+    println!("cargo::rustc-check-cfg=cfg(dtls)");
     if let Ok(libcoap_version) = std::env::var("DEP_COAP_3_LIBCOAP_VERSION") {
         let version = Version::from(libcoap_version.as_ref()).expect("invalid libcoap version");
         // libcoap >= 4.3.5rc2 no longer uses the buf and buflen parameters in
@@ -26,4 +27,6 @@ fn main() {
             _ => {},
         }
     }
+    #[cfg(any(feature = "dtls-pki", feature = "dtls-rpk", feature = "dtls-psk"))]
+    println!("cargo:rustc-cfg=dtls")
 }
diff --git a/libcoap/resources/test-keys/ca/ca.crt.der b/libcoap/resources/test-keys/ca/ca.crt.der
new file mode 100644
index 00000000..bfef6d47
Binary files /dev/null and b/libcoap/resources/test-keys/ca/ca.crt.der differ
diff --git a/libcoap/resources/test-keys/ca/ca.crt.pem b/libcoap/resources/test-keys/ca/ca.crt.pem
new file mode 100644
index 00000000..4cf229a1
--- /dev/null
+++ b/libcoap/resources/test-keys/ca/ca.crt.pem
@@ -0,0 +1,11 @@
+-----BEGIN CERTIFICATE-----
+MIIBiDCCAS+gAwIBAgIUK1yBz25vGTEzUDl7T7OM5HVmPAcwCgYIKoZIzj0EAwIw
+GTEXMBUGA1UEAwwOY2EuZXhhbXBsZS5jb20wIBcNMjQwOTA5MTMzNzM2WhgPMzAy
+NDAxMTExMzM3MzZaMBkxFzAVBgNVBAMMDmNhLmV4YW1wbGUuY29tMFkwEwYHKoZI
+zj0CAQYIKoZIzj0DAQcDQgAEgg06rgs6mSCWg04NKcgDIeMkNHBmBm3Df3J1BX0i
+I0r3BOqMcnZTblz1QthFFR0RKCA9LmNu5qHIdjJyTFVb5aNTMFEwHQYDVR0OBBYE
+FDioywV+uHqhLttA2BN5kKbaWZ0rMB8GA1UdIwQYMBaAFDioywV+uHqhLttA2BN5
+kKbaWZ0rMA8GA1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDRwAwRAIgRbfjoB45
+SnVhsIXiTX2KfOXTgcT2MEUs+m1qSGKh5e0CIAz3e0xCNO48B9NMRM6UrIZcHTO2
+fwOuThM0C9lgtCx8
+-----END CERTIFICATE-----
diff --git a/libcoap/resources/test-keys/ca/ca.key.pem b/libcoap/resources/test-keys/ca/ca.key.pem
new file mode 100644
index 00000000..3259ea6a
--- /dev/null
+++ b/libcoap/resources/test-keys/ca/ca.key.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIH5YgszlMkgNgi1yImxSKfjUwwqnHNX0E3R+MY6fq0rvoAoGCCqGSM49
+AwEHoUQDQgAEgg06rgs6mSCWg04NKcgDIeMkNHBmBm3Df3J1BX0iI0r3BOqMcnZT
+blz1QthFFR0RKCA9LmNu5qHIdjJyTFVb5Q==
+-----END EC PRIVATE KEY-----
diff --git a/libcoap/resources/test-keys/ca/ca.pub.pem b/libcoap/resources/test-keys/ca/ca.pub.pem
new file mode 100644
index 00000000..a9d10d52
--- /dev/null
+++ b/libcoap/resources/test-keys/ca/ca.pub.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgg06rgs6mSCWg04NKcgDIeMkNHBm
+Bm3Df3J1BX0iI0r3BOqMcnZTblz1QthFFR0RKCA9LmNu5qHIdjJyTFVb5Q==
+-----END PUBLIC KEY-----
diff --git a/libcoap/resources/test-keys/ca/ca.srl b/libcoap/resources/test-keys/ca/ca.srl
new file mode 100644
index 00000000..960df33e
--- /dev/null
+++ b/libcoap/resources/test-keys/ca/ca.srl
@@ -0,0 +1 @@
+72D02BD28A35760C59764C31E3ECD28ADFD15E79
diff --git a/libcoap/resources/test-keys/client/client.crt.der b/libcoap/resources/test-keys/client/client.crt.der
new file mode 100644
index 00000000..76be93e5
Binary files /dev/null and b/libcoap/resources/test-keys/client/client.crt.der differ
diff --git a/libcoap/resources/test-keys/client/client.crt.pem b/libcoap/resources/test-keys/client/client.crt.pem
new file mode 100644
index 00000000..c53beca7
--- /dev/null
+++ b/libcoap/resources/test-keys/client/client.crt.pem
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBezCCASKgAwIBAgIUctAr0oo1dgxZdkwx4+zSit/RXncwCgYIKoZIzj0EAwIw
+GTEXMBUGA1UEAwwOY2EuZXhhbXBsZS5jb20wIBcNMjQwOTExMTYwOTQxWhgPMzAy
+NDAxMTMxNjA5NDFaMB0xGzAZBgNVBAMMEmNsaWVudC5leGFtcGxlLmNvbTBZMBMG
+ByqGSM49AgEGCCqGSM49AwEHA0IABIEEcG+Lv6YP1AQvo1DnmdVlv4FNk0Q5A96W
+ZMrwqNfAh2kITEGwK3w7z3HAQs4aOh3Gp5oDgnmRxGE3mpaLbI6jQjBAMB0GA1Ud
+DgQWBBTgm7v3W4ReI1+mcJM3/delDrIJ9TAfBgNVHSMEGDAWgBQ4qMsFfrh6oS7b
+QNgTeZCm2lmdKzAKBggqhkjOPQQDAgNHADBEAiB+m4kt8xsAsDk1UGAPhpDLx924
+cGbbN8oLu3161LsCUwIgcd0q1bznVLBEM7ZgXFFHHUd3PW9Qko661GpR4cUqdWo=
+-----END CERTIFICATE-----
diff --git a/libcoap/resources/test-keys/client/client.csr b/libcoap/resources/test-keys/client/client.csr
new file mode 100644
index 00000000..6942eb35
--- /dev/null
+++ b/libcoap/resources/test-keys/client/client.csr
@@ -0,0 +1,7 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIHWMH8CAQAwHTEbMBkGA1UEAwwSY2xpZW50LmV4YW1wbGUuY29tMFkwEwYHKoZI
+zj0CAQYIKoZIzj0DAQcDQgAEgQRwb4u/pg/UBC+jUOeZ1WW/gU2TRDkD3pZkyvCo
+18CHaQhMQbArfDvPccBCzho6HcanmgOCeZHEYTealotsjqAAMAoGCCqGSM49BAMC
+A0cAMEQCIAPWMHMzDUOi9HRrGKAMNBhU0/QL48Egtuwyhtx/HeY9AiAlAxI9axH+
+ITumyg1JQr0nSWcmzJEhfrzvAqZwvzCsLA==
+-----END CERTIFICATE REQUEST-----
diff --git a/libcoap/resources/test-keys/client/client.key.der b/libcoap/resources/test-keys/client/client.key.der
new file mode 100644
index 00000000..291a31ff
Binary files /dev/null and b/libcoap/resources/test-keys/client/client.key.der differ
diff --git a/libcoap/resources/test-keys/client/client.key.pem b/libcoap/resources/test-keys/client/client.key.pem
new file mode 100644
index 00000000..bca2c5b5
--- /dev/null
+++ b/libcoap/resources/test-keys/client/client.key.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIM0eEzfutrQyk7EM69+2RCItCBFRbHXYA4iCu9zrxgRWoAoGCCqGSM49
+AwEHoUQDQgAEgQRwb4u/pg/UBC+jUOeZ1WW/gU2TRDkD3pZkyvCo18CHaQhMQbAr
+fDvPccBCzho6HcanmgOCeZHEYTealotsjg==
+-----END EC PRIVATE KEY-----
diff --git a/libcoap/resources/test-keys/client/client.pub.pem b/libcoap/resources/test-keys/client/client.pub.pem
new file mode 100644
index 00000000..f4e257ee
--- /dev/null
+++ b/libcoap/resources/test-keys/client/client.pub.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEgQRwb4u/pg/UBC+jUOeZ1WW/gU2T
+RDkD3pZkyvCo18CHaQhMQbArfDvPccBCzho6HcanmgOCeZHEYTealotsjg==
+-----END PUBLIC KEY-----
diff --git a/libcoap/resources/test-keys/server/server.crt.der b/libcoap/resources/test-keys/server/server.crt.der
new file mode 100644
index 00000000..5c5eca6b
Binary files /dev/null and b/libcoap/resources/test-keys/server/server.crt.der differ
diff --git a/libcoap/resources/test-keys/server/server.crt.pem b/libcoap/resources/test-keys/server/server.crt.pem
new file mode 100644
index 00000000..90a91f05
--- /dev/null
+++ b/libcoap/resources/test-keys/server/server.crt.pem
@@ -0,0 +1,10 @@
+-----BEGIN CERTIFICATE-----
+MIIBezCCASKgAwIBAgIUctAr0oo1dgxZdkwx4+zSit/RXnkwCgYIKoZIzj0EAwIw
+GTEXMBUGA1UEAwwOY2EuZXhhbXBsZS5jb20wIBcNMjQwOTExMTYxMjA1WhgPMzAy
+NDAxMTMxNjEyMDVaMB0xGzAZBgNVBAMMEnNlcnZlci5leGFtcGxlLmNvbTBZMBMG
+ByqGSM49AgEGCCqGSM49AwEHA0IABBPvpUhW5e+mIPaSt6vpf3DeduFwResl1SG5
+UTBNJaKd9jDeV3esJNDj8DsPPN5zFHiSXAUP882SjF/A+ElfOiGjQjBAMB0GA1Ud
+DgQWBBS4Dx+SL4vI1YTWCzNcBqHTYlQ3pjAfBgNVHSMEGDAWgBQ4qMsFfrh6oS7b
+QNgTeZCm2lmdKzAKBggqhkjOPQQDAgNHADBEAiBiloNtyjnucUjNBk09vG51glPZ
+nPUNKW4bGu4rdcKJ5QIgabg9CKn9WQ1VWOVrPwd6a+fiZU1seYQhYG7JfNmhCsc=
+-----END CERTIFICATE-----
diff --git a/libcoap/resources/test-keys/server/server.csr b/libcoap/resources/test-keys/server/server.csr
new file mode 100644
index 00000000..064dd416
--- /dev/null
+++ b/libcoap/resources/test-keys/server/server.csr
@@ -0,0 +1,7 @@
+-----BEGIN CERTIFICATE REQUEST-----
+MIHYMH8CAQAwHTEbMBkGA1UEAwwSc2VydmVyLmV4YW1wbGUuY29tMFkwEwYHKoZI
+zj0CAQYIKoZIzj0DAQcDQgAEE++lSFbl76Yg9pK3q+l/cN524XBF6yXVIblRME0l
+op32MN5Xd6wk0OPwOw883nMUeJJcBQ/zzZKMX8D4SV86IaAAMAoGCCqGSM49BAMC
+A0kAMEYCIQD97Wzx42WTzRkL1g6GnrIkqIxUSmtM+At6tFfTbgIKrAIhAKjhrAu4
+d3kY08rD4DlCyPHd6ajIe16jpASPddS3czEH
+-----END CERTIFICATE REQUEST-----
diff --git a/libcoap/resources/test-keys/server/server.key.der b/libcoap/resources/test-keys/server/server.key.der
new file mode 100644
index 00000000..f0f03db2
Binary files /dev/null and b/libcoap/resources/test-keys/server/server.key.der differ
diff --git a/libcoap/resources/test-keys/server/server.key.pem b/libcoap/resources/test-keys/server/server.key.pem
new file mode 100644
index 00000000..50b9aad7
--- /dev/null
+++ b/libcoap/resources/test-keys/server/server.key.pem
@@ -0,0 +1,5 @@
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIAj51Zbv9gziVtsxMBReFTU7JNd+n+yIKAh1bnaxgW7ioAoGCCqGSM49
+AwEHoUQDQgAEE++lSFbl76Yg9pK3q+l/cN524XBF6yXVIblRME0lop32MN5Xd6wk
+0OPwOw883nMUeJJcBQ/zzZKMX8D4SV86IQ==
+-----END EC PRIVATE KEY-----
diff --git a/libcoap/resources/test-keys/server/server.pub.pem b/libcoap/resources/test-keys/server/server.pub.pem
new file mode 100644
index 00000000..01c3c5fe
--- /dev/null
+++ b/libcoap/resources/test-keys/server/server.pub.pem
@@ -0,0 +1,4 @@
+-----BEGIN PUBLIC KEY-----
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEE++lSFbl76Yg9pK3q+l/cN524XBF
+6yXVIblRME0lop32MN5Xd6wk0OPwOw883nMUeJJcBQ/zzZKMX8D4SV86IQ==
+-----END PUBLIC KEY-----
diff --git a/libcoap/src/context.rs b/libcoap/src/context.rs
index ed487c4e..48dcd1ec 100644
--- a/libcoap/src/context.rs
+++ b/libcoap/src/context.rs
@@ -9,41 +9,39 @@
 
 //! Module containing context-internal types and traits.
 
-use std::{any::Any, ffi::c_void, fmt::Debug, marker::PhantomData, net::SocketAddr, ops::Sub, time::Duration};
-use std::sync::Once;
+#[cfg(feature = "dtls-pki")]
+use std::ffi::CString;
+#[cfg(dtls)]
+use std::ptr::NonNull;
+use std::{any::Any, ffi::c_void, fmt::Debug, net::SocketAddr, ops::Sub, sync::Once, time::Duration};
+#[cfg(all(feature = "dtls-pki", unix))]
+use std::{os::unix::ffi::OsStrExt, path::Path};
 
 use libc::c_uint;
-
+#[cfg(feature = "dtls-pki")]
+use libcoap_sys::coap_context_set_pki_root_cas;
 use libcoap_sys::{
-    coap_add_resource, coap_bin_const_t, COAP_BLOCK_SINGLE_BODY, COAP_BLOCK_USE_LIBCOAP,
-    coap_can_exit, coap_context_get_csm_max_message_size, coap_context_get_csm_timeout,
+    coap_add_resource, coap_can_exit, coap_context_get_csm_max_message_size, coap_context_get_csm_timeout,
     coap_context_get_max_handshake_sessions, coap_context_get_max_idle_sessions, coap_context_get_session_timeout,
     coap_context_set_block_mode, coap_context_set_csm_max_message_size, coap_context_set_csm_timeout,
-    coap_context_set_keepalive, coap_context_set_max_handshake_sessions, coap_context_set_max_idle_sessions, coap_context_set_psk2,
-    coap_context_set_session_timeout, coap_context_t, coap_dtls_spsk_info_t, COAP_DTLS_SPSK_SETUP_VERSION, coap_dtls_spsk_t, coap_event_t,
-    coap_free_context, coap_get_app_data, coap_io_process, COAP_IO_WAIT, coap_new_context,
-    coap_proto_t, coap_register_event_handler, coap_register_response_handler, coap_set_app_data,
-    coap_startup_with_feature_checks,
+    coap_context_set_keepalive, coap_context_set_max_handshake_sessions, coap_context_set_max_idle_sessions,
+    coap_context_set_session_timeout, coap_context_t, coap_event_t, coap_free_context, coap_get_app_data,
+    coap_io_process, coap_new_context, coap_proto_t, coap_register_event_handler, coap_register_response_handler,
+    coap_set_app_data, coap_startup_with_feature_checks, COAP_BLOCK_SINGLE_BODY, COAP_BLOCK_USE_LIBCOAP, COAP_IO_WAIT,
 };
 
-#[cfg(feature = "dtls")]
+#[cfg(any(feature = "dtls-rpk", feature = "dtls-pki"))]
+use crate::crypto::pki_rpk::ServerPkiRpkCryptoContext;
+#[cfg(feature = "dtls-psk")]
+use crate::crypto::psk::ServerPskContext;
 use crate::{
-    error::{ContextCreationError, EndpointCreationError, IoProcessError},
+    error::{ContextConfigurationError, EndpointCreationError, IoProcessError},
+    event::{event_handler_callback, CoapEventHandler},
+    mem::{CoapLendableFfiRcCell, CoapLendableFfiWeakCell, DropInnerExclusively},
     resource::{CoapResource, UntypedCoapResource},
-    session::session_response_handler,
+    session::{session_response_handler, CoapServerSession, CoapSession},
+    transport::CoapEndpoint,
 };
-#[cfg(feature = "dtls")]
-use crate::crypto::{CoapServerCryptoProvider, dtls_server_id_callback};
-#[cfg(feature = "dtls")]
-use crate::crypto::{CoapCryptoProviderResponse, CoapCryptoPskIdentity, CoapCryptoPskInfo};
-#[cfg(not(feature = "dtls_tinydtls"))]
-use crate::crypto::dtls_server_sni_callback;
-use crate::event::{CoapEventHandler, event_handler_callback};
-use crate::mem::{CoapLendableFfiRcCell, CoapLendableFfiWeakCell, DropInnerExclusively};
-use crate::session::CoapServerSession;
-use crate::session::CoapSession;
-use crate::session::CoapSessionCommon;
-use crate::transport::CoapEndpoint;
 
 static COAP_STARTUP_ONCE: Once = Once::new();
 
@@ -64,27 +62,12 @@ struct CoapContextInner<'a> {
     server_sessions: Vec<CoapServerSession<'a>>,
     /// The event handler responsible for library-user side handling of events.
     event_handler: Option<Box<dyn CoapEventHandler>>,
-    /// The provider for cryptography information for server-side sessions.
-    #[cfg(feature = "dtls")]
-    crypto_provider: Option<Box<dyn CoapServerCryptoProvider>>,
-    /// Last default cryptography info provided to libcoap.
-    #[cfg(feature = "dtls")]
-    crypto_default_info: Option<CoapCryptoPskInfo>,
-    /// Container for SNI information so that the libcoap C library can keep referring to the memory
-    /// locations.
-    #[cfg(feature = "dtls")]
-    crypto_sni_info_container: Vec<CoapCryptoPskInfo>,
-    /// Last provided cryptography information for server-side sessions (temporary storage as
-    /// libcoap makes defensive copies).
-    #[cfg(feature = "dtls")]
-    crypto_current_data: Option<CoapCryptoPskInfo>,
-    /// Structure referring to the last provided cryptography information for server-side sessions.
-    /// coap_dtls_spsk_info_t created upon calling dtls_server_sni_callback() as the SNI validation callback.
-    /// The caller of the validate_sni_call_back will make a defensive copy, so this one only has
-    /// to be valid for a very short time and can always be overridden by dtls_server_sni_callback().
-    #[cfg(feature = "dtls")]
-    crypto_last_info_ref: coap_dtls_spsk_info_t,
-    _context_lifetime_marker: PhantomData<&'a coap_context_t>,
+    /// PSK context for encrypted server-side sessions.
+    #[cfg(feature = "dtls-psk")]
+    psk_context: Option<ServerPskContext<'a>>,
+    /// PKI context for encrypted server-side sessions.
+    #[cfg(any(feature = "dtls-pki", feature = "dtls-rpk"))]
+    pki_rpk_context: Option<ServerPkiRpkCryptoContext<'a>>,
 }
 
 /// A CoAP Context — container for general state and configuration information relating to CoAP
@@ -101,13 +84,13 @@ impl<'a> CoapContext<'a> {
     /// # Errors
     /// Returns an error if the underlying libcoap library was unable to create a new context
     /// (probably an allocation error?).
-    pub fn new() -> Result<CoapContext<'a>, ContextCreationError> {
+    pub fn new() -> Result<CoapContext<'a>, ContextConfigurationError> {
         ensure_coap_started();
         // SAFETY: Providing null here is fine, the context will just not be bound to an endpoint
         // yet.
         let raw_context = unsafe { coap_new_context(std::ptr::null()) };
         if raw_context.is_null() {
-            return Err(ContextCreationError::Unknown);
+            return Err(ContextConfigurationError::Unknown);
         }
         // SAFETY: We checked that raw_context is not null.
         unsafe {
@@ -129,26 +112,10 @@ impl<'a> CoapContext<'a> {
             resources: Vec::new(),
             server_sessions: Vec::new(),
             event_handler: None,
-            #[cfg(feature = "dtls")]
-            crypto_provider: None,
-            #[cfg(feature = "dtls")]
-            crypto_default_info: None,
-            #[cfg(feature = "dtls")]
-            crypto_sni_info_container: Vec::new(),
-            #[cfg(feature = "dtls")]
-            crypto_current_data: None,
-            #[cfg(feature = "dtls")]
-            crypto_last_info_ref: coap_dtls_spsk_info_t {
-                hint: coap_bin_const_t {
-                    length: 0,
-                    s: std::ptr::null(),
-                },
-                key: coap_bin_const_t {
-                    length: 0,
-                    s: std::ptr::null(),
-                },
-            },
-            _context_lifetime_marker: Default::default(),
+            #[cfg(feature = "dtls-psk")]
+            psk_context: None,
+            #[cfg(any(feature = "dtls-pki", feature = "dtls-rpk"))]
+            pki_rpk_context: None,
         });
 
         // SAFETY: We checked that the raw context is not null, the provided function is valid and
@@ -245,6 +212,134 @@ impl<'a> CoapContext<'a> {
             }
         }
     }
+
+    /// Sets the server-side cryptography information provider.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ContextConfigurationError::Unknown`] if the call to the underlying libcoap library
+    /// function fails and [`ContextConfigurationError::CryptoContextAlreadySet`] if the PSK context
+    /// has already been set previously.
+    #[cfg(feature = "dtls-psk")]
+    pub fn set_psk_context(&mut self, psk_context: ServerPskContext<'a>) -> Result<(), ContextConfigurationError> {
+        let mut inner = self.inner.borrow_mut();
+        if inner.psk_context.is_some() {
+            return Err(ContextConfigurationError::CryptoContextAlreadySet);
+        }
+        inner.psk_context = Some(psk_context);
+        // SAFETY: raw context is valid, we ensure that an already set encryption context will not
+        // be overwritten, and the raw coap_context_t is cleaned up before the encryption context is
+        // dropped (ensuring the encryption context outlives the CoAP context).
+        unsafe {
+            inner
+                .psk_context
+                .as_ref()
+                .unwrap()
+                .apply_to_context(NonNull::new(inner.raw_context).unwrap())
+        }
+    }
+
+    /// Sets the server-side cryptography information provider.
+    ///
+    /// # Errors
+    ///
+    /// Returns [`ContextConfigurationError::Unknown`] if the call to the underlying libcoap library
+    /// function fails and [`ContextConfigurationError::CryptoContextAlreadySet`] if the PSK context
+    /// has already been set previously.
+    #[cfg(any(feature = "dtls-pki", feature = "dtls-rpk"))]
+    pub fn set_pki_rpk_context(
+        &mut self,
+        pki_context: impl Into<ServerPkiRpkCryptoContext<'a>>,
+    ) -> Result<(), ContextConfigurationError> {
+        let mut inner = self.inner.borrow_mut();
+        if inner.pki_rpk_context.is_some() {
+            return Err(ContextConfigurationError::CryptoContextAlreadySet);
+        }
+        inner.pki_rpk_context = Some(pki_context.into());
+        // SAFETY: raw context is valid, we ensure that an already set encryption context will not
+        // be overwritten, and the raw coap_context_t is cleaned up before the encryption context is
+        // dropped (ensuring the encryption context outlives the CoAP context).
+        unsafe {
+            inner
+                .pki_rpk_context
+                .as_ref()
+                .unwrap()
+                .apply_to_context(NonNull::new(inner.raw_context).unwrap())
+        }
+    }
+
+    /// Convenience wrapper around [`set_pki_root_cas`](CoapContext::set_pki_root_cas) that can be
+    /// provided with any type that implements `AsRef<Path>`.
+    ///
+    /// `ca_file` should be the full path of a PEM-encoded file containing all root CAs to be used
+    /// or `None`, `ca_dir` should be a directory path containing PEM-encoded CA certificates to
+    /// be used or `None`.
+    ///
+    /// As not all implementations of [`OsString`] (which is the basis of [`Path`]) provide
+    /// conversions to non-zero byte sequences, this function is only available on Unix.
+    /// On other operating systems, perform manual conversion of paths into [`CString`] and call
+    /// [`set_pki_root_cas`](CoapContext::set_pki_root_cas) directly instead.
+    ///
+    /// See the Rust standard library documentation on [FFI conversions](https://doc.rust-lang.org/std/ffi/index.html#conversions])
+    /// and the [`OsString` type](https://doc.rust-lang.org/std/ffi/struct.OsString.html) for more
+    /// information.
+    ///
+    /// # Errors
+    /// Will return [`ContextConfigurationError::Unknown`] if the call to the underlying libcoap
+    /// function fails (indicating an error in either libcoap or the underlying TLS library).
+    #[cfg(all(feature = "dtls-pki", unix))]
+    pub fn set_pki_root_ca_paths(
+        &mut self,
+        ca_file: Option<impl AsRef<Path>>,
+        ca_dir: Option<impl AsRef<Path>>,
+    ) -> Result<(), ContextConfigurationError> {
+        let ca_file = ca_file.as_ref().map(|v| {
+            let v = v.as_ref();
+            assert!(v.is_file(), "attempted to set non-file as CA file for libcoap");
+            // Unix paths never contain null bytes, so we can unwrap here.
+            CString::new(v.as_os_str().as_bytes()).unwrap()
+        });
+        let ca_dir = ca_dir.as_ref().map(|v| {
+            let v = v.as_ref();
+            assert!(v.is_dir(), "attempted to set non-directory as CA directory for libcoap");
+            // Unix paths never contain null bytes, so we can unwrap here.
+            CString::new(v.as_os_str().as_bytes()).unwrap()
+        });
+
+        self.set_pki_root_cas(ca_file, ca_dir)
+    }
+
+    /// Sets the path to a CA certificate file and/or a directory of CA certificate files that
+    /// should be used as this context's default root CA information.
+    ///
+    /// `ca_file` should be the full path of a PEM-encoded file containing all root CAs to be used
+    /// or `None`, `ca_dir` should be a directory path containing PEM-encoded CA certificates to
+    /// be used or `None`.
+    ///
+    /// # Errors
+    /// Will return [`ContextConfigurationError::Unknown`] if the call to the underlying libcoap
+    /// function fails (indicating an error in either libcoap or the underlying TLS library).
+    #[cfg(feature = "dtls-pki")]
+    pub fn set_pki_root_cas(
+        &mut self,
+        ca_file: Option<CString>,
+        ca_dir: Option<CString>,
+    ) -> Result<(), ContextConfigurationError> {
+        let inner = self.inner.borrow();
+
+        let result = unsafe {
+            coap_context_set_pki_root_cas(
+                inner.raw_context,
+                ca_file.as_ref().map(|v| v.as_ptr()).unwrap_or(std::ptr::null()),
+                ca_dir.as_ref().map(|v| v.as_ptr()).unwrap_or(std::ptr::null()),
+            )
+        };
+        if result == 1 {
+            Ok(())
+        } else {
+            Err(ContextConfigurationError::Unknown)
+        }
+    }
 }
 
 impl CoapContext<'_> {
@@ -286,21 +381,21 @@ impl CoapContext<'_> {
     /// Creates a new DTLS endpoint that is bound to the given address.
     ///
     /// Note that in order to actually connect to DTLS clients, you need to set a crypto provider
-    /// using [set_server_crypto_provider()](CoapContext::set_server_crypto_provider())
-    #[cfg(feature = "dtls")]
+    /// using [CoapContext::set_psk_context] and/or [CoapContext::set_pki_rpk_context].
+    #[cfg(dtls)]
     pub fn add_endpoint_dtls(&mut self, addr: SocketAddr) -> Result<(), EndpointCreationError> {
         self.add_endpoint(addr, coap_proto_t::COAP_PROTO_DTLS)
     }
 
-    /// TODO
-    #[cfg(all(feature = "tcp", feature = "dtls"))]
-    pub fn add_endpoint_tls(&mut self, _addr: SocketAddr) -> Result<(), EndpointCreationError> {
-        todo!()
-        // TODO: self.add_endpoint(addr, coap_proto_t::COAP_PROTO_TLS)
-    }
+    // /// TODO
+    // #[cfg(all(feature = "tcp", dtls))]
+    // pub fn add_endpoint_tls(&mut self, _addr: SocketAddr) -> Result<(), EndpointCreationError> {
+    //     todo!()
+    //     // TODO: self.add_endpoint(addr, coap_proto_t::COAP_PROTO_TLS)
+    // }
 
     /// Adds the given resource to the resource pool of this context.
-    pub fn add_resource<D: Any + ?Sized + Debug>(&mut self, res: CoapResource<D>) {
+    pub fn add_resource<D: Any+?Sized+Debug>(&mut self, res: CoapResource<D>) {
         let mut inner_ref = self.inner.borrow_mut();
         inner_ref.resources.push(Box::new(res));
         // SAFETY: raw context is valid, raw resource is also guaranteed to be valid as long as
@@ -313,59 +408,6 @@ impl CoapContext<'_> {
         };
     }
 
-    /// Sets the server-side cryptography information provider.
-    #[cfg(feature = "dtls")]
-    pub fn set_server_crypto_provider(&mut self, provider: Option<Box<dyn CoapServerCryptoProvider>>) {
-        let mut inner_ref = self.inner.borrow_mut();
-        // TODO replace Option<Box<Something>> with Option<Borrow<Something>> in libcoap-rs to simplify API.
-        inner_ref.crypto_provider = provider;
-        if let Some(provider) = &mut inner_ref.crypto_provider {
-            inner_ref.crypto_default_info = Some(provider.provide_default_info());
-            let initial_data = coap_dtls_spsk_info_t {
-                hint: coap_bin_const_t {
-                    length: inner_ref.crypto_default_info.as_ref().unwrap().key.len(),
-                    s: inner_ref.crypto_default_info.as_ref().unwrap().key.as_ptr(),
-                },
-                key: coap_bin_const_t {
-                    length: inner_ref.crypto_default_info.as_ref().unwrap().key.len(),
-                    s: inner_ref.crypto_default_info.as_ref().unwrap().key.as_ptr(),
-                },
-            };
-            // SAFETY: raw context is valid, setup_data is of the right type and contains
-            // only valid information.
-            unsafe {
-                coap_context_set_psk2(
-                    inner_ref.raw_context,
-                    Box::into_raw(Box::new(coap_dtls_spsk_t {
-                        version: COAP_DTLS_SPSK_SETUP_VERSION as u8,
-                        #[cfg(not(dtls_ec_jpake_support))]
-                        reserved: [0; 7],
-                        #[cfg(dtls_ec_jpake_support)]
-                        reserved: [0; 6],
-                        #[cfg(dtls_ec_jpake_support)]
-                        // TODO(#30) allow enabling this
-                        ec_jpake: 0,
-                        validate_id_call_back: Some(dtls_server_id_callback),
-                        id_call_back_arg: inner_ref.raw_context as *mut c_void,
-                        validate_sni_call_back: {
-                            // Unsupported by TinyDTLS
-                            #[cfg(not(feature = "dtls_tinydtls"))]
-                            {
-                                Some(dtls_server_sni_callback)
-                            }
-                            #[cfg(feature = "dtls_tinydtls")]
-                            {
-                                None
-                            }
-                        },
-                        sni_call_back_arg: inner_ref.raw_context as *mut c_void,
-                        psk_info: initial_data,
-                    })),
-                )
-            };
-        }
-    }
-
     /// Performs currently outstanding IO operations, waiting for a maximum duration of `timeout`.
     ///
     /// This is the function where most of the IO operations made using this library are actually
@@ -547,93 +589,6 @@ impl CoapContext<'_> {
         };
     }
 
-    /// Provide a raw key for a given identity using the CoapContext's set server crypto provider.
-    ///
-    /// # Safety
-    /// Returned pointer should only be used if the context is borrowed.
-    /// Calling this function may override previous returned values of this function.
-    #[cfg(feature = "dtls")]
-    pub(crate) unsafe fn provide_raw_key_for_identity(
-        &self,
-        identity: &CoapCryptoPskIdentity,
-        session: &CoapServerSession,
-    ) -> Option<*const coap_bin_const_t> {
-        let inner_ref = &mut *self.inner.borrow_mut();
-        match inner_ref
-            .crypto_provider
-            .as_mut()
-            .map(|v| v.provide_key_for_identity(identity))
-        {
-            Some(CoapCryptoProviderResponse::UseNew(new_data)) => {
-                inner_ref.crypto_current_data = Some(CoapCryptoPskInfo {
-                    identity: Box::from(identity),
-                    key: new_data,
-                });
-                let curr_data = inner_ref.crypto_current_data.as_ref().unwrap();
-                curr_data.apply_to_spsk_info(&mut inner_ref.crypto_last_info_ref);
-                Some(&inner_ref.crypto_last_info_ref.key as *const coap_bin_const_t)
-            },
-            Some(CoapCryptoProviderResponse::UseCurrent) => {
-                if let Some(key) = session.psk_key() {
-                    inner_ref.crypto_current_data = Some(CoapCryptoPskInfo {
-                        identity: Box::new([]),
-                        key,
-                    });
-                    inner_ref
-                        .crypto_current_data
-                        .as_ref()
-                        .unwrap()
-                        .apply_to_spsk_info(&mut inner_ref.crypto_last_info_ref);
-                    Some(&inner_ref.crypto_last_info_ref.key)
-                } else if inner_ref.crypto_default_info.is_some() {
-                    inner_ref
-                        .crypto_default_info
-                        .as_ref()
-                        .unwrap()
-                        .apply_to_spsk_info(&mut inner_ref.crypto_last_info_ref);
-                    Some(&inner_ref.crypto_last_info_ref.key)
-                } else {
-                    None
-                }
-            },
-            None | Some(CoapCryptoProviderResponse::Unacceptable) => None,
-        }
-    }
-
-    /// Provide a hint for a given SNI name using the CoapContext's set server crypto provider.
-    ///
-    /// # Safety
-    /// Returned pointer should only be used if the context is borrowed.
-    /// Calling this function may override previous returned values of this function.
-    #[cfg(all(feature = "dtls"))]
-    pub(crate) unsafe fn provide_raw_hint_for_sni(&self, sni: &str) -> Option<*const coap_dtls_spsk_info_t> {
-        let inner_ref = &mut *self.inner.borrow_mut();
-        match inner_ref.crypto_provider.as_mut().map(|v| v.provide_hint_for_sni(sni)) {
-            Some(CoapCryptoProviderResponse::UseNew(new_info)) => {
-                inner_ref.crypto_sni_info_container.push(new_info);
-                inner_ref
-                    .crypto_sni_info_container
-                    .last()
-                    .unwrap()
-                    .apply_to_spsk_info(&mut inner_ref.crypto_last_info_ref);
-                Some(&inner_ref.crypto_last_info_ref as *const coap_dtls_spsk_info_t)
-            },
-            Some(CoapCryptoProviderResponse::UseCurrent) => {
-                if inner_ref.crypto_default_info.is_some() {
-                    inner_ref
-                        .crypto_default_info
-                        .as_ref()
-                        .unwrap()
-                        .apply_to_spsk_info(&mut inner_ref.crypto_last_info_ref);
-                    Some(&inner_ref.crypto_last_info_ref as *const coap_dtls_spsk_info_t)
-                } else {
-                    None
-                }
-            },
-            None | Some(CoapCryptoProviderResponse::Unacceptable) => None,
-        }
-    }
-
     /// Returns a reference to the raw context contained in this struct.
     ///
     /// # Safety
diff --git a/libcoap/src/crypto.rs b/libcoap/src/crypto.rs
deleted file mode 100644
index 1cab0d01..00000000
--- a/libcoap/src/crypto.rs
+++ /dev/null
@@ -1,185 +0,0 @@
-// SPDX-License-Identifier: BSD-2-Clause
-/*
- * crypto.rs - CoAP cryptography provider interfaces and types.
- * This file is part of the libcoap-rs crate, see the README and LICENSE files for
- * more information and terms of use.
- * Copyright © 2021-2023 The NAMIB Project Developers, all rights reserved.
- * See the README as well as the LICENSE file for more information.
- */
-
-//! Cryptography provider interfaces and types
-
-use std::{
-    ffi::{c_void, CStr},
-    fmt::Debug,
-    os::raw::c_char,
-};
-
-use libcoap_sys::{
-    coap_bin_const_t, coap_context_t, coap_dtls_cpsk_info_t, coap_dtls_spsk_info_t, coap_session_t, coap_str_const_t,
-};
-
-use crate::{context::CoapContext, session::CoapClientSession};
-use crate::session::CoapServerSession;
-
-/// Representation of cryptographic information used by a server.
-#[derive(Debug, Clone, PartialEq, Eq)]
-#[cfg(feature = "dtls")]
-pub struct CoapCryptoPskInfo {
-    /// The identity hint to return to the client.
-    pub identity: Box<CoapCryptoPskIdentity>,
-    /// The pre-shared-key that belongs to this identity hint.
-    pub key: Box<CoapCryptoPskData>,
-}
-
-#[cfg(feature = "dtls")]
-impl CoapCryptoPskInfo {
-    /// Apply this key information to a coap_dtls_cpsk_info_t struct for use in libcoap.
-    pub fn apply_to_cpsk_info(&self, info: &mut coap_dtls_cpsk_info_t) {
-        info.identity.s = self.identity.as_ptr();
-        info.identity.length = self.identity.len();
-        info.key.s = self.key.as_ptr();
-        info.key.length = self.key.len();
-    }
-
-    /// Apply this key information to a coap_dtls_spsk_info_t struct for use in libcoap.
-    pub fn apply_to_spsk_info(&self, info: &mut coap_dtls_spsk_info_t) {
-        info.hint.s = self.identity.as_ptr();
-        info.hint.length = self.identity.len();
-        info.key.s = self.key.as_ptr();
-        info.key.length = self.key.len();
-    }
-}
-
-#[cfg(feature = "dtls")]
-pub type CoapCryptoPskIdentity = [u8];
-#[cfg(feature = "dtls")]
-pub type CoapCryptoPskData = [u8];
-
-/// Type representing a possible return value of a cryptographic credential provider.
-///
-/// Most functions implemented in CoapCryptoProvider can return one of three possible responses,
-/// which are represented by this enum.
-#[derive(Clone, Debug, PartialEq, Eq)]
-#[cfg(feature = "dtls")]
-pub enum CoapCryptoProviderResponse<T: Debug> {
-    /// The current key (as indicated by a previous callback such as
-    /// [CoapClientCryptoProvider::provide_default_info()]) is sufficient and should be used for this
-    /// session.
-    UseCurrent,
-    /// A new set of cryptographic credentials should be used for this session.
-    UseNew(T),
-    /// According to the provided information, the cryptographic material of the peer is
-    /// unacceptable (=> (D-)TLS Handshake Failure).
-    Unacceptable,
-}
-
-/// Trait implemented by types that can provide cryptographic information to CoapContexts and
-/// associated sessions when needed.
-#[cfg(feature = "dtls")]
-pub trait CoapClientCryptoProvider: Debug {
-    /// Provide the appropriate cryptographic information for the given hint supplied by the server.
-    ///
-    /// Return a CoapCryptoProviderResponse corresponding to the cryptographic information that
-    /// should be used.
-    ///
-    /// Note: Unsupported by the MBedTLS DTLS backend.
-    fn provide_key_for_hint(
-        &mut self,
-        hint: &CoapCryptoPskIdentity,
-    ) -> CoapCryptoProviderResponse<Box<CoapCryptoPskData>>;
-
-    /// Provide the initial cryptographic information for client-side sessions associated with this
-    /// provider.
-    fn provide_default_info(&mut self) -> CoapCryptoPskInfo;
-}
-
-#[cfg(feature = "dtls")]
-pub trait CoapServerCryptoProvider: Debug {
-    /// Provide the appropiate cryptographic information for the given key identity supplied by the
-    /// client.
-    ///
-    /// Return a CoapCryptoProviderResponse corresponding to the cryptographic information that
-    /// should be used.
-    #[allow(unused_variables)]
-    fn provide_key_for_identity(
-        &mut self,
-        identity: &CoapCryptoPskIdentity,
-    ) -> CoapCryptoProviderResponse<Box<CoapCryptoPskData>> {
-        CoapCryptoProviderResponse::UseCurrent
-    }
-
-    /// Provide the appropriate key hint and data for the given SNI provided by the client.
-    ///
-    /// This function will only be called once per SNI hint, libcoap will remember the returned
-    /// hint.
-    ///
-    /// Return None if the provided SNI is unacceptable, i.e. you have no key for this server name.
-    ///
-    /// Note: Unsupported by the TinyDTLS DTLS backend.
-    #[allow(unused_variables)]
-    fn provide_hint_for_sni(&mut self, sni: &str) -> CoapCryptoProviderResponse<CoapCryptoPskInfo> {
-        CoapCryptoProviderResponse::UseCurrent
-    }
-
-    /// Provide the default PSK identity hint and key data that should be used for new server-side
-    /// sessions.
-    ///
-    /// Return a CoapCryptoProviderResponse corresponding to the cryptographic information that
-    /// should be used.
-    fn provide_default_info(&mut self) -> CoapCryptoPskInfo;
-}
-
-// TODO DTLS PKI/RPK
-
-// DTLS Identity Hint callback is unsupported on mbedtls
-#[cfg(feature = "dtls")]
-pub(crate) unsafe extern "C" fn dtls_ih_callback(
-    hint: *mut coap_str_const_t,
-    session: *mut coap_session_t,
-    _userdata: *mut c_void,
-) -> *const coap_dtls_cpsk_info_t {
-    let mut session = CoapClientSession::from_raw(session);
-    let provided_identity = std::slice::from_raw_parts((*hint).s, (*hint).length);
-    session
-        .provide_raw_key_for_hint(provided_identity)
-        .map(|v| v)
-        .unwrap_or(std::ptr::null())
-}
-
-#[cfg(feature = "dtls")]
-pub(crate) unsafe extern "C" fn dtls_server_id_callback(
-    identity: *mut coap_bin_const_t,
-    session: *mut coap_session_t,
-    userdata: *mut c_void,
-) -> *const coap_bin_const_t {
-    let context = CoapContext::from_raw(userdata as *mut coap_context_t);
-    let provided_identity = std::slice::from_raw_parts((*identity).s, (*identity).length);
-    // We must not increase the refcount here, as doing so would require locking the global context,
-    // which is not possible during a DTLS callback.
-    // SAFETY: While we are in this callback, libcoap's context is locked by our current thread.
-    //         therefore, it is impossible that the reference counter would be decreased by any
-    //         other means, and constructing the server side session without increasing the refcount
-    //         is fine.
-    let session = CoapServerSession::from_raw_without_refcount(session);
-    let key = context.provide_raw_key_for_identity(provided_identity, &session);
-    key.unwrap_or(std::ptr::null())
-}
-
-#[cfg(feature = "dtls")]
-pub(crate) unsafe extern "C" fn dtls_server_sni_callback(
-    sni: *const c_char,
-    _session: *mut coap_session_t,
-    userdata: *mut c_void,
-) -> *const coap_dtls_spsk_info_t {
-    let context = CoapContext::from_raw(userdata as *mut coap_context_t);
-    let sni_value = CStr::from_ptr(sni).to_str();
-    if let Ok(sni_value) = sni_value {
-        context
-            .provide_raw_hint_for_sni(sni_value)
-            .map(|v| (v))
-            .unwrap_or(std::ptr::null())
-    } else {
-        std::ptr::null()
-    }
-}
diff --git a/libcoap/src/crypto/mod.rs b/libcoap/src/crypto/mod.rs
new file mode 100644
index 00000000..7425a6f4
--- /dev/null
+++ b/libcoap/src/crypto/mod.rs
@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * crypto/mod.rs - CoAP cryptography provider interfaces and types.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+//! Cryptography interfaces and types.
+//!
+//! Currently, libcoap supports four different types of encrypted communications:
+//! - (D)TLS using pre-shared keys (PSK): The simplest method, uses a symmetric/pre-shared key to
+//!   perform authentication (see [RFC 4279](https://datatracker.ietf.org/doc/html/rfc4279)).
+//! - (D)TLS using raw public keys (RPK): Uses asymmetric key pairs for authentication. The peer's
+//!   public key must be known in advance and must be validated by the library user.
+//! - (D)TLS using a public key infrastructure (PKI): Uses asymmetric key pairs signed by a
+//!   certificate authority, which are authenticated by the TLS library using a set of
+//!   pre-configured (or provided) root certificate authorities (the way most of the internet works).
+//! - OSCORE (*unsupported by libcoap-rs, see
+//!   [issue #23](https://github.com/namib-project/libcoap-rs/issues/23)*): Uses Object Security for
+//!   Constrained RESTful Environments (OSCORE, [RFC 8613](https://datatracker.ietf.org/doc/html/rfc8613)) to encrypt messages on the application
+//!   layer.
+//!
+//! # Configuration
+//!
+//! Logically, `libcoap` provides two different structures for DTLS configuration: One for PSK
+//! configuration and another one for both PKI and RPK configurations.
+//! Each of these DTLS contexts may be provided to either a
+//! [`CoapClientSession`](crate::session::CoapClientSession) on construction or be attached to a
+//! [`CoapContext`](crate::CoapContext) for server-side use.
+//!
+//! A client-side session can only be configured with _either_ a PKI/RPK configuration _or_ a PSK
+//! configuration, i.e., you must know in advance which type of encryption to use.
+//! The [`CoapContext`](crate::CoapContext) can be configured with both a server-side PKI/RPK
+//! configuration _and_ a PSK configuration, but only with one of each type, i.e., you can support
+//! both PSK and RPK/PKI, but not both RPK and PKI simultaneously, as the RPK/PKI configuration
+//! object can only be configured to enable _either_ PKI _or_ RPK.
+//!
+//! For more information on how to configure the different types of encryption, see the module-level
+//! documentation for the [PKI/RPK](pki_rpk) and [PSK](psk) submodules.
+//!
+//! You may also refer to the [libcoap documentation on encryption](https://libcoap.net/doc/reference/develop/man_coap_encryption.html)
+//! for supplementary information.
+//!
+//! # Compilation and TLS library support
+//!
+//! Support for DTLS requires the `dtls-rpk`, `dtls-pki`, or `dtls-psk` features to be enabled,
+//! depending on the DTLS variants you wish to support.
+//!
+//! libcoap may be built with different TLS libraries as backends, and support for the different
+//! variants of DTLS and certain features within those may differ between libraries.
+//! Assuming you have not called any unsafe functions that circumvent this check, enabling one of
+//! the three DTLS variant features while using a TLS library that does not support this feature
+//! will result in either a compilation error or a panic on when calling [`CoapContext::new`](crate::CoapContext::new),
+//! irrespective of whether you actually use DTLS.
+
+#[cfg(any(feature = "dtls-rpk", feature = "dtls-pki"))]
+pub mod pki_rpk;
+#[cfg(feature = "dtls-psk")]
+pub mod psk;
+
+use std::fmt::Debug;
+
+/// Client-side context for cryptography.
+///
+/// Can be provided to a client-side session constructor for encrypted sessions (such as
+/// [`CoapClientSession::connect_dtls`](crate::session::CoapClientSession::connect_dtls)).
+///
+/// The available enum variants depend on the enabled DTLS features (`dtls-psk`, `dtls-pki`, and/or
+/// `dtls-rpk`).
+#[derive(Clone, Debug)]
+pub enum ClientCryptoContext<'a> {
+    /// Context for a client-side DTLS session with pre-shared keys.
+    #[cfg(feature = "dtls-psk")]
+    Psk(psk::ClientPskContext<'a>),
+    /// Context for a client-side DTLS session using a public key infrastructure for certificate
+    /// validation.
+    #[cfg(feature = "dtls-pki")]
+    Pki(pki_rpk::PkiRpkContext<'a, pki_rpk::Pki>),
+    /// Context for a client-side DTLS session using raw public keys.
+    #[cfg(feature = "dtls-rpk")]
+    Rpk(pki_rpk::PkiRpkContext<'a, pki_rpk::Rpk>),
+}
diff --git a/libcoap/src/crypto/pki_rpk/key.rs b/libcoap/src/crypto/pki_rpk/key.rs
new file mode 100644
index 00000000..036200d5
--- /dev/null
+++ b/libcoap/src/crypto/pki_rpk/key.rs
@@ -0,0 +1,256 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * crypto/pki_rpk/key.rs - Interfaces and types for PKI/RPK keys in libcoap-rs.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+use libcoap_sys::{
+    coap_asn1_privatekey_type_t, coap_const_char_ptr_t, coap_dtls_key_t, coap_dtls_pki_t, coap_pki_define_t,
+};
+use num_derive::FromPrimitive;
+use num_traits::FromPrimitive;
+use std::ffi::CString;
+use std::fmt::Debug;
+#[cfg(unix)]
+use std::os::unix::ffi::OsStrExt;
+use std::path::Path;
+
+/// Trait for marker structs that describe different types of asymmetric DTLS keys (RPK or PKI).
+#[allow(private_bounds)]
+pub trait KeyType: KeyTypeSealed {}
+
+/// Sealed trait for key types.
+pub(super) trait KeyTypeSealed: Debug {
+    /// Applies default settings for this key type to the given encryption context `ctx`.
+    fn set_key_type_defaults(ctx: &mut coap_dtls_pki_t);
+}
+
+impl<T: KeyTypeSealed> KeyType for T {}
+
+/// Trait for types that can be used as a libcoap DTLS asymmetric key definition (RPK or PKI).
+#[allow(private_bounds)]
+pub trait KeyDef: KeyDefSealed {
+    /// The key type of this key definition.
+    type KeyType: KeyType;
+}
+
+/// Sealed trait for key definitions.
+pub(crate) trait KeyDefSealed: Debug {
+    /// Creates a raw key definition based on this key definition.
+    ///
+    /// **Important:** The returned raw definition refers to memory owned by `self`.
+    /// While this function alone can not cause undefined behavior (and is therefore not `unsafe`),
+    /// anything that dereferences the pointers stored in the returned [`coap_dtls_key_t`] (which is
+    /// itself only possible in `unsafe` code) after `self` has been dropped will cause Undefined
+    /// Behavior.
+    fn as_raw_dtls_key(&self) -> coap_dtls_key_t;
+}
+
+/// Trait for types that can be converted to components of an asymmetric DTLS key.
+pub(super) trait AsRawKeyComponent: Sized + Debug {
+    /// Returns a raw [`coap_const_char_ptr_t`] pointing to this key component and a `usize`
+    /// indicating the length of this key component (or `0` if this key type is supposed to be a
+    /// null-terminated string).
+    ///
+    /// **Important:** The returned raw definition refers to memory owned by `self`.
+    /// While this function alone can not cause undefined behavior (and is therefore not `unsafe`),
+    /// anything that dereferences the returned [`coap_const_char_ptr_t`] (which is itself only
+    /// possible in `unsafe` code) after `self` has been dropped will cause Undefined Behavior.
+    fn as_raw_key_component(&self) -> (coap_const_char_ptr_t, usize);
+}
+
+/// Sealed trait for components of an asymmetric DTLS key of the given [`KeyType`] `KTY`.
+pub(super) trait KeyComponentSealed<KTY: KeyType>: AsRawKeyComponent {
+    /// The raw [`coap_pki_define_t`] indicating the type of this key component that should be used
+    /// when using it in a key definition of type `KTY`.
+    const DEFINE_TYPE: coap_pki_define_t;
+}
+
+/// Trait indicating that a type can be used as a DTLS key component of the given [`KeyType`] `KTY`.
+#[allow(private_bounds)]
+pub trait KeyComponent<KTY: KeyType>: KeyComponentSealed<KTY> {}
+
+impl<KTY: KeyType, T: KeyComponentSealed<KTY>> KeyComponent<KTY> for T {}
+
+/// Key component that is stored in a PEM-encoded file with the given path.
+#[derive(Clone, Debug)]
+pub struct PemFileKeyComponent(CString);
+
+impl AsRawKeyComponent for PemFileKeyComponent {
+    fn as_raw_key_component(&self) -> (coap_const_char_ptr_t, usize) {
+        (
+            coap_const_char_ptr_t {
+                s_byte: self.0.as_ptr(),
+            },
+            0,
+        )
+    }
+}
+
+#[cfg(unix)]
+impl<T: AsRef<Path>> From<T> for PemFileKeyComponent {
+    fn from(value: T) -> Self {
+        // File paths never contain null-bytes on unix, so we can unwrap here.
+        PemFileKeyComponent(CString::new(value.as_ref().as_os_str().as_bytes()).unwrap())
+    }
+}
+
+/// Key component that is stored in memory as a PEM-encoded sequence of bytes.
+#[derive(Clone, Debug)]
+pub struct PemMemoryKeyComponent(Box<[u8]>);
+
+impl<T: Into<Vec<u8>>> From<T> for PemMemoryKeyComponent {
+    fn from(value: T) -> Self {
+        PemMemoryKeyComponent(value.into().into_boxed_slice())
+    }
+}
+
+impl AsRawKeyComponent for PemMemoryKeyComponent {
+    fn as_raw_key_component(&self) -> (coap_const_char_ptr_t, usize) {
+        (
+            coap_const_char_ptr_t {
+                u_byte: self.0.as_ptr(),
+            },
+            self.0.len(),
+        )
+    }
+}
+
+/// Key component that is stored in a DER-encoded file with the given path.
+#[derive(Clone, Debug)]
+pub struct DerFileKeyComponent(CString);
+
+impl AsRawKeyComponent for DerFileKeyComponent {
+    fn as_raw_key_component(&self) -> (coap_const_char_ptr_t, usize) {
+        (
+            coap_const_char_ptr_t {
+                s_byte: self.0.as_ptr(),
+            },
+            0,
+        )
+    }
+}
+
+#[cfg(unix)]
+impl<T: AsRef<Path>> From<T> for DerFileKeyComponent {
+    fn from(value: T) -> Self {
+        // File paths never contain null-bytes on unix, so we can unwrap here.
+        DerFileKeyComponent(CString::new(value.as_ref().as_os_str().as_bytes()).unwrap())
+    }
+}
+
+/// Key component that is stored in memory as a DER-encoded sequence of bytes.
+#[derive(Clone, Debug)]
+pub struct DerMemoryKeyComponent(Box<[u8]>);
+
+impl AsRawKeyComponent for DerMemoryKeyComponent {
+    fn as_raw_key_component(&self) -> (coap_const_char_ptr_t, usize) {
+        (
+            coap_const_char_ptr_t {
+                u_byte: self.0.as_ptr(),
+            },
+            self.0.len(),
+        )
+    }
+}
+
+impl<T: Into<Vec<u8>>> From<T> for DerMemoryKeyComponent {
+    fn from(value: T) -> Self {
+        DerMemoryKeyComponent(value.into().into_boxed_slice())
+    }
+}
+
+/// Key component that is stored as a PKCS11 URI.
+#[derive(Clone, Debug)]
+pub struct Pkcs11KeyComponent(CString);
+
+impl AsRawKeyComponent for Pkcs11KeyComponent {
+    fn as_raw_key_component(&self) -> (coap_const_char_ptr_t, usize) {
+        (
+            coap_const_char_ptr_t {
+                s_byte: self.0.as_ptr(),
+            },
+            0,
+        )
+    }
+}
+
+impl<T: Into<CString>> From<T> for Pkcs11KeyComponent {
+    fn from(value: T) -> Self {
+        Pkcs11KeyComponent(value.into())
+    }
+}
+
+/// Key component that is passed to the TLS library verbatim (only supported by OpenSSL).
+#[derive(Clone, Debug)]
+pub struct EngineKeyComponent(CString);
+
+impl AsRawKeyComponent for EngineKeyComponent {
+    fn as_raw_key_component(&self) -> (coap_const_char_ptr_t, usize) {
+        (
+            coap_const_char_ptr_t {
+                s_byte: self.0.as_ptr(),
+            },
+            0,
+        )
+    }
+}
+
+impl<T: Into<CString>> From<T> for EngineKeyComponent {
+    fn from(value: T) -> Self {
+        EngineKeyComponent(value.into())
+    }
+}
+
+/// Private key type for DER/ASN.1 encoded keys.
+#[repr(C)]
+#[derive(Copy, Clone, FromPrimitive, Debug, PartialEq, Eq, Hash, Default)]
+pub enum Asn1PrivateKeyType {
+    #[default]
+    None = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_NONE as isize,
+    Rsa = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_RSA as isize,
+    Rsa2 = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_RSA2 as isize,
+    Dsa = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA as isize,
+    Dsa1 = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA1 as isize,
+    Dsa2 = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA2 as isize,
+    Dsa3 = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA3 as isize,
+    Dsa4 = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA4 as isize,
+    Dh = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DH as isize,
+    Dhx = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DHX as isize,
+    Ec = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_EC as isize,
+    Hmac = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_HMAC as isize,
+    Cmac = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_CMAC as isize,
+    Tls1Prf = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_TLS1_PRF as isize,
+    Hkdf = coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_HKDF as isize,
+}
+
+impl From<Asn1PrivateKeyType> for coap_asn1_privatekey_type_t {
+    fn from(value: Asn1PrivateKeyType) -> Self {
+        match value {
+            Asn1PrivateKeyType::None => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_NONE,
+            Asn1PrivateKeyType::Rsa => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_RSA,
+            Asn1PrivateKeyType::Rsa2 => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_RSA2,
+            Asn1PrivateKeyType::Dsa => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA,
+            Asn1PrivateKeyType::Dsa1 => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA1,
+            Asn1PrivateKeyType::Dsa2 => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA2,
+            Asn1PrivateKeyType::Dsa3 => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA3,
+            Asn1PrivateKeyType::Dsa4 => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DSA4,
+            Asn1PrivateKeyType::Dh => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DH,
+            Asn1PrivateKeyType::Dhx => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_DHX,
+            Asn1PrivateKeyType::Ec => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_EC,
+            Asn1PrivateKeyType::Hmac => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_HMAC,
+            Asn1PrivateKeyType::Cmac => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_CMAC,
+            Asn1PrivateKeyType::Tls1Prf => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_TLS1_PRF,
+            Asn1PrivateKeyType::Hkdf => coap_asn1_privatekey_type_t::COAP_ASN1_PKEY_HKDF,
+        }
+    }
+}
+
+impl From<coap_asn1_privatekey_type_t> for Asn1PrivateKeyType {
+    fn from(value: coap_asn1_privatekey_type_t) -> Self {
+        FromPrimitive::from_isize(value as isize).expect("unknown ASN1 private key type")
+    }
+}
diff --git a/libcoap/src/crypto/pki_rpk/mod.rs b/libcoap/src/crypto/pki_rpk/mod.rs
new file mode 100644
index 00000000..f35f8f57
--- /dev/null
+++ b/libcoap/src/crypto/pki_rpk/mod.rs
@@ -0,0 +1,898 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * crypto/pki_rpk/mod.rs - Interfaces and types for PKI/RPK support in libcoap-rs.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+//! Types and traits related to (D)TLS with raw public keys and/or public key infrastructure support
+//! for CoAP.
+//!
+//! In order to configure PKI and/or RPK support, the following general steps need to be followed:
+//! 1. Create a key definition for the desired DTLS variant, see [`PkiKeyDef`](pki_rpk::PkiKeyDef)
+//!    and [`RpkKeyDef`](pki_rpk::RpkKeyDef) for more detailed information.
+//! 2. Create a [`PkiRpkContextBuilder`](pki_rpk::PkiRpkContextBuilder) using the provided key and
+//!    (optionally) make some additional configuration changes (see the builder struct
+//!    documentation).
+//! 3. Call [`PkiRpkContextBuilder::build`](pki_rpk::PkiRpkContextBuilder::build) to create a
+//!    [`PkiRpkContext`](pki_rpk::PkiRpkContext).
+//! 4. Provide the created context to [`CoapClientSession::connect_dtls`](crate::session::CoapClientSession::connect_dtls)
+//!    (for client-side sessions) or [`CoapContext::set_pki_rpk_context`](crate::CoapContext::set_pki_rpk_context)
+//!    (for server-side sessions).
+//! 5. On servers, run [`CoapContext::add_endpoint_dtls`](crate::CoapContext::add_endpoint_dtls) to
+//!    add a DTLS endpoint.
+//!
+//! Note that [`PkiRpkContextBuilder`](pki_rpk::PkiRpkContextBuilder) uses generics with the marker
+//! structs [`Pki`](pki_rpk::Pki) and [`Rpk`](pki_rpk::Rpk) to statically indicate the DTLS variant
+//! and [`NonCertVerifying`](pki_rpk::NonCertVerifying) and [`CertVerifying`](pki_rpk::CertVerifying)
+//! to indicate whether the peer certificate should be verified (PKI only, RPK will always use
+//! [`NonCertVerifying`](pki_rpk::NonCertVerifying)).
+//!
+//! # Examples
+#![cfg_attr(
+    feature = "dtls-rpk",
+    doc = r##"
+Creating and connecting a client-side session with DTLS RPK configured:
+```no_run
+use libcoap_rs::CoapContext;
+use libcoap_rs::crypto::pki_rpk::{NonCertVerifying, PkiRpkContextBuilder, Rpk, RpkKeyDef};
+use libcoap_rs::session::{CoapClientSession, CoapSession};
+
+// RPK is only supported if the key is provided as a byte array in memory, providing file paths
+// directly is unsupported.
+let client_private_key = Vec::from(include_str!("../../../resources/test-keys/client/client.key.pem"));
+let client_public_key = Vec::from(include_str!("../../../resources/test-keys/client/client.pub.pem"));
+
+// Create key definition.
+let client_key_def = RpkKeyDef::with_pem_memory(client_public_key, client_private_key);
+
+// Create the cryptography context. Note that you might have to explicitly specify that
+// PKI certificate validation should not be performed, even though enabling it while passing a
+// RPK key definition is impossible due to a lack of a constructor for
+// `PkiRpkContextBuilder<Rpk, CertVerifying>`.
+// This is a type system limitation.
+let crypto_ctx = PkiRpkContextBuilder::<_, NonCertVerifying>::new(client_key_def);
+
+let key_validator = |asn1_public_key: &[u8], session: &CoapSession, validated: bool| {
+    if !validated {
+        false
+    } else {
+        // Here, you would add code to validate that the peer's public key is actually the one you
+        // expect, and return either true (accept key) or false (reject key).
+        // `asn1_encoded_key` should be the certificate structure defined in
+        // [RFC 7250, section 3](https://datatracker.ietf.org/doc/html/rfc7250#section-3), which you
+        // might be able to parse with crates like
+        // [x509-cert](https://docs.rs/x509-cert/latest/x509_cert/index.html) and
+        // [spki](https://docs.rs/spki/0.7.3/spki/index.html) to obtain and match the
+        // SubjectPublicKeyInformation encoded within.
+        //
+        // Instead of using a lambda like this, you could also implement `RpkValidator` on any
+        // arbitrary type of your choice, e.g., a structure containing a storage of allowed public
+        // keys.
+        # true
+    }
+};
+
+// Set the RPK validator and build the context.
+let crypto_ctx = crypto_ctx.rpk_validator(key_validator).build();
+
+let mut coap_ctx = CoapContext::new().expect("unable to create CoAP context");
+let session = CoapClientSession::connect_dtls(&mut coap_ctx, "example.com:5684".parse().unwrap(), crypto_ctx);
+
+// The session might not be immediately established, but you can already create and send
+// requests as usual after this point.
+// To check for errors and/or disconnections, you might want to call and check the return value
+// of `session.state()` occasionally.
+// For error handling, you might also want to register an event handler with the CoAP context.
+// Remaining code omitted for brevity, see the crate-level docs for a full example of client
+// operation.
+```
+
+Creating a server that supports DTLS RPK configured:
+```no_run
+use libcoap_rs::CoapContext;
+use libcoap_rs::crypto::pki_rpk::{NonCertVerifying, PkiRpkContextBuilder, Rpk, RpkKeyDef};
+use libcoap_rs::session::{CoapClientSession, CoapSession};
+
+fn key_validator(asn1_public_key: &[u8], session: &CoapSession, validated: bool) -> bool {
+    // Here, you would add code to validate that the peer's public key is actually the one you
+    // expect, and return either true (accept key) or false (reject key).
+    // `asn1_encoded_key` should be the certificate structure defined in
+    // [RFC 7250, section 3](https://datatracker.ietf.org/doc/html/rfc7250#section-3), which you
+    // might be able to parse with crates like
+    // [x509-cert](https://docs.rs/x509-cert/latest/x509_cert/index.html) and
+    // [spki](https://docs.rs/spki/0.7.3/spki/index.html) to obtain and match the
+    // SubjectPublicKeyInformation encoded within.
+    //
+    // Instead of using a function like this, you could also implement `RpkValidator` on any
+    // arbitrary type of your choice, e.g., a structure containing a storage of allowed public
+    // keys.
+    # true
+}
+
+// RPK is only supported if the key is provided as a byte array in memory, providing file paths
+// directly is unsupported.
+let server_private_key = Vec::from(include_str!("../../../resources/test-keys/server/server.key.pem"));
+let server_public_key = Vec::from(include_str!("../../../resources/test-keys/server/server.pub.pem"));
+
+// Create key definition.
+let server_key_def = RpkKeyDef::with_pem_memory(server_public_key, server_private_key);
+
+// Create the cryptography context. Note that you might have to explicitly specify that
+// PKI certificate validation should not be performed, even though enabling it while passing a
+// RPK key definition is impossible due to a lack of a constructor for
+// `PkiRpkContextBuilder<Rpk, CertVerifying>`.
+// This is a type system limitation.
+let crypto_ctx = PkiRpkContextBuilder::<_, NonCertVerifying>::new(server_key_def);
+// Set the RPK validator and build the context.
+let crypto_ctx = crypto_ctx.rpk_validator(key_validator).build();
+
+let mut coap_ctx = CoapContext::new().expect("unable to create CoAP context");
+coap_ctx.set_pki_rpk_context(crypto_ctx);
+coap_ctx.add_endpoint_dtls("[::1]:5684".parse().unwrap()).expect("unable to create DTLS endpoint");
+
+// For error handling, you might want to register an event handler with the CoAP context.
+// Remaining code omitted for brevity, see the crate-level docs for a full example of server
+// operation.
+```
+"##
+)]
+#![cfg_attr(
+    feature = "dtls-pki",
+    doc = r##"
+
+Creating and connecting a client-side session with DTLS PKI configured:
+```no_run
+use std::ffi::{c_uint, CStr};
+use std::net::SocketAddr;
+use libcoap_rs::CoapContext;
+use libcoap_rs::crypto::pki_rpk::{CertVerifying, PkiKeyDef, PkiRpkContextBuilder};
+use libcoap_rs::session::{CoapClientSession, CoapSession};
+use std::ffi::CString;
+
+// Paths to private key and certificate.
+// The certificate may also contain intermediates. However, they might *not* be provided to the
+// peer (i.e., the peer might have to already know all intermediates beforehand in order for
+// validation to succeed).
+let client_private_key = "../../../resources/test-keys/client/client.key.pem";
+let client_public_cert = "../../../resources/test-keys/client/client.crt.pem";
+
+// Create key definition.
+// Note: the first argument (`ca_cert`) is not used to send intermediates and root certificates
+// to the peer (unlike what you might expect if you have experience setting up HTTP servers).
+// It is exclusively used to determine a list of CA names that a server will provide to a client
+// to indicate to it which certificates it should send.
+// For client-side operation, `ca_cert` is not used.
+let client_key_def = PkiKeyDef::with_pem_files(
+                        None::<String>,
+                        client_public_cert,
+                        client_private_key);
+
+// The name of the server we want to connect to.
+let server_name = "example.com";
+
+// Validator function for certificate common names.
+// Typically, this function should have the following behavior:
+// - If !validated, something went wrong during TLS-level certificate checks, so reject.
+// - If depth == 0, we are checking the client certificate, whose common name should equal the
+//   server name we want to connect to, return the equality check result.
+// - If depth > 0, we are checking an intermediate or root CA certificate. As we usually trust
+//   all CAs in the trust store and validation of those is already performed by the TLS library,
+//   always accept.
+let c_server_name = CString::new(server_name).unwrap();
+let cn_validator = |
+     cn: &CStr,
+     asn1_public_cert: &[u8],
+     session: &CoapSession,
+     depth: c_uint,
+     validated: bool| {
+    if !validated {
+        false
+    } else if depth == 0 {
+        cn == c_server_name.as_c_str()
+    } else {
+        true
+    }
+};
+
+// Create the cryptography context. Note that you must explicitly specify whether
+// PKI certificate validation should be performed using the context builder's generics.
+let crypto_ctx = PkiRpkContextBuilder::<_, CertVerifying>::new(client_key_def)
+                 // Provide the server with a Server Name Indication (might be required by
+                 // some servers to use the right certificate).
+                 .client_sni(server_name).unwrap()
+                 // Use the CN validator we defined earlier.
+                 .cn_validator(cn_validator)
+                 // Enable certificate chain validation (in case you have intermediate CAs) and set
+                 // verification depth (recommended value here is 3).
+                 .cert_chain_validation(3)
+                 .build();
+
+let mut coap_ctx = CoapContext::new().expect("unable to create CoAP context");
+let session = CoapClientSession::connect_dtls(
+             &mut coap_ctx,
+             SocketAddr::new(server_name.parse().expect("error in name resolution"), 5684),
+             crypto_ctx);
+
+// The session might not be immediately established, but you can already create and send
+// requests as usual after this point.
+// To check for errors and/or disconnections, you might want to call and check the return value
+// of `session.state()` occasionally.
+// For error handling, you might also want to register an event handler with the CoAP context.
+// Remaining code omitted for brevity, see the crate-level docs for a full example of client
+// operation.
+```
+
+Creating a server that supports DTLS RPK configured:
+```no_run
+use std::ffi::{c_uint, CStr};
+use std::net::SocketAddr;
+use libcoap_rs::CoapContext;
+use libcoap_rs::crypto::pki_rpk::{CertVerifying, PkiKeyDef, PkiRpkContextBuilder, KeyDef, Pki};
+use libcoap_rs::session::{CoapClientSession, CoapSession};
+use std::ffi::CString;
+
+// Paths to private key and certificate.
+// The certificate may also contain intermediates. However, they might *not* be provided to the
+// peer (i.e., the peer might have to already know all intermediates beforehand in order for
+// validation to succeed).
+let server_private_key = "../../../resources/test-keys/server/server.key.pem";
+let server_public_cert = "../../../resources/test-keys/server/server.crt.pem";
+let ca_cert = "../../../resources/test-keys/ca/ca.crt.pem";
+
+// Create key definition.
+// Note: the first argument (`ca_cert`) is not used to send intermediates and root certificates
+// to the peer (unlike what you might expect if you have experience setting up HTTP servers).
+// It is exclusively used to determine a list of CA names that a server will provide to a client
+// to indicate to it which certificates it should send.
+let server_key_def = PkiKeyDef::with_pem_files(Some(ca_cert), server_public_cert, server_private_key);
+
+// The name of the server we use.
+let server_name = "example.com";
+
+// Key provider for Server Name Indications.
+// If the client provides a server name using the Server Name Indication extension, this
+// callback is called to determine the key the server should use instead of the one provided as
+// the default to `PkiRpkContextBuilder::new`.
+// Typically, you would want to maintain a map from potential server names to key definitions,
+// and return either `Some(Box::new(key))` for the appropriate map entry or `None` if the server
+// name is unknown.
+let c_server_name = CString::new(server_name).unwrap();
+let sni_cb = |sni: &CStr| -> Option<Box<dyn KeyDef<KeyType = Pki>>> {
+    (sni == c_server_name.as_c_str()).then_some(Box::new(server_key_def.clone()))
+};
+
+// Just like the client, the server may also have a CN validator defined to determine whether
+// the common name of the client is acceptable. Here, we omit this validator for brevity.
+
+// Create the cryptography context. Note that you must explicitly specify whether
+// PKI certificate validation should be performed using the context builder's generics.
+let crypto_ctx = PkiRpkContextBuilder::<_, CertVerifying>::new(server_key_def.clone())
+                 .sni_key_provider(sni_cb)
+                 // Enable certificate chain validation (in case you have intermediate CAs) and set
+                 // verification depth (recommended value here is 3).
+                 .cert_chain_validation(3)
+                 .build();
+
+let mut coap_ctx = CoapContext::new().expect("unable to create CoAP context");
+coap_ctx.set_pki_rpk_context(crypto_ctx);
+coap_ctx.add_endpoint_dtls("[::1]:5684".parse().unwrap()).expect("unable to create DTLS endpoint");
+
+// For error handling, you might want to register an event handler with the CoAP context.
+// Remaining code omitted for brevity, see the crate-level docs for a full example of server
+// operation.
+```
+"##
+)]
+
+/// Data structures and builders for PKI/RPK keys.
+mod key;
+/// Code specific to PKI support.
+#[cfg(feature = "dtls-pki")]
+mod pki;
+/// Code specific to RPK support.
+#[cfg(feature = "dtls-rpk")]
+mod rpk;
+
+#[cfg(feature = "dtls-pki")]
+pub use pki::*;
+#[cfg(feature = "dtls-rpk")]
+pub use rpk::*;
+
+pub use key::*;
+
+use crate::error::{ContextConfigurationError, SessionCreationError};
+use crate::session::CoapSession;
+use crate::types::CoapAddress;
+use crate::CoapContext;
+use libcoap_sys::{
+    coap_context_set_pki, coap_context_t, coap_dtls_key_t, coap_dtls_pki_t, coap_new_client_session_pki, coap_proto_t,
+    coap_session_t, COAP_DTLS_PKI_SETUP_VERSION,
+};
+use std::cell::RefCell;
+use std::ffi::{c_char, c_int, c_uint, c_void, CStr, CString, NulError};
+use std::fmt::{Debug, Formatter};
+use std::marker::PhantomData;
+use std::ptr::NonNull;
+use std::rc::{Rc, Weak};
+
+/// A context configuration for server-side PKI or RPK based DTLS encryption.
+#[derive(Clone, Debug)]
+pub enum ServerPkiRpkCryptoContext<'a> {
+    /// PKI based configuration.
+    #[cfg(feature = "dtls-pki")]
+    Pki(PkiRpkContext<'a, Pki>),
+    // RPK based configuration.
+    #[cfg(feature = "dtls-rpk")]
+    Rpk(PkiRpkContext<'a, Rpk>),
+}
+
+impl ServerPkiRpkCryptoContext<'_> {
+    /// Apply this cryptographic context to the given raw `coap_context_t`.
+    ///
+    /// # Errors
+    ///
+    /// Will return [`ContextConfigurationError::Unknown`] if the call to the underlying libcoap
+    /// function fails.
+    ///
+    /// # Safety
+    /// The provided CoAP context must be valid and must not outlive this PkiRpkContext.
+    pub(crate) unsafe fn apply_to_context(
+        &self,
+        ctx: NonNull<coap_context_t>,
+    ) -> Result<(), ContextConfigurationError> {
+        match self {
+            #[cfg(feature = "dtls-pki")]
+            ServerPkiRpkCryptoContext::Pki(v) => v.apply_to_context(ctx),
+            #[cfg(feature = "dtls-rpk")]
+            ServerPkiRpkCryptoContext::Rpk(v) => v.apply_to_context(ctx),
+        }
+    }
+}
+
+/// Marker indicating that a cryptographic context does not do TLS library-side certificate
+/// verification.
+///
+/// # Implementation details (informative, not covered by semver guarantees)
+/// A [`PkiRpkContext`] that is [`NonCertVerifying`] will set the `verify_peer_cert` field of the
+/// underlying [`coap_dtls_pki_t`] to `0`.
+pub struct NonCertVerifying;
+
+/// Marker indicating that a cryptographic context does perform TLS library-side certificate
+/// verification.
+///
+/// # Implementation details (informative, not covered by semver guarantees)
+/// A [`PkiRpkContext`] that is [`CertVerifying`] will set the `verify_peer_cert` field of the
+/// underlying [`coap_dtls_pki_t`] to `1`.
+pub struct CertVerifying;
+
+trait CertVerificationModeSealed {}
+
+/// Trait for markers that indicate whether a PKI/RPK DTLS context performs certificate validation.
+#[allow(private_bounds)]
+pub trait CertVerificationMode: CertVerificationModeSealed {}
+
+impl CertVerificationModeSealed for NonCertVerifying {}
+
+impl CertVerificationModeSealed for CertVerifying {}
+
+impl CertVerificationMode for NonCertVerifying {}
+
+impl CertVerificationMode for CertVerifying {}
+
+/// Builder for a PKI or RPK configuration context.
+pub struct PkiRpkContextBuilder<'a, KTY: KeyType, V: CertVerificationMode> {
+    ctx: PkiRpkContextInner<'a, KTY>,
+    verifying: PhantomData<V>,
+}
+
+impl<'a, KTY: KeyType> PkiRpkContextBuilder<'a, KTY, NonCertVerifying> {
+    /// Creates a new context builder with the given `key` as the default key to use.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Providing a raw public key will set `is_rpk_not_cert` to `1` in the underlying
+    /// [`coap_dtls_pki_t`] structure. `pki_key` will be set to the provided key regardless of key
+    /// type.
+    pub fn new<K: KeyDef<KeyType = KTY> + 'a>(key: K) -> Self {
+        let mut result = PkiRpkContextBuilder::<KTY, NonCertVerifying> {
+            ctx: PkiRpkContextInner {
+                raw_cfg: Box::new(coap_dtls_pki_t {
+                    version: COAP_DTLS_PKI_SETUP_VERSION as u8,
+                    verify_peer_cert: 0,
+                    check_common_ca: 0,
+                    allow_self_signed: 0,
+                    allow_expired_certs: 0,
+                    cert_chain_validation: 0,
+                    cert_chain_verify_depth: 0,
+                    check_cert_revocation: 0,
+                    allow_no_crl: 0,
+                    allow_expired_crl: 0,
+                    allow_bad_md_hash: 0,
+                    allow_short_rsa_length: 0,
+                    is_rpk_not_cert: 0,
+                    use_cid: 0,
+                    reserved: Default::default(),
+                    validate_cn_call_back: None,
+                    cn_call_back_arg: std::ptr::null_mut(),
+                    validate_sni_call_back: None,
+                    sni_call_back_arg: std::ptr::null_mut(),
+                    additional_tls_setup_call_back: None,
+                    client_sni: std::ptr::null_mut(),
+                    pki_key: key.as_raw_dtls_key(),
+                }),
+                provided_keys: vec![Box::new(key)],
+                provided_key_descriptors: vec![],
+                cn_callback: None,
+                sni_key_provider: None,
+                client_sni: None,
+            },
+            verifying: Default::default(),
+        };
+        KTY::set_key_type_defaults(result.ctx.raw_cfg.as_mut());
+        result
+    }
+}
+
+impl<KTY: KeyType, V: CertVerificationMode> PkiRpkContextBuilder<'_, KTY, V> {
+    /// Enables/disables use of DTLS connection identifiers
+    /// ([RFC 9146](https://datatracker.ietf.org/doc/html/rfc9146)) for the built context *if used
+    /// in a client-side session*.
+    ///
+    /// For server-side sessions, this setting is ignored, and connection identifiers will always be
+    /// used if supported by the underlying DTLS library.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `use_cid` in the underlying [`coap_dtls_pki_t`] structure.
+    pub fn use_cid(mut self, use_cid: bool) -> Self {
+        self.ctx.raw_cfg.use_cid = use_cid.into();
+        self
+    }
+
+    /// Sets the server name indication that should be sent to servers if the built
+    /// [`PkiRpkContext`] is used in a client-side session.
+    ///
+    /// `client_sni` should be convertible into a byte string that does not contain null bytes.
+    /// Typically, you would provide a `&str` or `String`.
+    ///
+    /// # Errors
+    ///
+    /// Will return [`NulError`] if the provided byte string contains null bytes.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `client_sni` in the underlying [`coap_dtls_pki_t`] structure.
+    ///
+    /// The provided `client_sni` will be converted into a `Box<[u8]>`, which will be owned and
+    /// stored by the built context.
+    pub fn client_sni(mut self, client_sni: impl Into<Vec<u8>>) -> Result<Self, NulError> {
+        // For some reason, client_sni is not immutable here.
+        // While I don't see any reason why libcoap would modify the string, it is not strictly
+        // forbidden for it to do so, so simply using CString::into_raw() is not an option (as it
+        // does not allow modifications to client_sni that change the length).
+        let sni = CString::new(client_sni.into())?
+            .into_bytes_with_nul()
+            .into_boxed_slice();
+        self.ctx.client_sni = Some(sni);
+        self.ctx.raw_cfg.client_sni = self.ctx.client_sni.as_mut().unwrap().as_mut_ptr() as *mut c_char;
+        Ok(self)
+    }
+}
+
+impl<KTY: KeyType> PkiRpkContextBuilder<'_, KTY, CertVerifying> {
+    /// Enables or disables checking whether both peers' certificates are signed by the same CA.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `check_common_ca` in the underlying [`coap_dtls_pki_t`] structure.
+    pub fn check_common_ca(mut self, check_common_ca: bool) -> Self {
+        self.ctx.raw_cfg.check_common_ca = check_common_ca.into();
+        self
+    }
+
+    /// Allows or disallows use of self-signed certificates by the peer.
+    ///
+    /// If `check_common_ca` has been enabled, this setting will be **ignored**.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `allow_self_signed` in the underlying [`coap_dtls_pki_t`] structure.
+    pub fn allow_self_signed(mut self, allow_self_signed: bool) -> Self {
+        self.ctx.raw_cfg.allow_self_signed = allow_self_signed.into();
+        self
+    }
+
+    /// Allows or disallows usage of expired certificates by the peer.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `allow_expired_certs` in the underlying [`coap_dtls_pki_t`] structure.
+    pub fn allow_expired_certs(mut self, allow_expired_certs: bool) -> Self {
+        self.ctx.raw_cfg.allow_expired_certs = allow_expired_certs.into();
+        self
+    }
+
+    /// Enables or disables verification of the entire certificate chain (up to
+    /// `cert_chain_verify_depth`).
+    ///
+    /// If `cert_chain_verify_depth` is `0`, certificate chain validation is disabled.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `cert_chain_verify_depth` and `cert_chain_validation` in the
+    /// underlying [`coap_dtls_pki_t`] structure.
+    pub fn cert_chain_validation(mut self, cert_chain_verify_depth: u8) -> Self {
+        self.ctx.raw_cfg.cert_chain_validation = if cert_chain_verify_depth == 0 { 0 } else { 1 };
+        self.ctx.raw_cfg.cert_chain_verify_depth = cert_chain_verify_depth;
+        self
+    }
+
+    /// Enables or disables certificate revocation checking.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `check_cert_revocation` in the underlying [`coap_dtls_pki_t`] structure.
+    pub fn check_cert_revocation(mut self, check_cert_revocation: bool) -> Self {
+        self.ctx.raw_cfg.check_cert_revocation = check_cert_revocation.into();
+        self
+    }
+
+    /// Allows or disallows disabling certificate revocation checking if a certificate does not have
+    /// a CRL.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `allow_no_crl` in the underlying [`coap_dtls_pki_t`] structure.
+    pub fn allow_no_crl(mut self, allow_no_crl: bool) -> Self {
+        self.ctx.raw_cfg.allow_no_crl = allow_no_crl.into();
+        self
+    }
+
+    /// Allows or disallows disabling certificate revocation checking if a certificate has an
+    /// expired CRL.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `allow_expired_crl` in the underlying [`coap_dtls_pki_t`] structure.
+    pub fn allow_expired_crl(mut self, allow_expired_crl: bool) -> Self {
+        self.ctx.raw_cfg.allow_expired_crl = allow_expired_crl.into();
+        self
+    }
+
+    /// Allows or disallows use of unsupported MD hashes.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `allow_bad_md_hash` in the underlying [`coap_dtls_pki_t`] structure.
+    pub fn allow_bad_md_hash(mut self, allow_bad_md_hash: bool) -> Self {
+        self.ctx.raw_cfg.allow_bad_md_hash = allow_bad_md_hash.into();
+        self
+    }
+
+    /// Allows or disallows small RSA key sizes.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `allow_short_rsa_length` in the underlying [`coap_dtls_pki_t`] structure.
+    pub fn allow_short_rsa_length(mut self, allow_short_rsa_length: bool) -> Self {
+        self.ctx.raw_cfg.allow_short_rsa_length = allow_short_rsa_length.into();
+        self
+    }
+}
+
+impl<'a, KTY: KeyType, V: CertVerificationMode> PkiRpkContextBuilder<'a, KTY, V> {
+    /// Sets the key provider that provides keys for a SNI provided by a client (only used in
+    /// server-side operation).
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Setting a `sni_key_provider` will set the `validate_sni_call_back` of the underlying
+    /// [`coap_dtls_pki_t`] to a wrapper function, which will then call the key provider.
+    ///
+    /// Keys returned by the key provider will be stored in the context for at least as long as they
+    /// are used by the respective session.
+    pub fn sni_key_provider(mut self, sni_key_provider: impl PkiRpkSniKeyProvider<KTY> + 'a) -> Self {
+        self.ctx.sni_key_provider = Some(Box::new(sni_key_provider));
+        self.ctx.raw_cfg.validate_sni_call_back = Some(dtls_pki_sni_callback::<KTY>);
+        self
+    }
+
+    /// Builds the configured `PkiRpkContext` by consuming this builder.
+    pub fn build(self) -> PkiRpkContext<'a, KTY> {
+        let ctx = Rc::new(RefCell::new(self.ctx));
+        {
+            let mut ctx_borrow = ctx.borrow_mut();
+            if ctx_borrow.raw_cfg.validate_cn_call_back.is_some() {
+                ctx_borrow.raw_cfg.cn_call_back_arg = Rc::downgrade(&ctx).into_raw() as *mut c_void;
+            }
+            if ctx_borrow.raw_cfg.validate_sni_call_back.is_some() {
+                ctx_borrow.raw_cfg.sni_call_back_arg = Rc::downgrade(&ctx).into_raw() as *mut c_void;
+            }
+        }
+        PkiRpkContext { inner: ctx }
+    }
+}
+
+/// Inner structure of a [`PkiRpkContext`].
+struct PkiRpkContextInner<'a, KTY: KeyType> {
+    /// Raw PKI/RPK configuration structure.
+    raw_cfg: Box<coap_dtls_pki_t>,
+    /// Store for key definitions that we provided in previous callback invocations.
+    provided_keys: Vec<Box<dyn KeyDef<KeyType = KTY> + 'a>>,
+    /// Store for raw key definitions provided to libcoap.
+    ///
+    /// The stored raw pointers must all have been created by a call to `Box::into_raw`, and must
+    /// remain valid as long as the respective session is still active.
+    ///
+    /// Using `Vec<coap_dtls_key_t>` instead is not an option, as a Vec resize may cause the
+    /// instances to be moved to a different place in memory, invalidating pointers provided to
+    /// libcoap.
+    provided_key_descriptors: Vec<*mut coap_dtls_key_t>,
+    /// User-provided CN callback that should be wrapped (either a PKI CN callback or a RPK public
+    /// key validator).
+    cn_callback: Option<CnCallback<'a>>,
+    /// User-provided SNI key provider.
+    sni_key_provider: Option<Box<dyn PkiRpkSniKeyProvider<KTY> + 'a>>,
+    /// Byte string that client-side sessions using this context should send as SNI.
+    ///
+    /// Is referenced in raw_cfg and must therefore not be mutated for the lifetime of this context.
+    client_sni: Option<Box<[u8]>>,
+}
+
+impl<KTY: KeyType> Debug for PkiRpkContextInner<'_, KTY> {
+    fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("PkiContextInner")
+            .field(
+                "raw_cfg",
+                &format!("(does not implement Debug), address: {:p}", self.raw_cfg),
+            )
+            .field("provided_keys", &self.provided_keys)
+            .field(
+                "provided_key_descriptors",
+                &format!(
+                    "(values do not implement Debug), length: {}",
+                    self.provided_key_descriptors.len()
+                ),
+            )
+            .field("cn_callback", &"(value does not implement Debug)")
+            .field("sni_key_provider", &"(value does not implement Debug)")
+            .field("client_sni", &self.client_sni)
+            .finish()
+    }
+}
+
+impl<KTY: KeyType> Drop for PkiRpkContextInner<'_, KTY> {
+    fn drop(&mut self) {
+        for key_ref in std::mem::take(&mut self.provided_key_descriptors).into_iter() {
+            // SAFETY: If the inner context is dropped, this implies that the pointers returned in
+            // previous callbacks are no longer used (because of the contracts of apply_to_context()
+            // and create_raw_session()). We can therefore restore and drop these values without
+            // breaking the aliasing rules.
+            unsafe {
+                drop(Box::from_raw(key_ref));
+            }
+        }
+        if !self.raw_cfg.cn_call_back_arg.is_null() {
+            // SAFETY: If we set this, it must have been using a call to `Weak::into_raw` with the
+            //         correct type, otherwise, the value will always be null.
+            unsafe {
+                Weak::from_raw(self.raw_cfg.cn_call_back_arg as *mut RefCell<Self>);
+            }
+        }
+        if !self.raw_cfg.sni_call_back_arg.is_null() {
+            // SAFETY: If we set this, it must have been using a call to `Weak::into_raw` with the
+            //         correct type, otherwise, the value will always be null.
+            unsafe {
+                Weak::from_raw(self.raw_cfg.sni_call_back_arg as *mut RefCell<Self>);
+            }
+        }
+    }
+}
+
+/// A configuration context for PKI or RPK based DTLS operation.
+///
+/// Whether PKI or RPK is configured for this context is indicated by the `KTY` generic, which may
+/// either be [`Pki`] or [`Rpk`].
+#[derive(Clone, Debug)]
+pub struct PkiRpkContext<'a, KTY: KeyType> {
+    /// Inner structure that is referenced by this context.
+    inner: Rc<RefCell<PkiRpkContextInner<'a, KTY>>>,
+}
+
+impl<KTY: KeyType> PkiRpkContext<'_, KTY> {
+    /// Creates a raw [`coap_session_t`] that is bound and uses this encryption context.
+    ///
+    /// # Safety
+    ///
+    /// This PkiRpkContext must outlive the returned [`coap_session_t`].
+    pub(crate) unsafe fn create_raw_session(
+        &self,
+        ctx: &mut CoapContext<'_>,
+        addr: &CoapAddress,
+        proto: coap_proto_t,
+    ) -> Result<NonNull<coap_session_t>, SessionCreationError> {
+        // SAFETY: self.raw_context is guaranteed to be valid, local_if can be null,
+        // raw_cfg is of valid format (as constructed by the builder).
+        {
+            let mut inner = (*self.inner).borrow_mut();
+            NonNull::new(unsafe {
+                coap_new_client_session_pki(
+                    ctx.as_mut_raw_context(),
+                    std::ptr::null(),
+                    addr.as_raw_address(),
+                    proto,
+                    inner.raw_cfg.as_mut(),
+                )
+            })
+            .ok_or(SessionCreationError::Unknown)
+        }
+    }
+
+    /// Configures the provided raw [`coap_context_t`] to use this encryption context for RPK or PKI
+    /// based server-side operation.
+    ///
+    /// # Errors
+    ///
+    /// Will return [`ContextConfigurationError::Unknown`] if the call to the underlying libcoap
+    /// function fails.
+    ///
+    /// # Safety
+    ///
+    /// The provided CoAP context must be valid and must not outlive this [`PkiRpkContext`].
+    unsafe fn apply_to_context(&self, mut ctx: NonNull<coap_context_t>) -> Result<(), ContextConfigurationError> {
+        let mut inner = self.inner.borrow_mut();
+        // SAFETY: context is valid as per caller contract, raw_cfg is a valid configuration as
+        // ensured by the builder.
+        match unsafe { coap_context_set_pki(ctx.as_mut(), inner.raw_cfg.as_mut()) } {
+            1 => Ok(()),
+            _ => Err(ContextConfigurationError::Unknown),
+        }
+    }
+}
+
+impl<'a, KTY: KeyType> PkiRpkContext<'a, KTY> {
+    /// Wrapper function for the user-provided CN callback.
+    ///
+    /// Calls the user-provided CN callback and converts its return value into the integer values
+    /// libcoap expects.
+    // cn and depth are unused only if dtls-pki feature is not enabled
+    #[cfg_attr(not(feature = "dtls-pki"), allow(unused_variables))]
+    fn cn_callback(
+        &self,
+        cn: &CStr,
+        asn1_public_cert: &[u8],
+        session: &CoapSession,
+        depth: c_uint,
+        validated: bool,
+    ) -> c_int {
+        let inner = (*self.inner).borrow();
+        // This function is only ever called if a CN key provider is set, so it's fine to unwrap
+        // here.
+        if match inner.cn_callback.as_ref().unwrap() {
+            #[cfg(feature = "dtls-pki")]
+            CnCallback::Pki(pki) => pki.validate_cn(cn, asn1_public_cert, session, depth, validated),
+            #[cfg(feature = "dtls-rpk")]
+            CnCallback::Rpk(rpk) => rpk.validate_rpk(asn1_public_cert, session, validated),
+        } {
+            1
+        } else {
+            0
+        }
+    }
+
+    /// Wrapper function for the user-provided SNI callback.
+    ///
+    /// Stores the returned key in a way that ensures it is accessible for libcoap for the lifetime
+    /// of this encryption context.  
+    ///
+    /// **Important:** After the underlying [`PkiRpkContextInner`] is dropped, the returned
+    /// pointer will no longer be valid and should no longer be dereferenced.
+    fn sni_callback(&self, sni: &CStr) -> *mut coap_dtls_key_t {
+        let mut inner = self.inner.borrow_mut();
+        // This function is only ever called if an SNI key provider is set, so it's fine to unwrap
+        // here.
+        let key = inner.sni_key_provider.as_ref().unwrap().key_for_sni(sni);
+        if let Some(key) = key {
+            let key_ref = Box::into_raw(Box::new(key.as_raw_dtls_key()));
+            inner.provided_keys.push(key);
+            inner.provided_key_descriptors.push(key_ref);
+            key_ref
+        } else {
+            std::ptr::null_mut()
+        }
+    }
+
+    /// Restores a [`PkiRpkContext`] from a pointer to its inner structure (i.e. from the
+    /// user-provided pointer given to DTLS callbacks).
+    ///
+    /// # Panics
+    ///
+    /// Panics if the given pointer is a null pointer or the inner structure was already dropped.
+    ///
+    /// # Safety
+    /// The provided pointer must be a valid reference to a [`RefCell<PkiRpkContextInner<KTY>>`]
+    /// instance created from a call to [`Weak::into_raw()`].
+    unsafe fn from_raw(raw_ctx: *const RefCell<PkiRpkContextInner<'a, KTY>>) -> Self {
+        assert!(!raw_ctx.is_null(), "provided raw DTLS PKI context was null");
+        let inner_weak = Weak::from_raw(raw_ctx);
+        let inner = inner_weak
+            .upgrade()
+            .expect("provided DTLS PKI context was already dropped!");
+        let _ = Weak::into_raw(inner_weak);
+        PkiRpkContext { inner }
+    }
+}
+
+/// User-provided CN callback.
+///
+/// Depending on whether the encryption context is configured for RPK or PKI operation, the callback
+/// will be either a [`PkiCnValidator`] or a [`RpkValidator`].
+enum CnCallback<'a> {
+    /// CN callback for PKI based configuration.
+    #[cfg(feature = "dtls-pki")]
+    Pki(Box<dyn PkiCnValidator + 'a>),
+    /// CN callback for RPK based configuration.
+    #[cfg(feature = "dtls-rpk")]
+    Rpk(Box<dyn RpkValidator + 'a>),
+}
+
+/// Trait for things that can provide RPK/PKI DTLS keys for a given Server Name Indication.
+pub trait PkiRpkSniKeyProvider<KTY: KeyType> {
+    /// Provide a key for the server name indication given as `sni`, or `None` if the SNI is not
+    /// valid and no key is available.
+    ///
+    /// Note that libcoap will remember the returned key and re-use it for future handshakes with
+    /// the same SNI (even if the peer is not the same), the return value should therefore not
+    /// depend on the provided `session`.
+    fn key_for_sni(&self, sni: &CStr) -> Option<Box<dyn KeyDef<KeyType = KTY>>>;
+}
+
+impl<KTY: KeyType, T: Fn(&CStr) -> Option<Box<dyn KeyDef<KeyType = KTY>>>> PkiRpkSniKeyProvider<KTY> for T {
+    fn key_for_sni(&self, sni: &CStr) -> Option<Box<dyn KeyDef<KeyType = KTY>>> {
+        self(sni)
+    }
+}
+
+/// Raw CN callback that can be provided to libcoap.
+///
+/// # Safety
+///
+/// This function expects the arguments to be provided in a way that libcoap would when invoking
+/// this function as a CN callback.
+///
+/// Additionally, `session` must be a valid argument to [`CoapSession::from_raw`], and `arg` must be
+/// a valid argument to [`PkiRpkContext::from_raw`] (where the key type of `PkiRpkContext` matches
+/// the key type of this function).
+unsafe extern "C" fn dtls_pki_cn_callback<KTY: KeyType>(
+    cn: *const c_char,
+    asn1_public_cert: *const u8,
+    asn1_length: usize,
+    session: *mut coap_session_t,
+    depth: c_uint,
+    validated: c_int,
+    arg: *mut c_void,
+) -> c_int {
+    let session = CoapSession::from_raw(session);
+    let cn = CStr::from_ptr(cn);
+    let asn1_public_cert = std::slice::from_raw_parts(asn1_public_cert, asn1_length);
+    let validated = validated == 1;
+    let context = PkiRpkContext::from_raw(arg as *const RefCell<PkiRpkContextInner<KTY>>);
+    context.cn_callback(cn, asn1_public_cert, &session, depth, validated)
+}
+
+/// Raw PKI/RPK SNI callback that can be provided to libcoap.
+///
+/// # Safety
+///
+/// This function expects the arguments to be provided in a way that libcoap would when invoking
+/// this function as an PKI/RPK SNI callback.
+///
+/// Additionally, `arg` must be a valid argument to [`PkiRpkContext::from_raw`] (where the key type
+/// of `PkiRpkContext` matches the key type of this function).
+unsafe extern "C" fn dtls_pki_sni_callback<KTY: KeyType>(sni: *const c_char, arg: *mut c_void) -> *mut coap_dtls_key_t {
+    let sni = CStr::from_ptr(sni);
+    let context = PkiRpkContext::from_raw(arg as *const RefCell<PkiRpkContextInner<KTY>>);
+    context.sni_callback(sni)
+}
diff --git a/libcoap/src/crypto/pki_rpk/pki.rs b/libcoap/src/crypto/pki_rpk/pki.rs
new file mode 100644
index 00000000..bebf05f7
--- /dev/null
+++ b/libcoap/src/crypto/pki_rpk/pki.rs
@@ -0,0 +1,363 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * crypto/pki_rpk/pki.rs - Interfaces and types for PKI support in libcoap-rs.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+use crate::crypto::pki_rpk;
+use crate::crypto::pki_rpk::key::{KeyComponentSealed, KeyTypeSealed};
+use crate::crypto::pki_rpk::{
+    Asn1PrivateKeyType, CertVerificationMode, CertVerifying, CnCallback, DerFileKeyComponent, DerMemoryKeyComponent,
+    EngineKeyComponent, KeyComponent, KeyDef, KeyDefSealed, NonCertVerifying, PemFileKeyComponent,
+    PemMemoryKeyComponent, Pkcs11KeyComponent, PkiRpkContext, PkiRpkContextBuilder, ServerPkiRpkCryptoContext,
+};
+use crate::crypto::ClientCryptoContext;
+use crate::session::CoapSession;
+use libcoap_sys::{
+    coap_const_char_ptr_t, coap_dtls_key_t, coap_dtls_key_t__bindgen_ty_1, coap_dtls_pki_t, coap_pki_define_t,
+    coap_pki_key_define_t, coap_pki_key_t,
+};
+use std::ffi::{c_uint, CStr, CString};
+use std::fmt::Debug;
+
+/// (Marker) key type for keys with a certificate signed by a trusted CA.
+#[derive(Debug, Clone, Copy)]
+pub struct Pki {}
+
+impl KeyTypeSealed for Pki {
+    fn set_key_type_defaults(ctx: &mut coap_dtls_pki_t) {
+        ctx.is_rpk_not_cert = 0;
+    }
+}
+
+// If PKI is enabled, implement conversions for PKI contexts to PKI-supporting server/client-side
+// cryptographic contexts.
+
+impl<'a> From<PkiRpkContext<'a, Pki>> for ServerPkiRpkCryptoContext<'a> {
+    fn from(value: PkiRpkContext<'a, Pki>) -> Self {
+        ServerPkiRpkCryptoContext::Pki(value)
+    }
+}
+
+impl<'a> From<PkiRpkContext<'a, Pki>> for ClientCryptoContext<'a> {
+    fn from(value: PkiRpkContext<'a, Pki>) -> Self {
+        ClientCryptoContext::Pki(value)
+    }
+}
+
+impl<'a> PkiRpkContextBuilder<'a, Pki, NonCertVerifying> {
+    /// Enables PKI certificate verification of the peer's certificate when using the build
+    /// encryption context.
+    ///
+    /// Note: While this will enable peer certificate validation, the other settings relating to
+    /// certificate validation will not automatically be enabled.
+    /// In particular, you might want to consider enabling certificate chain validation using
+    /// [`PkiRpkContextBuilder::cert_chain_validation`].
+    ///
+    /// Depending on your circumstances, you might want to add additional root certificates
+    /// using [`CoapContext::set_pki_root_cas`](crate::CoapContext::set_pki_root_ca_paths).
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `verify_peer_cert` to `1` in the underlying [`coap_dtls_pki_t`]
+    /// structure.
+    pub fn verify_peer_cert(mut self) -> PkiRpkContextBuilder<'a, Pki, CertVerifying> {
+        self.ctx.raw_cfg.verify_peer_cert = 1;
+        PkiRpkContextBuilder::<Pki, CertVerifying> {
+            ctx: self.ctx,
+            verifying: Default::default(),
+        }
+    }
+}
+
+impl<'a> PkiRpkContextBuilder<'a, Pki, CertVerifying> {
+    pub fn new<K: KeyDef<KeyType = Pki> + 'a>(key: K) -> Self {
+        PkiRpkContextBuilder::<'a, Pki, NonCertVerifying>::new(key).verify_peer_cert()
+    }
+}
+
+impl<'a, V: CertVerificationMode> PkiRpkContextBuilder<'a, Pki, V> {
+    /// Sets the common name validator for this encryption context.
+    ///
+    /// The common name validator's [`validate_cn`](PkiCnValidator::validate_cn) function will be
+    /// called after the TLS level validation checks have been completed in order to check whether
+    /// the common name provided by the peer is allowed/as expected.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Setting a `cn_validator` will set the `validate_cn_call_back` of the underlying
+    /// [`coap_dtls_pki_t`] to a wrapper function, which will then call the CN validator.
+    pub fn cn_validator(mut self, validator: impl PkiCnValidator + 'a) -> Self {
+        self.ctx.cn_callback = Some(CnCallback::Pki(Box::new(validator)));
+        self.ctx.raw_cfg.validate_cn_call_back = Some(pki_rpk::dtls_pki_cn_callback::<Pki>);
+        self
+    }
+}
+
+/// Trait for types that can check whether a peer's or CA certificate's common name is allowed/as
+/// expected for a session.
+pub trait PkiCnValidator {
+    /// Validates the common name of a peer or intermediate certificate.
+    ///
+    /// Aside from the common name given as `cn`, this function is also provided with the raw bytes
+    /// of the ASN.1/DER encoded public certificate (`asn1_public_cert`), the respective `session`,
+    /// the TLS library's `validated` status and the current `depth` that should be validated.
+    ///
+    /// `depth` will be 0 for the peer's certificate, and larger than 0 for a CA certificate.
+    ///
+    /// Should return `true` if the connection is to be accepted and `false` if the connection
+    /// should be aborted.
+    ///
+    /// See [the libcoap documentation](https://libcoap.net/doc/reference/4.3.5/group__dtls.html#gaef7a2800757a4922102311c94c3fa529)
+    /// for more background information.
+    fn validate_cn(
+        &self,
+        cn: &CStr,
+        asn1_public_cert: &[u8],
+        session: &CoapSession,
+        depth: c_uint,
+        validated: bool,
+    ) -> bool;
+}
+
+impl<T: Fn(&CStr, &[u8], &CoapSession, c_uint, bool) -> bool> PkiCnValidator for T {
+    fn validate_cn(
+        &self,
+        cn: &CStr,
+        asn1_public_cert: &[u8],
+        session: &CoapSession,
+        depth: c_uint,
+        validated: bool,
+    ) -> bool {
+        self(cn, asn1_public_cert, session, depth, validated)
+    }
+}
+
+/// Key definition for a DTLS key consisting of a private key and a CA-signed certificate.
+///
+/// Optionally, it may also contain a CA certificate whose name will be sent to clients to indicate
+/// the key that they should themselves send.
+///
+/// # Note on key construction
+///
+/// For maximum compatibility, you should stick to the `with_*` constructors defined for this type.
+/// While in theory you could use an arbitrary combination of key component types for a key
+/// definition, those defined using `with_*` match explicit key types provided in libcoap and should
+/// therefore always be supported.
+///
+/// # The CA certificate field
+///
+/// **Important:** The CA certificate field/parameter is not to be confused with the CA certificate
+/// you may set while configuring HTTP servers. The CA certificate will **not** be sent in full to
+/// the peer during connection establishment and does not have to refer to the CA that signed the
+/// public certificate.
+/// It will only be used to set the CA list sent to the client for client certificate validation.
+///
+/// Therefore, in order for TLS certificate validation to succeed, the peer must already know the
+/// root CA's and all intermediate CAs' certificates.
+#[derive(Clone, Debug)]
+pub struct PkiKeyDef<CA: KeyComponent<Pki>, PK: KeyComponent<Pki>, SK: KeyComponent<Pki>> {
+    ca_cert: Option<CA>,
+    public_cert: PK,
+    private_key: SK,
+    user_pin: Option<CString>,
+    asn1_private_key_type: Asn1PrivateKeyType,
+}
+
+impl<CA: KeyComponent<Pki>, PK: KeyComponent<Pki>, SK: KeyComponent<Pki>> PkiKeyDef<CA, PK, SK> {
+    /// Creates a new key definition using the given components.
+    ///
+    /// # Parameters
+    ///
+    /// - `ca_cert`:     The certificate of the CA whose name should be provided to clients when
+    ///                  requesting client certificates.
+    ///                  **Important:** See the section in the struct-level documentation regarding
+    ///                  this field for more information.
+    /// - `public_cert`: The public (signed) certificate of this key.
+    /// - `private_key`: The private key.
+    /// - `user_pin`:    The PIN that should be used when unlocking a token (for PKCS11 keys stored
+    ///                  on a token, ignored otherwise)
+    /// - `asn1_private_key_type`: The type of the private key (only used for DER/ASN.1 encoded
+    ///                  keys).
+    pub fn new(
+        ca_cert: Option<CA>,
+        public_cert: PK,
+        private_key: SK,
+        user_pin: Option<CString>,
+        asn1_private_key_type: Asn1PrivateKeyType,
+    ) -> Self {
+        Self {
+            ca_cert,
+            public_cert,
+            private_key,
+            user_pin,
+            asn1_private_key_type,
+        }
+    }
+}
+
+impl PkiKeyDef<PemFileKeyComponent, PemFileKeyComponent, PemFileKeyComponent> {
+    /// Creates a new key definition using PEM-encoded files as components.
+    ///
+    /// See the documentation of [PkiKeyDef::new] for more information on the parameters, especially
+    /// regarding the `ca_cert` field.
+    pub fn with_pem_files(
+        ca_cert: Option<impl Into<PemFileKeyComponent>>,
+        public_cert: impl Into<PemFileKeyComponent>,
+        private_key: impl Into<PemFileKeyComponent>,
+    ) -> Self {
+        Self::new(
+            ca_cert.map(|v| v.into()),
+            public_cert.into(),
+            private_key.into(),
+            None,
+            Asn1PrivateKeyType::None,
+        )
+    }
+}
+
+impl PkiKeyDef<PemMemoryKeyComponent, PemMemoryKeyComponent, PemMemoryKeyComponent> {
+    /// Creates a new key definition using PEM-encoded byte sequences in memory as components.
+    ///
+    /// See the documentation of [`PkiKeyDef::new`] for more information on the parameters, especially
+    /// regarding the `ca_cert` field.
+    pub fn with_pem_memory(
+        ca_cert: Option<impl Into<PemMemoryKeyComponent>>,
+        public_cert: impl Into<PemMemoryKeyComponent>,
+        private_key: impl Into<PemMemoryKeyComponent>,
+    ) -> Self {
+        Self::new(
+            ca_cert.map(|v| v.into()),
+            public_cert.into(),
+            private_key.into(),
+            None,
+            Asn1PrivateKeyType::None,
+        )
+    }
+}
+
+impl PkiKeyDef<DerFileKeyComponent, DerFileKeyComponent, DerFileKeyComponent> {
+    /// Creates a new key definition using DER-encoded files as components.
+    ///
+    /// See the documentation of [`PkiKeyDef::new`] for more information on the parameters, especially
+    /// regarding the `ca_cert` field.
+    pub fn with_asn1_files(
+        ca_cert: Option<impl Into<DerFileKeyComponent>>,
+        public_cert: impl Into<DerFileKeyComponent>,
+        private_key: impl Into<DerFileKeyComponent>,
+        private_key_type: Asn1PrivateKeyType,
+    ) -> Self {
+        Self::new(
+            ca_cert.map(|v| v.into()),
+            public_cert.into(),
+            private_key.into(),
+            None,
+            private_key_type,
+        )
+    }
+}
+
+impl PkiKeyDef<DerMemoryKeyComponent, DerMemoryKeyComponent, DerMemoryKeyComponent> {
+    /// Creates a new key definition using DER-encoded byte sequences in memory as components.
+    ///
+    /// See the documentation of [`PkiKeyDef::new`] for more information on the parameters, especially
+    /// regarding the `ca_cert` field.
+    pub fn with_asn1_memory(
+        ca_cert: Option<impl Into<DerMemoryKeyComponent>>,
+        public_cert: impl Into<DerMemoryKeyComponent>,
+        private_key: impl Into<DerMemoryKeyComponent>,
+        private_key_type: Asn1PrivateKeyType,
+    ) -> Self {
+        Self::new(
+            ca_cert.map(|v| v.into()),
+            public_cert.into(),
+            private_key.into(),
+            None,
+            private_key_type,
+        )
+    }
+}
+
+impl PkiKeyDef<Pkcs11KeyComponent, Pkcs11KeyComponent, Pkcs11KeyComponent> {
+    /// Creates a new key definition using PKCS11 URIs as components.
+    ///
+    /// See the documentation of [`PkiKeyDef::new`] for more information on the parameters, especially
+    /// regarding the `ca_cert` field.
+    pub fn with_pkcs11(
+        ca_cert: Option<impl Into<Pkcs11KeyComponent>>,
+        public_cert: impl Into<Pkcs11KeyComponent>,
+        private_key: impl Into<Pkcs11KeyComponent>,
+        user_pin: Option<CString>,
+    ) -> Self {
+        Self::new(
+            ca_cert.map(|v| v.into()),
+            public_cert.into(),
+            private_key.into(),
+            user_pin,
+            Asn1PrivateKeyType::None,
+        )
+    }
+}
+
+impl<CA: KeyComponent<Pki>, PK: KeyComponent<Pki>, SK: KeyComponent<Pki>> KeyDefSealed for PkiKeyDef<CA, PK, SK> {
+    fn as_raw_dtls_key(&self) -> coap_dtls_key_t {
+        let (ca, ca_len) = self.ca_cert.as_ref().map(|v| v.as_raw_key_component()).unwrap_or((
+            coap_const_char_ptr_t {
+                u_byte: std::ptr::null(),
+            },
+            0,
+        ));
+        let (public_cert, public_cert_len) = self.public_cert.as_raw_key_component();
+        let (private_key, private_key_len) = self.private_key.as_raw_key_component();
+
+        coap_dtls_key_t {
+            key_type: coap_pki_key_t::COAP_PKI_KEY_DEFINE,
+            key: coap_dtls_key_t__bindgen_ty_1 {
+                define: coap_pki_key_define_t {
+                    ca,
+                    public_cert,
+                    private_key,
+                    ca_len,
+                    public_cert_len,
+                    private_key_len,
+                    ca_def: <CA as KeyComponentSealed<Pki>>::DEFINE_TYPE,
+                    public_cert_def: <PK as KeyComponentSealed<Pki>>::DEFINE_TYPE,
+                    private_key_def: <SK as KeyComponentSealed<Pki>>::DEFINE_TYPE,
+                    private_key_type: self.asn1_private_key_type.into(),
+                    user_pin: self.user_pin.as_ref().map(|v| v.as_ptr()).unwrap_or(std::ptr::null()),
+                },
+            },
+        }
+    }
+}
+
+impl<CA: KeyComponent<Pki>, PK: KeyComponent<Pki>, SK: KeyComponent<Pki>> KeyDef for PkiKeyDef<CA, PK, SK> {
+    type KeyType = Pki;
+}
+
+impl KeyComponentSealed<Pki> for PemFileKeyComponent {
+    const DEFINE_TYPE: coap_pki_define_t = coap_pki_define_t::COAP_PKI_KEY_DEF_PEM;
+}
+
+impl KeyComponentSealed<Pki> for PemMemoryKeyComponent {
+    const DEFINE_TYPE: coap_pki_define_t = coap_pki_define_t::COAP_PKI_KEY_DEF_PEM_BUF;
+}
+
+impl KeyComponentSealed<Pki> for DerFileKeyComponent {
+    const DEFINE_TYPE: coap_pki_define_t = coap_pki_define_t::COAP_PKI_KEY_DEF_DER;
+}
+
+impl KeyComponentSealed<Pki> for DerMemoryKeyComponent {
+    const DEFINE_TYPE: coap_pki_define_t = coap_pki_define_t::COAP_PKI_KEY_DEF_DER_BUF;
+}
+
+impl KeyComponentSealed<Pki> for Pkcs11KeyComponent {
+    const DEFINE_TYPE: coap_pki_define_t = coap_pki_define_t::COAP_PKI_KEY_DEF_PKCS11;
+}
+
+impl KeyComponentSealed<Pki> for EngineKeyComponent {
+    const DEFINE_TYPE: coap_pki_define_t = coap_pki_define_t::COAP_PKI_KEY_DEF_ENGINE;
+}
diff --git a/libcoap/src/crypto/pki_rpk/rpk.rs b/libcoap/src/crypto/pki_rpk/rpk.rs
new file mode 100644
index 00000000..1642bc75
--- /dev/null
+++ b/libcoap/src/crypto/pki_rpk/rpk.rs
@@ -0,0 +1,205 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * crypto/pki_rpk/rpk.rs - Interfaces and types for RPK support in libcoap-rs.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+use crate::crypto::pki_rpk;
+use crate::crypto::pki_rpk::key::{KeyComponentSealed, KeyTypeSealed};
+use crate::crypto::pki_rpk::{
+    Asn1PrivateKeyType, CnCallback, KeyComponent, KeyDef, KeyDefSealed, NonCertVerifying, PemMemoryKeyComponent,
+    Pkcs11KeyComponent, PkiRpkContext, PkiRpkContextBuilder, ServerPkiRpkCryptoContext,
+};
+use crate::crypto::ClientCryptoContext;
+use crate::session::CoapSession;
+use libcoap_sys::{
+    coap_const_char_ptr_t, coap_dtls_key_t, coap_dtls_key_t__bindgen_ty_1, coap_dtls_pki_t, coap_pki_define_t,
+    coap_pki_key_define_t, coap_pki_key_t,
+};
+use std::ffi::CString;
+use std::fmt::Debug;
+
+/// (Marker) key type for asymmetric DTLS keys not signed by a CA (raw public keys).
+#[derive(Debug, Clone, Copy)]
+pub struct Rpk {}
+
+impl KeyTypeSealed for Rpk {
+    fn set_key_type_defaults(ctx: &mut coap_dtls_pki_t) {
+        ctx.is_rpk_not_cert = 1;
+    }
+}
+
+// If PKI is enabled, implement conversions for PKI contexts to RPK-supporting server/client-side
+// cryptographic contexts.
+
+impl<'a> From<PkiRpkContext<'a, Rpk>> for ClientCryptoContext<'a> {
+    fn from(value: PkiRpkContext<'a, Rpk>) -> Self {
+        ClientCryptoContext::Rpk(value)
+    }
+}
+
+impl<'a> From<PkiRpkContext<'a, Rpk>> for ServerPkiRpkCryptoContext<'a> {
+    fn from(value: PkiRpkContext<'a, Rpk>) -> Self {
+        ServerPkiRpkCryptoContext::Rpk(value)
+    }
+}
+
+impl<'a> PkiRpkContextBuilder<'a, Rpk, NonCertVerifying> {
+    /// Sets the raw public key validator for this encryption context.
+    ///
+    /// The raw public key validator's [`validate_rpk`](RpkValidator::validate_rpk) function will be
+    /// called after the TLS-level validation checks have been completed in order to check whether
+    /// the RPK provided by the peer is allowed/as expected.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Setting an RPK validator will set the `validate_cn_call_back` of the underlying
+    /// [`coap_dtls_pki_t`] to a wrapper function, which will then call the RPK validator.
+    pub fn rpk_validator(mut self, validator: impl RpkValidator + 'a) -> Self {
+        self.ctx.cn_callback = Some(CnCallback::Rpk(Box::new(validator)));
+        self.ctx.raw_cfg.validate_cn_call_back = Some(pki_rpk::dtls_pki_cn_callback::<Rpk>);
+        self
+    }
+}
+
+/// Trait for types that can validate that a raw public key is the one expected for a given peer.
+pub trait RpkValidator {
+    /// Validates the raw public key of a peer.
+    ///
+    /// This function is provided with the public key (`asn1_public_key`), the respective `session`,
+    /// and the TLS library's `validated` status, and should return `true` if the connection is to
+    /// be accepted and `false` if the connection should be aborted.
+    ///
+    /// `asn1_encoded_key` should be the certificate structure defined in
+    /// [RFC 7250, section 3](https://datatracker.ietf.org/doc/html/rfc7250#section-3), which you
+    /// might be able to parse with crates like
+    /// [x509-cert](https://docs.rs/x509-cert/latest/x509_cert/index.html) and
+    /// [spki](https://docs.rs/spki/0.7.3/spki/index.html) to obtain and match the
+    /// SubjectPublicKeyInformation encoded within.
+    ///
+    /// See [the libcoap documentation](https://libcoap.net/doc/reference/4.3.5/group__dtls.html#gaef7a2800757a4922102311c94c3fa529)
+    /// for more information.
+    fn validate_rpk(&self, asn1_public_key: &[u8], session: &CoapSession, validated: bool) -> bool;
+}
+
+impl<T: Fn(&[u8], &CoapSession, bool) -> bool> RpkValidator for T {
+    fn validate_rpk(&self, asn1_public_key: &[u8], session: &CoapSession, validated: bool) -> bool {
+        self(asn1_public_key, session, validated)
+    }
+}
+
+/// Key definition for a DTLS key consisting of a private and public key component without a signed
+/// certificate.
+///
+/// # Note on key construction
+///
+/// For maximum compatibility, you should stick to the `with_*` constructors defined for this type.
+/// While in theory you could use an arbitrary combination of key component types for a key
+/// definition, those defined using `with_*` match explicit key types provided in libcoap and should
+/// therefore always be supported.
+#[derive(Clone, Debug)]
+pub struct RpkKeyDef<PK: KeyComponent<Rpk>, SK: KeyComponent<Rpk>> {
+    public_key: PK,
+    private_key: SK,
+    user_pin: Option<CString>,
+    asn1_private_key_type: Asn1PrivateKeyType,
+}
+
+impl<PK: KeyComponent<Rpk>, SK: KeyComponent<Rpk>> RpkKeyDef<PK, SK> {
+    /// Creates a new key definition using the given components.
+    ///
+    /// # Parameters
+    ///
+    /// - `public_key`:  The public key component of this key.
+    /// - `private_key`: The private key.
+    /// - `user_pin`:    The PIN that should be used when unlocking a token (for PKCS11 keys stored
+    ///                  on a token, ignored otherwise)
+    /// - `asn1_private_key_type`: The type of the private key (only used for DER/ASN.1 encoded
+    ///                  keys).
+    pub fn new(
+        public_key: PK,
+        private_key: SK,
+        user_pin: Option<CString>,
+        asn1_private_key_type: Asn1PrivateKeyType,
+    ) -> Self {
+        Self {
+            public_key,
+            private_key,
+            user_pin,
+            asn1_private_key_type,
+        }
+    }
+}
+
+impl RpkKeyDef<PemMemoryKeyComponent, PemMemoryKeyComponent> {
+    /// Creates a new key definition using PEM-encoded byte sequences in memory as components.
+    ///
+    /// See the documentation of [`RpkKeyDef::new`] for more information on the parameters.
+    pub fn with_pem_memory(
+        public_key: impl Into<PemMemoryKeyComponent>,
+        private_key: impl Into<PemMemoryKeyComponent>,
+    ) -> Self {
+        Self::new(public_key.into(), private_key.into(), None, Asn1PrivateKeyType::None)
+    }
+}
+
+impl RpkKeyDef<Pkcs11KeyComponent, Pkcs11KeyComponent> {
+    /// Creates a new key definition using PKCS11 URIs as components.
+    ///
+    /// See the documentation of [`RpkKeyDef::new`] for more information on the parameters.
+    pub fn with_pkcs11(
+        public_key: impl Into<Pkcs11KeyComponent>,
+        private_key: impl Into<Pkcs11KeyComponent>,
+        user_pin: Option<CString>,
+    ) -> Self {
+        Self::new(
+            public_key.into(),
+            private_key.into(),
+            user_pin,
+            Asn1PrivateKeyType::None,
+        )
+    }
+}
+
+impl<PK: KeyComponent<Rpk>, SK: KeyComponent<Rpk>> KeyDefSealed for RpkKeyDef<PK, SK> {
+    fn as_raw_dtls_key(&self) -> coap_dtls_key_t {
+        let (public_cert, public_cert_len) = self.public_key.as_raw_key_component();
+        let (private_key, private_key_len) = self.private_key.as_raw_key_component();
+
+        coap_dtls_key_t {
+            key_type: coap_pki_key_t::COAP_PKI_KEY_DEFINE,
+            key: coap_dtls_key_t__bindgen_ty_1 {
+                define: coap_pki_key_define_t {
+                    ca: coap_const_char_ptr_t {
+                        u_byte: std::ptr::null(),
+                    },
+                    public_cert,
+                    private_key,
+                    ca_len: 0,
+                    public_cert_len,
+                    private_key_len,
+                    ca_def: coap_pki_define_t::COAP_PKI_KEY_DEF_PEM,
+                    public_cert_def: <PK as KeyComponentSealed<Rpk>>::DEFINE_TYPE,
+                    private_key_def: <SK as KeyComponentSealed<Rpk>>::DEFINE_TYPE,
+                    private_key_type: self.asn1_private_key_type.into(),
+                    user_pin: self.user_pin.as_ref().map(|v| v.as_ptr()).unwrap_or(std::ptr::null()),
+                },
+            },
+        }
+    }
+}
+
+impl<PK: KeyComponent<Rpk>, SK: KeyComponent<Rpk>> KeyDef for RpkKeyDef<PK, SK> {
+    type KeyType = Rpk;
+}
+
+impl KeyComponentSealed<Rpk> for PemMemoryKeyComponent {
+    const DEFINE_TYPE: coap_pki_define_t = coap_pki_define_t::COAP_PKI_KEY_DEF_RPK_BUF;
+}
+
+impl KeyComponentSealed<Rpk> for Pkcs11KeyComponent {
+    const DEFINE_TYPE: coap_pki_define_t = coap_pki_define_t::COAP_PKI_KEY_DEF_PKCS11_RPK;
+}
diff --git a/libcoap/src/crypto/psk/client.rs b/libcoap/src/crypto/psk/client.rs
new file mode 100644
index 00000000..e8b09d1a
--- /dev/null
+++ b/libcoap/src/crypto/psk/client.rs
@@ -0,0 +1,335 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * crypto/psk/client.rs - Interfaces and types for client-side PSK support in libcoap-rs.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+use crate::crypto::psk::key::PskKey;
+use crate::error::SessionCreationError;
+use crate::session::CoapClientSession;
+use crate::types::CoapAddress;
+use crate::CoapContext;
+use libcoap_sys::{
+    coap_dtls_cpsk_info_t, coap_dtls_cpsk_t, coap_new_client_session_psk2, coap_proto_t, coap_session_t,
+    coap_str_const_t, COAP_DTLS_CPSK_SETUP_VERSION,
+};
+use std::cell::RefCell;
+use std::ffi::{c_char, c_void, CString, NulError};
+use std::fmt::Debug;
+use std::ptr::NonNull;
+use std::rc::{Rc, Weak};
+
+/// Builder for a client-side DTLS encryption context for use with pre-shared keys (PSK).
+#[derive(Debug)]
+pub struct ClientPskContextBuilder<'a> {
+    ctx: ClientPskContextInner<'a>,
+}
+
+impl<'a> ClientPskContextBuilder<'a> {
+    /// Creates a new context builder with the given `key` as the default key to use.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Providing a raw public key will set `psk_info` to the provided key in the underlying
+    /// [`coap_dtls_cpsk_t`] structure.
+    pub fn new(psk: PskKey<'a>) -> Self {
+        Self {
+            ctx: ClientPskContextInner {
+                raw_cfg: Box::new(coap_dtls_cpsk_t {
+                    version: COAP_DTLS_CPSK_SETUP_VERSION as u8,
+                    reserved: Default::default(),
+                    #[cfg(dtls_ec_jpake_support)]
+                    ec_jpake: 0,
+                    #[cfg(dtls_cid_support)]
+                    use_cid: 0,
+                    validate_ih_call_back: None,
+                    ih_call_back_arg: std::ptr::null_mut(),
+                    client_sni: std::ptr::null_mut(),
+                    psk_info: psk.into_raw_cpsk_info(),
+                }),
+                key_provider: None,
+                provided_keys: Vec::new(),
+                client_sni: None,
+            },
+        }
+    }
+
+    /// Sets the key provider that provides pre-shared keys based on the PSK hint received by the
+    /// server.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Setting a `key_provider` will set the `validate_ih_call_back` of the underlying
+    /// [`coap_dtls_cpsk_t`] to a wrapper function, which will then call the key provider.
+    ///
+    /// Keys returned by the key provider will be stored in the context for at least as long as they
+    /// are used by the respective session.
+    pub fn key_provider(mut self, key_provider: impl ClientPskHintKeyProvider<'a> + 'a) -> Self {
+        self.ctx.key_provider = Some(Box::new(key_provider));
+        self.ctx.raw_cfg.validate_ih_call_back = Some(dtls_psk_client_ih_callback);
+        self
+    }
+
+    /// Consumes this builder to construct the resulting PSK context.
+    pub fn build(self) -> ClientPskContext<'a> {
+        let ctx = Rc::new(RefCell::new(self.ctx));
+        {
+            let mut ctx_borrow = ctx.borrow_mut();
+            if ctx_borrow.raw_cfg.validate_ih_call_back.is_some() {
+                ctx_borrow.raw_cfg.ih_call_back_arg = Rc::downgrade(&ctx).into_raw() as *mut c_void;
+            }
+        }
+        ClientPskContext { inner: ctx }
+    }
+}
+
+impl<'a> From<ClientPskContext<'a>> for crate::crypto::ClientCryptoContext<'a> {
+    fn from(value: ClientPskContext<'a>) -> Self {
+        crate::crypto::ClientCryptoContext::Psk(value)
+    }
+}
+
+impl ClientPskContextBuilder<'_> {
+    /// Enables or disables support for EC JPAKE ([RFC 8236](https://datatracker.ietf.org/doc/html/rfc8236))
+    /// key exchanges in (D)TLS.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `ec_jpake` in the underlying [`coap_dtls_cpsk_t`] structure.
+    #[cfg(dtls_ec_jpake_support)]
+    pub fn ec_jpake(mut self, ec_jpake: bool) -> Self {
+        self.ctx.raw_cfg.ec_jpake = ec_jpake.into();
+        self
+    }
+
+    /// Enables or disables use of DTLS connection IDs ([RFC 9146](https://datatracker.ietf.org/doc/rfc9146/)).
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `use_cid` in the underlying [`coap_dtls_cpsk_t`] structure.
+    #[cfg(dtls_cid_support)]
+    pub fn use_cid(mut self, use_cid: bool) -> Self {
+        self.ctx.raw_cfg.use_cid = use_cid.into();
+        self
+    }
+
+    /// Sets the server name indication that should be sent to servers if the built
+    /// [`ClientPskContext`] is used.
+    ///
+    /// `client_sni` should be convertible into a byte string that does not contain null bytes.
+    /// Typically, you would provide a `&str` or `String`.
+    ///
+    /// # Errors
+    ///
+    /// Will return [`NulError`] if the provided byte string contains null bytes.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `client_sni` in the underlying [`coap_dtls_cpsk_t`] structure.
+    ///
+    /// The provided `client_sni` will be converted into a `Box<[u8]>`, which will be owned and
+    /// stored by the built context.
+    pub fn client_sni<T: Into<Vec<u8>>>(mut self, client_sni: T) -> Result<Self, NulError> {
+        // For some reason, client_sni is not immutable here.
+        // While I don't see any reason why libcoap would modify the string, it is not strictly
+        // forbidden for it to do so, so simply using CString::into_raw() is not an option (as it
+        // does not allow modifications to client_sni that change the length).
+        let sni = CString::new(client_sni.into())?
+            .into_bytes_with_nul()
+            .into_boxed_slice();
+        self.ctx.client_sni = Some(sni);
+        self.ctx.raw_cfg.client_sni = self.ctx.client_sni.as_mut().unwrap().as_mut_ptr() as *mut c_char;
+        Ok(self)
+    }
+}
+
+/// Client-side encryption context for PSK-based (D)TLS sessions.
+#[derive(Clone, Debug)]
+pub struct ClientPskContext<'a> {
+    /// Inner structure of this context.
+    inner: Rc<RefCell<ClientPskContextInner<'a>>>,
+}
+
+impl ClientPskContext<'_> {
+    /// Returns a pointer to the PSK to use for a given `identity_hint` and `session`, or
+    /// [`std::ptr::null()`] if the provided identity hint and/or session are unacceptable.
+    ///
+    /// The returned pointer is guaranteed to remain valid as long as the underlying
+    /// [`ClientPskContextInner`] is not dropped.
+    /// As the [`ClientPskContext`] is also stored in the [`CoapClientSession`] instance, this
+    /// implies that the pointer is valid for at least as long as the session is.
+    ///
+    /// **Important:** After the underlying [`ClientPskContextInner`] is dropped, the returned
+    /// pointer will no longer be valid and should no longer be dereferenced.
+    fn ih_callback(
+        &self,
+        identity_hint: Option<&[u8]>,
+        session: &CoapClientSession<'_>,
+    ) -> *const coap_dtls_cpsk_info_t {
+        let mut inner = (*self.inner).borrow_mut();
+        let key = inner
+            .key_provider
+            .as_ref()
+            .unwrap()
+            .key_for_identity_hint(identity_hint, session);
+
+        if let Some(key) = key {
+            let boxed_key_info = Box::new(key.into_raw_cpsk_info());
+            let boxed_key_ptr = Box::into_raw(boxed_key_info);
+            // TODO remove these entries prematurely if the underlying session is removed (would
+            //      require modifications to the client session drop handler).
+            inner.provided_keys.push(boxed_key_ptr);
+            boxed_key_ptr
+        } else {
+            std::ptr::null()
+        }
+    }
+
+    /// Creates a raw CoAP session object that is bound to and utilizes this encryption context.
+    ///
+    /// # Safety
+    ///
+    /// This [`ClientPskContext`] must outlive the returned [`coap_session_t`].
+    pub(crate) unsafe fn create_raw_session(
+        &self,
+        ctx: &mut CoapContext<'_>,
+        addr: &CoapAddress,
+        proto: coap_proto_t,
+    ) -> Result<NonNull<coap_session_t>, SessionCreationError> {
+        // SAFETY: self.raw_context is guaranteed to be valid, local_if can be null,
+        // raw_cfg is of valid format (as constructed by the builder).
+        {
+            let mut inner = (*self.inner).borrow_mut();
+            NonNull::new(unsafe {
+                coap_new_client_session_psk2(
+                    ctx.as_mut_raw_context(),
+                    std::ptr::null(),
+                    addr.as_raw_address(),
+                    proto,
+                    inner.raw_cfg.as_mut(),
+                )
+            })
+            .ok_or(SessionCreationError::Unknown)
+        }
+    }
+}
+
+impl<'a> ClientPskContext<'a> {
+    /// Restores a [`ClientPskContext`] from a pointer to its inner structure (i.e., from the
+    /// user-provided pointer given to DTLS callbacks).
+    ///
+    /// # Panics
+    ///
+    /// Panics if the given pointer is a null pointer or the inner structure was already dropped.
+    ///
+    /// # Safety
+    /// The provided pointer must be a valid reference to a [`RefCell<ClientPskContextInner>`]
+    /// instance created from a call to [`Weak::into_raw()`].
+    unsafe fn from_raw(raw_ctx: *const RefCell<ClientPskContextInner<'a>>) -> Self {
+        assert!(!raw_ctx.is_null(), "provided raw DTLS PSK client context was null");
+        let inner_weak = Weak::from_raw(raw_ctx);
+        let inner = inner_weak
+            .upgrade()
+            .expect("provided DTLS PSK client context was already dropped!");
+        let _ = Weak::into_raw(inner_weak);
+        ClientPskContext { inner }
+    }
+}
+
+/// Inner structure of a client-side PSK context.
+#[derive(Debug)]
+struct ClientPskContextInner<'a> {
+    /// Raw configuration object.
+    raw_cfg: Box<coap_dtls_cpsk_t>,
+    /// User-supplied key provider.
+    key_provider: Option<Box<dyn ClientPskHintKeyProvider<'a> + 'a>>,
+    /// Store for `coap_dtls_cpsk_info_t` instances that we provided in previous identity hint
+    /// callback invocations.
+    ///
+    /// The stored pointers *must* all be created from [`Box::into_raw`].
+    ///
+    /// Using `Vec<coap_dtls_cpsk_info_t>` instead is not an option, as a `Vec` resize may cause the
+    /// instances to be moved to a different place in memory, invalidating pointers provided to
+    /// libcoap.
+    provided_keys: Vec<*mut coap_dtls_cpsk_info_t>,
+    /// Server Name Indication to send to servers.
+    client_sni: Option<Box<[u8]>>,
+}
+
+impl Drop for ClientPskContextInner<'_> {
+    fn drop(&mut self) {
+        for provided_key in std::mem::take(&mut self.provided_keys).into_iter() {
+            // SAFETY: Vector has only ever been filled by instances created from to_raw_cpsk_info.
+            unsafe {
+                PskKey::from_raw_cpsk_info(*Box::from_raw(provided_key));
+            }
+        }
+        if !self.raw_cfg.ih_call_back_arg.is_null() {
+            // SAFETY: If we set this, it must have been a call to Weak::into_raw with the correct
+            //         type.
+            unsafe {
+                Weak::from_raw(self.raw_cfg.ih_call_back_arg as *mut RefCell<Self>);
+            }
+        }
+        unsafe {
+            // SAFETY: Pointer should not have been changed by anything else and refers to a CPSK
+            //         info instance created from DtlsPsk::into_raw_cpsk_info().
+            PskKey::from_raw_cpsk_info(self.raw_cfg.psk_info);
+        }
+    }
+}
+
+/// Trait for types that can provide the appropriate pre-shared key for a given PSK hint sent by the
+/// server.
+pub trait ClientPskHintKeyProvider<'a>: Debug {
+    /// Returns the appropriate pre-shared key for a given `identity_hint` and the given `session`,
+    /// or `None` if the session should be aborted/no key is available.
+    fn key_for_identity_hint(
+        &self,
+        identity_hint: Option<&[u8]>,
+        session: &CoapClientSession<'_>,
+    ) -> Option<PskKey<'a>>;
+}
+
+impl<'a, T: Debug> ClientPskHintKeyProvider<'a> for T
+where
+    T: AsRef<PskKey<'a>>,
+{
+    /// Returns the key if the supplied `identity_hint` is `None` or the key's identity matches the
+    /// hint.
+    fn key_for_identity_hint(
+        &self,
+        identity_hint: Option<&[u8]>,
+        _session: &CoapClientSession<'_>,
+    ) -> Option<PskKey<'a>> {
+        let key = self.as_ref();
+        if identity_hint.is_none() || key.identity() == identity_hint {
+            Some(key.clone())
+        } else {
+            None
+        }
+    }
+}
+
+/// Raw PSK identity hint callback that can be provided to libcoap.
+///
+/// # Safety
+///
+/// This function expects the arguments to be provided in a way that libcoap would when invoking
+/// this function as an identity hint callback.
+///
+/// Additionally, `arg` must be a valid argument to [`ClientPskContext::from_raw`].
+unsafe extern "C" fn dtls_psk_client_ih_callback(
+    hint: *mut coap_str_const_t,
+    session: *mut coap_session_t,
+    userdata: *mut c_void,
+) -> *const coap_dtls_cpsk_info_t {
+    let session = CoapClientSession::from_raw(session);
+    let client_context = ClientPskContext::from_raw(userdata as *const RefCell<ClientPskContextInner>);
+    let provided_identity =
+        NonNull::new(hint).map(|h| std::slice::from_raw_parts((*h.as_ptr()).s, (*h.as_ptr()).length));
+    client_context.ih_callback(provided_identity, &session)
+}
diff --git a/libcoap/src/crypto/psk/key.rs b/libcoap/src/crypto/psk/key.rs
new file mode 100644
index 00000000..eebf94de
--- /dev/null
+++ b/libcoap/src/crypto/psk/key.rs
@@ -0,0 +1,206 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * crypto/psk/key.rs - Interfaces and types for PSK keys in libcoap-rs.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+use libcoap_sys::{coap_bin_const_t, coap_dtls_cpsk_info_t, coap_dtls_spsk_info_t};
+use std::borrow::Cow;
+use std::marker::PhantomData;
+use std::ptr::NonNull;
+
+/// A pre-shared DTLS key.
+#[derive(Debug, Clone)]
+pub struct PskKey<'a> {
+    /// Identity of this key (or None if no identity is known).
+    identity: Option<Box<[u8]>>,
+    /// Actual key data (the key bytes).
+    data: Box<[u8]>,
+    // This lifetime is not strictly necessary for now. This is just future-proofing for later
+    // changes, which might allow PskKey instances with limited lifetimes (e.g. using borrowed byte
+    // slices).
+    // In practice (at least for now), all PskKey instances have a 'static lifetime.
+    _lifetime_marker: PhantomData<&'a ()>,
+}
+
+impl<'a> PskKey<'a> {
+    /// Creates a new key object with the given `identity` and the actual key bytes given in `data`.
+    pub fn new<T: Into<Vec<u8>>, U: Into<Vec<u8>>>(identity: Option<T>, data: U) -> PskKey<'a> {
+        PskKey {
+            identity: identity.map(Into::into).map(|v| v.into_boxed_slice()),
+            data: data.into().into_boxed_slice(),
+            _lifetime_marker: Default::default(),
+        }
+    }
+}
+
+impl PskKey<'_> {
+    /// Returns the key's identity or `None` if no key identity was set.
+    pub fn identity(&self) -> Option<&[u8]> {
+        self.identity.as_ref().map(|v| v.as_ref())
+    }
+
+    /// Returns the key data bytes as an immutable slice.
+    pub fn data(&self) -> &[u8] {
+        self.data.as_ref()
+    }
+
+    /// Creates a [`coap_dtls_spsk_info_t`] instance from this [`PskKey`].
+    ///
+    /// This call converts the identity and data field of this PSK into raw pointers and creates a
+    /// [`coap_dtls_spsk_info_t`] structure that allows libcoap to use those values.
+    ///
+    /// After this call, the caller is responsible for managing the memory allocated for the
+    /// identity and key byte strings referred to be the created struct instance, i.e., simply
+    /// dropping the created [`coap_dtls_spsk_info_t`] will cause a memory leak.
+    /// The easiest way to clean up the memory is by calling [`from_raw_spsk_info`](Self::from_raw_spsk_info)
+    /// to reverse the conversion done by this method and then dropping the restored [`PskKey`]
+    /// instance.
+    pub(crate) fn into_raw_spsk_info(self) -> coap_dtls_spsk_info_t {
+        let (hint, key) = self.into_bin_consts();
+        coap_dtls_spsk_info_t { hint, key }
+    }
+
+    /// Restores a `DtlsPsk` instance from a [`coap_dtls_spsk_info_t`] structure.
+    ///
+    /// # Safety
+    ///
+    /// The provided object must point to a valid instance of [`coap_dtls_spsk_info_t`] that *must*
+    /// have been created by a previous call to [`into_raw_spsk_info`](Self::into_raw_spsk_info).
+    ///
+    /// The byte strings the provided `spsk_info` points to *must* not be in use anywhere else (as
+    /// this might violate the aliasing rules), i.e. libcoap must no longer use these byte strings.
+    pub(crate) unsafe fn from_raw_spsk_info(spsk_info: coap_dtls_spsk_info_t) -> Self {
+        // SAFETY: Caller contract requires the provided spsk_info to be created by a previous call
+        // to into_raw_spsk_info.
+        Self::from_bin_consts(&spsk_info.hint, &spsk_info.key)
+    }
+
+    /// Creates a [`coap_dtls_cpsk_info_t`] instance from this [`PskKey`].
+    ///
+    /// This call converts the identity and data field of this PSK into raw pointers and creates a
+    /// [`coap_dtls_cpsk_info_t`] structure that allows libcoap to use those values.
+    ///
+    /// After this call, the caller is responsible for managing the memory allocated for the
+    /// identity and key byte strings referred to be the created struct instance, i.e., simply
+    /// dropping the created [`coap_dtls_cpsk_info_t`] will cause a memory leak.
+    /// The easiest way to clean up the memory is by calling [`from_raw_cpsk_info`](Self::from_raw_cpsk_info)
+    /// to reverse the conversion done by this method and then dropping the restored [`PskKey`]
+    /// instance.
+    pub(crate) fn into_raw_cpsk_info(self) -> coap_dtls_cpsk_info_t {
+        let (identity, key) = self.into_bin_consts();
+        coap_dtls_cpsk_info_t { identity, key }
+    }
+
+    /// Restores a DtlsPsk instance from a [`coap_dtls_cpsk_info_t`] structure.
+    ///
+    /// # Safety
+    ///
+    /// The provided object must point to a valid instance of [`coap_dtls_cpsk_info_t`] that *must*
+    /// have been created by a previous call to [`into_raw_cpsk_info`](Self::into_raw_cpsk_info).
+    ///
+    /// The byte strings the provided `cpsk_info` points to *must* not be in use anywhere else (as
+    /// this might violate the aliasing rules), i.e., libcoap must no longer use these byte strings.
+    pub(crate) unsafe fn from_raw_cpsk_info(cpsk_info: coap_dtls_cpsk_info_t) -> Self {
+        // SAFETY: Caller contract requires the provided cpsk_info to be created by a previous call
+        // to into_raw_cpsk_info.
+        Self::from_bin_consts(&cpsk_info.identity, &cpsk_info.key)
+    }
+
+    /// Consumes this key object to create two [`coap_bin_const_t`] instances referring to the
+    /// `identity` and `data` fields.
+    ///
+    /// The pointers given in [`coap_bin_const_t`] have been created by a call to [`Box::into_raw`]
+    /// with the `length` field set to the length of the given field.
+    fn into_bin_consts(self) -> (coap_bin_const_t, coap_bin_const_t) {
+        let identity = self
+            .identity
+            .map(|v| coap_bin_const_t {
+                length: v.len(),
+                s: Box::into_raw(v) as *const u8,
+            })
+            .unwrap_or(coap_bin_const_t {
+                length: 0,
+                s: std::ptr::null(),
+            });
+        let key = coap_bin_const_t {
+            length: self.data.len(),
+            s: Box::into_raw(self.data) as *const u8,
+        };
+        (identity, key)
+    }
+
+    /// Converts the given pair of [`coap_bin_const_t`]s back into a [`PskKey`] instance with the
+    /// given `identity` and `key`
+    ///
+    /// # Safety
+    /// The provided `identity` and `key` must have been created by a previous call to
+    /// [`PskKey::into_bin_consts`], the `length` field and pointers of both constants must not have
+    /// been modified.
+    unsafe fn from_bin_consts(identity: &coap_bin_const_t, key: &coap_bin_const_t) -> Self {
+        // SAFETY: Caller contract requires the provided identity and key to be created by a
+        // previous call to into_bin_consts, which means that the pointer in identity.s refers to a
+        // pointer created by a previous call to Box::into_raw(), identity.length refers
+        // to the correct length of the slice, and the pointer can actually be treated as a mutable
+        // pointer.
+        let identity = NonNull::new(identity.s as *mut u8)
+            .map(|mut v| unsafe { Box::from_raw(std::slice::from_raw_parts_mut(v.as_mut(), identity.length)) });
+
+        // SAFETY same as above.
+        let data = unsafe { Box::from_raw(std::slice::from_raw_parts_mut(key.s as *mut u8, key.length)) };
+        Self {
+            identity,
+            data,
+            _lifetime_marker: Default::default(),
+        }
+    }
+}
+
+impl From<Box<[u8]>> for PskKey<'static> {
+    fn from(value: Box<[u8]>) -> Self {
+        PskKey {
+            identity: None,
+            data: value,
+            _lifetime_marker: Default::default(),
+        }
+    }
+}
+
+impl From<&[u8]> for PskKey<'static> {
+    fn from(value: &[u8]) -> Self {
+        PskKey {
+            identity: None,
+            data: value.into(),
+            _lifetime_marker: Default::default(),
+        }
+    }
+}
+
+impl<'a> From<Cow<'a, [u8]>> for PskKey<'static> {
+    fn from(value: Cow<'a, [u8]>) -> Self {
+        PskKey {
+            identity: None,
+            data: value.into(),
+            _lifetime_marker: Default::default(),
+        }
+    }
+}
+
+impl<T: Into<Box<[u8]>>, U: Into<Box<[u8]>>> From<(T, U)> for PskKey<'static> {
+    fn from(value: (T, U)) -> Self {
+        PskKey {
+            identity: Some(value.0.into()),
+            data: value.1.into(),
+            _lifetime_marker: Default::default(),
+        }
+    }
+}
+
+impl<'a> AsRef<PskKey<'a>> for PskKey<'a> {
+    fn as_ref(&self) -> &PskKey<'a> {
+        self
+    }
+}
diff --git a/libcoap/src/crypto/psk/mod.rs b/libcoap/src/crypto/psk/mod.rs
new file mode 100644
index 00000000..aebd19bc
--- /dev/null
+++ b/libcoap/src/crypto/psk/mod.rs
@@ -0,0 +1,109 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * crypto/psk/mod.rs - Interfaces and types for PSK support in libcoap-rs.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+//! Types and traits related to support for (D)TLS with pre-shared keys for CoAP.
+//!
+//! PSK configuration differs between client-side and server-side.
+//!
+//! # Client Configuration
+//! Typically, you would follow these steps to configure a DTLS PSK client:
+//! 1. Create a [`PskKey`](psk::PskKey) that should be used as a default key when connecting to servers.
+//! 2. Create a [`ClientPskContextBuilder`](psk::ClientPskContextBuilder) using the default key,
+//!    (optionally) make some additional configuration changes in the builder.
+//!    Most notably, you might want to call [`ClientPskContextBuilder::key_provider`](psk::ClientPskContextBuilder::key_provider)
+//!    to set a key provider that may use server-provided identity hints to select a different key
+//!    than the default key (if your target server sends those hints).
+//! 3. Call [`ClientPskContextBuilder::build`](psk::ClientPskContextBuilder::build) to create a
+//!    [`ClientPskContext`](psk::ClientPskContext).
+//! 4. Provide the created context to [`CoapClientSession::connect_dtls`](crate::session::CoapClientSession::connect_dtls).
+//!
+//! ## Example
+//!
+//! ```no_run
+//! use libcoap_rs::CoapContext;
+//! use libcoap_rs::crypto::psk::{ClientPskContextBuilder, PskKey};
+//! use libcoap_rs::session::CoapClientSession;
+//!
+//! let example_key = PskKey::new(Some("dtls_test_id_client1"), "dtls_test_key__1");
+//! let psk_context = ClientPskContextBuilder::new(example_key.clone());
+//!
+//! let psk_context = psk_context.build();
+//!
+//! let mut context = CoapContext::new().unwrap();
+//! let session = CoapClientSession::connect_dtls(
+//!                 &mut context,
+//!                 "example.com:5684".parse().unwrap(),
+//!                 psk_context
+//!               ).unwrap();
+//!
+//! // The session might not be immediately established, but you can already create and send
+//! // requests as usual after this point.
+//! // To check for errors and/or disconnections, you might want to call and check the return value
+//! // of `session.state()` occasionally.
+//! // For error handling, you might also want to register an event handler with the CoAP context.
+//! // Remaining code omitted for brevity, see the crate-level docs for a full example of client
+//! // operation.
+//! ```
+//!
+//! # Server Configuration
+//! Typically, you would follow these steps to configure a DTLS PSK server:
+//! 1. Create a [`PskKey`](psk::PskKey) that should be used as a default key when connecting to clients.
+//! 2. Create a [`ServerPskContextBuilder`](psk::ServerPskContextBuilder) using the default key, (optionally) make some additional
+//!    configuration changes in the builder.
+//!    Most notably, you might want to call [`ServerPskContextBuilder::id_key_provider`](psk::ServerPskContextBuilder::id_key_provider) to choose
+//!    different pre-shared keys depending on the identity sent by clients, and
+//!    [`ServerPskContextBuilder::sni_key_provider`](psk::ServerPskContextBuilder::sni_key_provider) to send different identity hints for different
+//!    requested domains.
+//! 3. Call [`ServerPskContextBuilder::build`](psk::ServerPskContextBuilder::build) to create a [`ServerPskContext`](psk::ServerPskContext).
+//! 4. Provide the created context to [`CoapContext::set_psk_context`](crate::CoapContext::set_psk_context).
+//! 5. Add a DTLS endpoint using [`CoapContext::add_endpoint_dtls`](crate::CoapContext::add_endpoint_dtls).
+//!
+//! ## Example
+//!
+//! ```no_run
+//! use std::collections::HashMap;
+//! use libcoap_rs::CoapContext;
+//! use libcoap_rs::crypto::psk::{ClientPskContextBuilder, PskKey, ServerPskContextBuilder};
+//! use libcoap_rs::session::CoapClientSession;
+//!
+//!
+//! let example_key = PskKey::new(Some("dtls_test_id"), "dtls_test_key___");
+//!
+//! let mut client_keys = [
+//!     PskKey::new(Some("dtls_test_id_client1"), "dtls_test_key__1"),
+//!     PskKey::new(Some("dtls_test_id_client2"), "dtls_test_key__2"),
+//! ];
+//!
+//! let psk_context = ServerPskContextBuilder::new(example_key.clone())
+//!                     // Some types already implement ServerPskIdentityKeyProvider by default.
+//!                     // Namely, all types that implement AsRef<[PskKey]> do, such as [PskKey] and
+//!                     // Vec<PskKey>.
+//!                     .id_key_provider(client_keys);
+//!
+//! let psk_context = psk_context.build();
+//!
+//! let mut context = CoapContext::new().unwrap();
+//! context.set_psk_context(psk_context).expect("error while setting PSK context");
+//! context.add_endpoint_dtls("[::1]:5684".parse().unwrap()).expect("unable to create DTLS endpoint");
+//!
+//! // For error handling, you might want to register an event handler with the CoAP context.
+//! // Remaining code omitted for brevity, see the crate-level docs for a full example of server
+//! // operation.
+//!
+//! ```
+
+/// Data structures and builders for PSK client-side operation.
+mod client;
+/// Data structures for PSKs.
+mod key;
+/// Data structures and builders for PSK server-side operation.
+mod server;
+
+pub use client::*;
+pub use key::*;
+pub use server::*;
diff --git a/libcoap/src/crypto/psk/server.rs b/libcoap/src/crypto/psk/server.rs
new file mode 100644
index 00000000..eeb61bb7
--- /dev/null
+++ b/libcoap/src/crypto/psk/server.rs
@@ -0,0 +1,392 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * crypto/psk/server.rs - Interfaces and types for server-side PSK support in libcoap-rs.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+use crate::crypto::psk::key::PskKey;
+use crate::error::ContextConfigurationError;
+use crate::session::CoapServerSession;
+use libcoap_sys::{
+    coap_bin_const_t, coap_context_set_psk2, coap_context_t, coap_dtls_spsk_info_t, coap_dtls_spsk_t, coap_session_t,
+    COAP_DTLS_SPSK_SETUP_VERSION,
+};
+use std::borrow::Borrow;
+use std::cell::RefCell;
+use std::collections::{BTreeMap, HashMap};
+use std::ffi::{c_void, CStr};
+use std::fmt::Debug;
+use std::hash::Hash;
+use std::os::raw::c_char;
+use std::ptr::NonNull;
+use std::rc::{Rc, Weak};
+
+/// Builder for a server-side DTLS encryption context for use with pre-shared keys (PSK).
+#[derive(Debug)]
+pub struct ServerPskContextBuilder<'a> {
+    ctx: ServerPskContextInner<'a>,
+}
+
+impl<'a> ServerPskContextBuilder<'a> {
+    /// Creates a new context builder with the given `key` as the default key to use.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Providing a raw public key will set `psk_info` to the provided key in the underlying
+    /// [`coap_dtls_spsk_t`] structure.
+    pub fn new(key: PskKey<'a>) -> Self {
+        Self {
+            ctx: ServerPskContextInner {
+                id_key_provider: None,
+                sni_key_provider: None,
+                provided_keys: Vec::new(),
+                raw_cfg: Box::new(coap_dtls_spsk_t {
+                    version: COAP_DTLS_SPSK_SETUP_VERSION as u8,
+                    reserved: Default::default(),
+                    #[cfg(dtls_ec_jpake_support)]
+                    ec_jpake: 0,
+                    validate_id_call_back: None,
+                    id_call_back_arg: std::ptr::null_mut(),
+                    validate_sni_call_back: None,
+                    sni_call_back_arg: std::ptr::null_mut(),
+                    psk_info: key.into_raw_spsk_info(),
+                }),
+            },
+        }
+    }
+
+    /// Sets the key provider that provides a PSK for a given identity.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Setting a `id_key_provider` will set the `validate_id_call_back` of the underlying
+    /// [`coap_dtls_spsk_t`] to a wrapper function, which will then call the key provider.
+    pub fn id_key_provider(mut self, id_key_provider: impl ServerPskIdentityKeyProvider<'a> + 'a) -> Self {
+        self.ctx.id_key_provider = Some(Box::new(id_key_provider));
+        self.ctx.raw_cfg.validate_id_call_back = Some(dtls_psk_server_id_callback);
+        self
+    }
+
+    /// Sets the key provider that provides keys for a SNI provided by a client.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Setting a `sni_key_provider` will set the `validate_sni_call_back` of the underlying
+    /// [`coap_dtls_spsk_t`] to a wrapper function, which will then call the key provider.
+    ///
+    /// Keys returned by the key provider will be stored in the context for at least as long as they
+    /// are used by the respective session.
+    pub fn sni_key_provider(mut self, sni_key_provider: impl ServerPskSniKeyProvider<'a> + 'a) -> Self {
+        self.ctx.sni_key_provider = Some(Box::new(sni_key_provider));
+        self.ctx.raw_cfg.validate_sni_call_back = Some(dtls_psk_server_sni_callback);
+        self
+    }
+
+    /// Consumes this builder to construct the resulting PSK context.
+    pub fn build(self) -> ServerPskContext<'a> {
+        let ctx = Rc::new(RefCell::new(self.ctx));
+        {
+            let mut ctx_borrow = ctx.borrow_mut();
+            if ctx_borrow.raw_cfg.validate_id_call_back.is_some() {
+                ctx_borrow.raw_cfg.id_call_back_arg = Rc::downgrade(&ctx).into_raw() as *mut c_void
+            }
+            if ctx_borrow.raw_cfg.validate_sni_call_back.is_some() {
+                ctx_borrow.raw_cfg.sni_call_back_arg = Rc::downgrade(&ctx).into_raw() as *mut c_void
+            }
+        }
+        ServerPskContext { inner: ctx }
+    }
+}
+
+impl ServerPskContextBuilder<'_> {
+    /// Enables or disables support for EC JPAKE ([RFC 8236](https://datatracker.ietf.org/doc/html/rfc8236))
+    /// key exchanges in (D)TLS.
+    ///
+    /// # Implementation details (informative, not covered by semver guarantees)
+    ///
+    /// Equivalent to setting `ec_jpake` in the underlying [`coap_dtls_spsk_t`] structure.
+    #[cfg(dtls_ec_jpake_support)]
+    pub fn ec_jpake(mut self, ec_jpake: bool) -> Self {
+        self.ctx.raw_cfg.ec_jpake = ec_jpake.into();
+        self
+    }
+}
+
+#[derive(Debug)]
+struct ServerPskContextInner<'a> {
+    /// Raw configuration object.
+    raw_cfg: Box<coap_dtls_spsk_t>,
+    /// Store for `coap_dtls_spsk_info_t` instances that we provided in previous SNI or ID
+    /// callback invocations.
+    ///
+    /// The stored pointers *must* all be created from Box::into_raw().
+    ///
+    /// Using `Vec<coap_dtls_spsk_info_t>` instead is not an option, as a Vec resize may cause the
+    /// instances to be moved to a different place in memory, invalidating pointers provided to
+    /// libcoap.
+    provided_keys: Vec<*mut coap_dtls_spsk_info_t>,
+    /// User-supplied SNI key provider.
+    sni_key_provider: Option<Box<dyn ServerPskSniKeyProvider<'a> + 'a>>,
+    /// User-supplied identity key provider.
+    id_key_provider: Option<Box<dyn ServerPskIdentityKeyProvider<'a> + 'a>>,
+}
+
+impl Drop for ServerPskContextInner<'_> {
+    fn drop(&mut self) {
+        for provided_key in std::mem::take(&mut self.provided_keys).into_iter() {
+            // SAFETY: Vector has only ever been filled by instances created from to_raw_spsk_info.
+            unsafe {
+                PskKey::from_raw_spsk_info(*Box::from_raw(provided_key));
+            }
+        }
+        if !self.raw_cfg.id_call_back_arg.is_null() {
+            // SAFETY: If we set this, it must have been a call to Weak::into_raw with the correct
+            //         type.
+            unsafe {
+                Weak::from_raw(self.raw_cfg.id_call_back_arg as *mut Self);
+            }
+        }
+        if !self.raw_cfg.sni_call_back_arg.is_null() {
+            // SAFETY: If we set this, it must have been a call to Weak::into_raw with the correct
+            //         type.
+            unsafe {
+                Weak::from_raw(self.raw_cfg.sni_call_back_arg as *mut Self);
+            }
+        }
+        unsafe {
+            // SAFETY: Pointer should not have been changed by anything else and refers to a CPSK
+            //         info instance created from DtlsPsk::into_raw_cpsk_info().
+            PskKey::from_raw_spsk_info(self.raw_cfg.psk_info);
+        }
+    }
+}
+
+/// Server-side encryption context for PSK-based (D)TLS sessions.
+#[derive(Clone, Debug)]
+pub struct ServerPskContext<'a> {
+    /// Inner structure of this context.
+    inner: Rc<RefCell<ServerPskContextInner<'a>>>,
+}
+
+impl ServerPskContext<'_> {
+    /// Returns a pointer to the PSK key data to use for a given `identity` and `session`, or
+    /// [`std::ptr::null()`] if the provided identity hint and/or session are unacceptable.
+    ///
+    /// The returned pointer is guaranteed to remain valid as long as the underlying
+    /// [`ServerPskContextInner`] is not dropped.
+    /// As the [`ServerPskContext`] is also stored in the [`CoapServerSession`] instance, this
+    /// implies that the pointer is valid for at least as long as the session is.
+    ///
+    /// **Important:** After the underlying [`ServerPskContextInner`] is dropped, the returned
+    /// pointer will no longer be valid and should no longer be dereferenced.
+    fn id_callback(&self, identity: &[u8], session: &CoapServerSession<'_>) -> *const coap_bin_const_t {
+        let mut inner = (*self.inner).borrow_mut();
+        let key = inner
+            .id_key_provider
+            .as_ref()
+            .unwrap()
+            .key_for_identity(identity, session);
+
+        if let Some(key) = key {
+            let boxed_key_info = Box::new(key.into_raw_spsk_info());
+            let boxed_key_ptr = Box::into_raw(boxed_key_info);
+            // TODO remove these entries prematurely if the underlying session is removed (would
+            //      require modifications to the event handler).
+            inner.provided_keys.push(boxed_key_ptr);
+            // SAFETY: Pointer is obviously valid.
+            &unsafe { *boxed_key_ptr }.key
+        } else {
+            std::ptr::null()
+        }
+    }
+
+    /// Returns a pointer to the PSK (potentially with identity hint) to use for a given `sni` (and
+    /// `session`), or [`std::ptr::null()`] if the provided identity hint and/or session are
+    /// unacceptable.
+    ///
+    /// The returned pointer is guaranteed to remain valid as long as the underlying
+    /// [`ServerPskContextInner`] is not dropped.
+    /// As the [`ServerPskContext`] is also stored in the [`CoapServerSession`] instance, this
+    /// implies that the pointer is valid for at least as long as the session is.
+    ///
+    /// **Important:** After the underlying [`ServerPskContextInner`] is dropped, the returned
+    /// pointer will no longer be valid and should no longer be dereferenced.
+    fn sni_callback(&self, sni: &CStr, session: &CoapServerSession<'_>) -> *const coap_dtls_spsk_info_t {
+        let mut inner = (*self.inner).borrow_mut();
+        let key = inner.sni_key_provider.as_ref().unwrap().key_for_sni(sni, session);
+
+        if let Some(key) = key {
+            let boxed_key_info = Box::new(key.into_raw_spsk_info());
+            let boxed_key_ptr = Box::into_raw(boxed_key_info);
+            inner.provided_keys.push(boxed_key_ptr);
+            // SAFETY: Pointer is obviously valid.
+            boxed_key_ptr
+        } else {
+            std::ptr::null()
+        }
+    }
+
+    /// Applies this encryption configuration to the given raw `coap_context_t`.
+    ///
+    /// # Errors
+    ///
+    /// Will return [`ContextConfigurationError::Unknown`] if the call to the underlying libcoap
+    /// function fails.
+    ///
+    /// # Safety
+    /// This [ServerPskContext] must outlive the provided CoAP context, the provided pointer must be
+    /// valid.
+    pub(crate) unsafe fn apply_to_context(
+        &self,
+        mut ctx: NonNull<coap_context_t>,
+    ) -> Result<(), ContextConfigurationError> {
+        let mut inner = self.inner.borrow_mut();
+        // SAFETY: context is valid as per caller contract, raw_cfg is a valid configuration as
+        // ensured by the builder.
+        match unsafe { coap_context_set_psk2(ctx.as_mut(), inner.raw_cfg.as_mut()) } {
+            1 => Ok(()),
+            _ => Err(ContextConfigurationError::Unknown),
+        }
+    }
+}
+
+impl<'a> ServerPskContext<'a> {
+    /// Restores a [`ServerPskContext`] from a pointer to its inner structure (i.e. from the
+    /// user-provided pointer given to DTLS callbacks).
+    ///
+    /// # Panics
+    ///
+    /// Panics if the given pointer is a null pointer or the inner structure was already dropped.
+    ///
+    /// # Safety
+    /// The provided pointer must be a valid reference to a [`RefCell<ServerPskContextInner>`]
+    /// instance created from a call to [`Weak::into_raw()`].
+    unsafe fn from_raw(raw_ctx: *const RefCell<ServerPskContextInner<'a>>) -> Self {
+        assert!(!raw_ctx.is_null(), "provided raw DTLS PSK server context was null");
+        let inner_weak = Weak::from_raw(raw_ctx);
+        let inner = inner_weak
+            .upgrade()
+            .expect("provided DTLS PSK server context was already dropped!");
+        let _ = Weak::into_raw(inner_weak);
+        ServerPskContext { inner }
+    }
+}
+
+/// Trait for types that can provide pre-shared keys for a key identity given by a client to a
+/// server.
+pub trait ServerPskIdentityKeyProvider<'a>: Debug {
+    /// Provides the key for the key `identity` given by the client that is connected through
+    /// `session`, or `None` if the identity unacceptable or no key is available.
+    fn key_for_identity(&self, identity: &[u8], session: &CoapServerSession<'_>) -> Option<PskKey<'a>>;
+}
+
+impl<'a, T: Debug> ServerPskIdentityKeyProvider<'a> for T
+where
+    T: AsRef<[PskKey<'a>]>,
+{
+    /// Returns the first key whose identity is equal to the one requested.
+    /// If not found, returns the first key that has no key ID set.
+    fn key_for_identity(&self, identity: &[u8], _session: &CoapServerSession<'_>) -> Option<PskKey<'a>> {
+        let keys = self.as_ref();
+        keys.iter()
+            .find(|k| k.identity().is_some_and(|kid| kid == identity))
+            .or_else(|| keys.iter().find(|k| k.identity().is_none()))
+            .cloned()
+    }
+}
+
+/// Trait for things that can provide PSK DTLS keys for a given Server Name Indication.
+pub trait ServerPskSniKeyProvider<'a>: Debug {
+    /// Provide a key for the server name indication given as `sni`, or `None` if the SNI is not
+    /// valid and no key is available.
+    ///
+    /// Note that libcoap will remember the returned key and re-use it for future handshakes with
+    /// the same SNI (even if the peer is not the same), the return value should therefore not
+    /// depend on the provided `session`.
+    fn key_for_sni(&self, sni: &CStr, session: &CoapServerSession<'_>) -> Option<PskKey<'a>>;
+}
+
+impl<'a, T: AsRef<[u8]> + Debug, U: AsRef<PskKey<'a>> + Debug> ServerPskSniKeyProvider<'a> for Vec<(T, U)> {
+    /// Return the second tuple object if the first one matches the given SNI.
+    fn key_for_sni(&self, sni: &CStr, _session: &CoapServerSession<'_>) -> Option<PskKey<'a>> {
+        self.iter()
+            .find_map(|(key_sni, key)| (key_sni.as_ref() == sni.to_bytes()).then_some(key.as_ref().clone()))
+    }
+}
+
+impl<'a, T: AsRef<[u8]> + Debug, U: AsRef<PskKey<'a>> + Debug> ServerPskSniKeyProvider<'a> for [(T, U)] {
+    /// Return the second tuple object if the first one matches the given SNI.
+    fn key_for_sni(&self, sni: &CStr, _session: &CoapServerSession<'_>) -> Option<PskKey<'a>> {
+        self.iter()
+            .find_map(|(key_sni, key)| (key_sni.as_ref() == sni.to_bytes()).then_some(key.as_ref().clone()))
+    }
+}
+
+impl<'a, T: Borrow<[u8]> + Debug + Eq + Hash, U: AsRef<PskKey<'a>> + Debug> ServerPskSniKeyProvider<'a>
+    for HashMap<T, U>
+{
+    /// Return the map value if the key matches the given SNI.
+    fn key_for_sni(&self, sni: &CStr, _session: &CoapServerSession<'_>) -> Option<PskKey<'a>> {
+        self.get(sni.to_bytes()).map(|v| v.as_ref()).cloned()
+    }
+}
+
+impl<'a, T: Borrow<[u8]> + Debug + Ord, U: AsRef<PskKey<'a>> + Debug> ServerPskSniKeyProvider<'a> for BTreeMap<T, U> {
+    /// Return the map value if the key matches the given SNI.
+    fn key_for_sni(&self, sni: &CStr, _session: &CoapServerSession<'_>) -> Option<PskKey<'a>> {
+        self.get(sni.to_bytes()).map(|v| v.as_ref()).cloned()
+    }
+}
+
+/// Raw PSK identity callback that can be provided to libcoap.
+///
+/// # Safety
+///
+/// This function expects the arguments to be provided in a way that libcoap would when invoking
+/// this function as an identity callback.
+///
+/// Additionally, `arg` must be a valid argument to [`ServerPskContext::from_raw`].
+unsafe extern "C" fn dtls_psk_server_id_callback(
+    identity: *mut coap_bin_const_t,
+    session: *mut coap_session_t,
+    userdata: *mut c_void,
+) -> *const coap_bin_const_t {
+    let identity = std::slice::from_raw_parts((*identity).s, (*identity).length);
+    // We must not increase the refcount here, as doing so would require locking the global context,
+    // which is not possible during a DTLS callback.
+    // SAFETY: While we are in this callback, libcoap's context is locked by our current thread.
+    //         therefore, it is impossible that the reference counter would be decreased by any
+    //         other means, and constructing the server side session without increasing the refcount
+    //         is fine.
+    let session = CoapServerSession::from_raw_without_refcount(session);
+    let server_context = ServerPskContext::from_raw(userdata as *const RefCell<ServerPskContextInner>);
+    server_context.id_callback(identity, &session)
+}
+
+/// Raw PSK SNI callback that can be provided to libcoap.
+///
+/// # Safety
+///
+/// This function expects the arguments to be provided in a way that libcoap would when invoking
+/// this function as an PSK SNI callback.
+///
+/// Additionally, `arg` must be a valid argument to [`ServerPskContext::from_raw`].
+unsafe extern "C" fn dtls_psk_server_sni_callback(
+    sni: *const c_char,
+    session: *mut coap_session_t,
+    userdata: *mut c_void,
+) -> *const coap_dtls_spsk_info_t {
+    let sni = CStr::from_ptr(sni);
+    // We must not increase the refcount here, as doing so would require locking the global context,
+    // which is not possible during a DTLS callback.
+    // SAFETY: While we are in this callback, libcoap's context is locked by our current thread.
+    //         therefore, it is impossible that the reference counter would be decreased by any
+    //         other means, and constructing the server side session without increasing the refcount
+    //         is fine.
+    let session = CoapServerSession::from_raw_without_refcount(session);
+    let server_context = ServerPskContext::from_raw(userdata as *const RefCell<ServerPskContextInner>);
+    server_context.sni_callback(sni, &session)
+}
diff --git a/libcoap/src/error.rs b/libcoap/src/error.rs
index 5bea17f5..14fcf6f5 100644
--- a/libcoap/src/error.rs
+++ b/libcoap/src/error.rs
@@ -25,10 +25,14 @@ pub enum EndpointCreationError {
 }
 
 #[derive(Error, Debug, Copy, Clone, Eq, PartialEq)]
-pub enum ContextCreationError {
+pub enum ContextConfigurationError {
     /// Unknown error inside of libcoap
-    #[error("CoAP context creation error: unknown error in call to libcoap")]
+    #[error("CoAP context configuration error: unknown error in call to libcoap")]
     Unknown,
+    #[error(
+        "CoAP context configuration error: attempted to set encryption context while one has already been configured for this encryption variant"
+    )]
+    CryptoContextAlreadySet,
 }
 
 #[derive(Error, Debug, Copy, Clone, Eq, PartialEq)]
diff --git a/libcoap/src/lib.rs b/libcoap/src/lib.rs
index 29964cd0..9dcda7ab 100644
--- a/libcoap/src/lib.rs
+++ b/libcoap/src/lib.rs
@@ -19,7 +19,7 @@
 //!     - [x] UDP
 //!     - [x] DTLS
 //!         - [x] DTLS using PSK
-//!         - [ ] DTLS using PKI/RPK
+//!         - [x] DTLS using PKI/RPK
 //!     - [ ] TCP
 //!     - [ ] TLS
 //!     - [ ] OSCORE
@@ -77,6 +77,18 @@
 //! CONFIG_MBEDTLS_KEY_EXCHANGE_PSK=y
 //! ```
 //!
+//! # Using cryptography
+//! If you wish to use CoAP over DTLS, you have to provide credential and key information to
+//! libcoap. See the documentation of the [`crypto`] module for more information and examples.
+//!
+//! libcoap requires a DTLS library to be selected for DTLS functionality. By default, libcoap-rs
+//! will use `openssl` for this purpose. If you wish to use one of the other supported DTLS
+//! libraries (GnuTLS, MbedTLS, tinydtls), disable the `dtls_openssl` feature and replace it with
+//! the feature for the library of your choice.
+//!
+//! Note that enabling multiple backends is not possible and doing so will result in a single
+//! backend being chosen based on the priority order (gnutls > openssl > mbedtls > tinydtls).
+//!
 //! # Examples
 //!
 //! ## Client
@@ -144,23 +156,9 @@
 //!     session::{CoapSessionCommon, CoapServerSession},
 //! };
 //!
-//! // This will give us a SocketAddress with a port in the local port range automatically
-//! // assigned by the operating system.
-//! // Because the UdpSocket goes out of scope, the Port will be free for usage by libcoap.
-//! // This seems to be the only portable way to get a port number assigned from the operating
-//! // system.
-//! // It is assumed here that after unbinding the temporary socket, the OS will not reassign
-//! // this port until we bind it again. This should work in most cases (unless we run on a
-//! // system with very few free ports), because at least Linux will not reuse port numbers
-//! // unless necessary, see https://unix.stackexchange.com/a/132524.
-//! let server_address = UdpSocket::bind("localhost:0")
-//!     .expect("Failed to bind server socket")
-//!     .local_addr()
-//!     .expect("Failed to get server socket address");
-//!
 //! // a new CoAP context and bind to the generated SocketAddr.
 //! let mut context = CoapContext::new().expect("Failed to create CoAP context");
-//! context.add_endpoint_udp(server_address).expect("Unable to add/bind to endpoint");
+//! context.add_endpoint_udp("[::1]:5683".parse().unwrap()).expect("Unable to add/bind to endpoint");
 //!
 //! // Create a new resource that is available at the URI path `hello_world`
 //! // The second argument can be used to provide any kind of user-specific data, which will
@@ -201,28 +199,15 @@
 //! // Properly shut down, completing outstanding IO requests and properly closing sessions.
 //! context.shutdown(Some(Duration::from_secs(0))).unwrap();
 //! ```
-//!
-//! # Using cryptography
-//! If you wish to use CoAP over DTLS, you have to provide credential and key information to
-//! libcoap. To do so, you need to provide an instance of [crypto::CoapClientCryptoProvider]
-//! to [session::CoapClientSession::connect_dtls()] (for client sessions) and/or an instance of
-//! [crypto::CoapServerCryptoProvider] to [CoapContext::set_server_crypto_provider()] (for server
-//! sessions).
-//!
-//! libcoap requires a DTLS library to be selected for DTLS functionality. By default, libcoap-rs
-//! will use `openssl` for this purpose. If you wish to use one of the other supported DTLS
-//! libraries (GnuTLS, MbedTLS, TinyDTLS), disable the `dtls_openssl` feature and replace it with
-//! the feature for the library of your choice.
-//!
-//! Note that enabling multiple backends is not possible and doing so will result in a single
-//! backend being chosen based on the priority order (gnutls > openssl > mbedtls > tinydtls).
+
+extern crate core;
 
 pub use context::CoapContext;
 pub use event::CoapEventHandler;
 pub use resource::{CoapRequestHandler, CoapResource};
 
 mod context;
-#[cfg(feature = "dtls")]
+#[cfg(dtls)]
 pub mod crypto;
 pub mod error;
 mod event;
diff --git a/libcoap/src/mem.rs b/libcoap/src/mem.rs
index e2d923ad..64097377 100644
--- a/libcoap/src/mem.rs
+++ b/libcoap/src/mem.rs
@@ -23,6 +23,7 @@ pub(crate) trait DropInnerExclusively {
     /// referenced by this instance is also dropped.
     ///
     /// # Panics
+    ///
     /// Panics if the inner part of this struct cannot be exclusively dropped, i.e., it is still
     /// used by another instance.
     fn drop_exclusively(self);
@@ -332,7 +333,7 @@ impl<T: Debug> CoapLendableFfiRcCell<T> {
         let ret_val = ref_box
             .upgrade()
             .expect("unable to restore CoapLendableFfiRcCell as the underlying value was already dropped");
-        Box::into_raw(ref_box);
+        assert_eq!(Box::into_raw(ref_box), ptr);
         ret_val
     }
 
diff --git a/libcoap/src/session/client.rs b/libcoap/src/session/client.rs
index b1bd7c09..47f241c2 100644
--- a/libcoap/src/session/client.rs
+++ b/libcoap/src/session/client.rs
@@ -11,35 +11,81 @@ use std::cell::{Ref, RefMut};
 use std::net::SocketAddr;
 
 use libcoap_sys::{
-    coap_bin_const_t, coap_dtls_cpsk_info_t, coap_dtls_cpsk_t, COAP_DTLS_SPSK_SETUP_VERSION, coap_new_client_session,
-    coap_new_client_session_psk2, coap_proto_t, coap_register_event_handler, coap_session_get_app_data,
-    coap_session_get_context, coap_session_get_type, coap_session_release, coap_session_set_app_data, coap_session_t,
-    coap_session_type_t, COAP_TOKEN_DEFAULT_MAX,
+    coap_new_client_session, coap_proto_t, coap_register_event_handler, coap_session_get_app_data,
+    coap_session_get_context, coap_session_get_type, coap_session_init_token, coap_session_release,
+    coap_session_set_app_data, coap_session_t, coap_session_type_t, COAP_TOKEN_DEFAULT_MAX,
 };
 
-use crate::{context::CoapContext, error::SessionCreationError, types::CoapAddress};
-#[cfg(feature = "dtls")]
-use crate::crypto::{CoapClientCryptoProvider, CoapCryptoProviderResponse, CoapCryptoPskIdentity, CoapCryptoPskInfo};
-#[cfg(not(feature = "dtls_mbedtls"))]
-use crate::crypto::dtls_ih_callback;
+use super::{CoapSessionCommon, CoapSessionInner, CoapSessionInnerProvider};
 use crate::event::event_handler_callback;
 use crate::mem::{CoapFfiRcCell, DropInnerExclusively};
 use crate::prng::coap_prng_try_fill;
+use crate::{context::CoapContext, error::SessionCreationError, types::CoapAddress};
 
-use super::{CoapSessionCommon, CoapSessionInner, CoapSessionInnerProvider};
+#[cfg(dtls)]
+use crate::crypto::ClientCryptoContext;
 
 #[derive(Debug)]
 struct CoapClientSessionInner<'a> {
     inner: CoapSessionInner<'a>,
-    #[cfg(feature = "dtls")]
-    crypto_provider: Option<Box<dyn CoapClientCryptoProvider>>,
-    #[cfg(feature = "dtls")]
-    crypto_current_data: Option<CoapCryptoPskInfo>,
-    // coap_dtls_cpsk_info_t created upon calling dtls_client_ih_callback().
-    // The caller of the callback will make a defensive copy, so this one only has
-    // to be valid for a very short time and can always be overridden.
-    #[cfg(feature = "dtls")]
-    crypto_last_info_ref: coap_dtls_cpsk_info_t,
+    #[cfg(dtls)]
+    // This field is actually referred to be libcoap, so it isn't actually unused.
+    #[allow(unused)]
+    crypto_ctx: Option<ClientCryptoContext<'a>>,
+}
+
+impl<'a> CoapClientSessionInner<'a> {
+    /// Initializes a new [`CoapClientSessionInner`] for an unencrypted session from its raw counterpart
+    /// with the provided initial information.
+    ///
+    /// Also initializes the message token to a random value to prevent off-path response spoofing
+    /// (see [RFC 7252, section 5.3.1](https://datatracker.ietf.org/doc/html/rfc7252#section-5.3.1)).
+    ///
+    /// # Safety
+    /// The provided pointer for `raw_session` must be valid and point to the newly constructed raw
+    /// session.
+    unsafe fn new(raw_session: *mut coap_session_t) -> CoapFfiRcCell<CoapClientSessionInner<'a>> {
+        // For insecure protocols, generate a random initial token to prevent off-path response
+        // spoofing, see https://datatracker.ietf.org/doc/html/rfc7252#section-5.3.1
+        let mut token = [0; COAP_TOKEN_DEFAULT_MAX as usize];
+        coap_prng_try_fill(&mut token).expect("unable to generate random initial token");
+        coap_session_init_token(raw_session, token.len(), token.as_ptr());
+
+        let inner_session = CoapFfiRcCell::new(CoapClientSessionInner {
+            inner: CoapSessionInner::new(raw_session),
+            #[cfg(dtls)]
+            crypto_ctx: None,
+        });
+
+        // SAFETY: raw session is valid, inner session pointer must be valid as it was just created
+        // from one of Rust's smart pointers.
+        coap_session_set_app_data(raw_session, inner_session.create_raw_weak());
+
+        inner_session
+    }
+
+    /// Initializes a new [`CoapClientSessionInner`] for an encrypted session from its raw counterpart
+    /// with the provided initial information.
+    ///
+    /// # Safety
+    /// The provided pointer for `raw_session` must be valid and point to the newly constructed raw
+    /// session.
+    #[cfg(dtls)]
+    unsafe fn new_with_crypto_ctx(
+        raw_session: *mut coap_session_t,
+        crypto_ctx: ClientCryptoContext<'a>,
+    ) -> CoapFfiRcCell<CoapClientSessionInner<'a>> {
+        let inner_session = CoapFfiRcCell::new(CoapClientSessionInner {
+            inner: CoapSessionInner::new(raw_session),
+            crypto_ctx: Some(crypto_ctx),
+        });
+
+        // SAFETY: raw session is valid, inner session pointer must be valid as it was just created
+        // from one of Rust's smart pointers.
+        coap_session_set_app_data(raw_session, inner_session.create_raw_weak());
+
+        inner_session
+    }
 }
 
 /// Representation of a client-side CoAP session.
@@ -49,79 +95,43 @@ pub struct CoapClientSession<'a> {
 }
 
 impl CoapClientSession<'_> {
-    /// Create a new DTLS encrypted session with the given peer.
-    ///
-    /// To supply cryptographic information (like PSK hints or key data), you have to provide a
-    /// struct implementing [CoapClientCryptoProvider].
+    /// Create a new DTLS encrypted session with the given peer `addr` using the given `crypto_ctx`.
     ///
     /// # Errors
     /// Will return a [SessionCreationError] if libcoap was unable to create a session (most likely
     /// because it was not possible to bind to a port).
-    #[cfg(feature = "dtls")]
-    pub fn connect_dtls<'a, P: 'static + CoapClientCryptoProvider>(
+    #[cfg(dtls)]
+    pub fn connect_dtls<'a>(
         ctx: &mut CoapContext<'a>,
         addr: SocketAddr,
-        mut crypto_provider: P,
+        crypto_ctx: impl Into<ClientCryptoContext<'a>>,
     ) -> Result<CoapClientSession<'a>, SessionCreationError> {
-        // Get default identity.
-        let id = crypto_provider.provide_default_info();
-        let client_setup_data = Box::into_raw(Box::new(coap_dtls_cpsk_t {
-            version: COAP_DTLS_SPSK_SETUP_VERSION as u8,
-            #[cfg(not(any(dtls_ec_jpake_support, dtls_cid_support)))]
-            reserved: [0; 7],
-            #[cfg(all(any(dtls_ec_jpake_support, dtls_cid_support), not(all(dtls_ec_jpake_support, dtls_cid_support))))]
-            reserved: [0; 6],
-            #[cfg(all(dtls_ec_jpake_support, dtls_cid_support))]
-            reserved: [0; 5],
-            #[cfg(dtls_ec_jpake_support)]
-            // TODO allow enabling this?
-            ec_jpake: 0,
-            // TODO allow enabling this?
-            #[cfg(dtls_cid_support)]
-            use_cid: 0,
-            validate_ih_call_back: {
-                // Unsupported by MbedTLS
-                #[cfg(not(feature = "dtls_mbedtls"))]
-                {
-                    Some(dtls_ih_callback)
-                }
-                #[cfg(feature = "dtls_mbedtls")]
-                {
-                    None
-                }
-            },
-            ih_call_back_arg: std::ptr::null_mut(),
-            client_sni: std::ptr::null_mut(),
-            psk_info: coap_dtls_cpsk_info_t {
-                identity: coap_bin_const_t {
-                    length: id.identity.len(),
-                    s: id.identity.as_ptr(),
+        let crypto_ctx = crypto_ctx.into();
+        // SAFETY: The returned raw session lives for as long as the constructed
+        // CoapClientSessionInner does, which is limited to the lifetime of crypto_ctx.
+        // When the CoapClientSessionInner instance is dropped, the session is dropped before the
+        // crypto context is.
+        let raw_session = unsafe {
+            match &crypto_ctx {
+                #[cfg(feature = "dtls-psk")]
+                ClientCryptoContext::Psk(psk_ctx) => {
+                    psk_ctx.create_raw_session(ctx, &addr.into(), coap_proto_t::COAP_PROTO_DTLS)?
                 },
-                key: coap_bin_const_t {
-                    length: id.key.len(),
-                    s: id.key.as_ptr(),
+                #[cfg(feature = "dtls-pki")]
+                ClientCryptoContext::Pki(pki_ctx) => {
+                    pki_ctx.create_raw_session(ctx, &addr.into(), coap_proto_t::COAP_PROTO_DTLS)?
                 },
-            },
-        }));
-        // SAFETY: self.raw_context is guaranteed to be valid, local_if can be null, constructed
-        // coap_dtls_cpsk_t is of valid format and has no out-of-bounds issues.
-        let raw_session = unsafe {
-            coap_new_client_session_psk2(
-                ctx.as_mut_raw_context(),
-                std::ptr::null(),
-                CoapAddress::from(addr).as_raw_address(),
-                coap_proto_t::COAP_PROTO_DTLS,
-                client_setup_data,
-            )
+                #[cfg(feature = "dtls-rpk")]
+                ClientCryptoContext::Rpk(rpk_ctx) => {
+                    rpk_ctx.create_raw_session(ctx, &addr.into(), coap_proto_t::COAP_PROTO_DTLS)?
+                },
+            }
         };
 
-        if raw_session.is_null() {
-            return Err(SessionCreationError::Unknown);
-        }
-
-        // SAFETY: raw_session was just checked, crypto_current_data is data provided to
-        // coap_new_client_session_psk2().
-        Ok(unsafe { CoapClientSession::new(raw_session, Some(id), Some(Box::new(crypto_provider))) })
+        // SAFETY: raw_session was just checked to be valid pointer.
+        Ok(CoapClientSession {
+            inner: unsafe { CoapClientSessionInner::new_with_crypto_ctx(raw_session.as_ptr(), crypto_ctx) },
+        })
     }
 
     /// Create a new unencrypted session with the given peer over UDP.
@@ -145,16 +155,9 @@ impl CoapClientSession<'_> {
         if session.is_null() {
             return Err(SessionCreationError::Unknown);
         }
-        // SAFETY: Session was just checked for validity, no crypto info was provided to
-        // coap_new_client_session().
-        Ok(unsafe {
-            CoapClientSession::new(
-                session as *mut coap_session_t,
-                #[cfg(feature = "dtls")]
-                None,
-                #[cfg(feature = "dtls")]
-                None,
-            )
+        // SAFETY: Session was just checked for validity.
+        Ok(CoapClientSession {
+            inner: unsafe { CoapClientSessionInner::new(session) },
         })
     }
 
@@ -179,70 +182,12 @@ impl CoapClientSession<'_> {
         if session.is_null() {
             return Err(SessionCreationError::Unknown);
         }
-        // SAFETY: Session was just checked for validity, no crypto info was provided to
-        // coap_new_client_session().
-        Ok(unsafe {
-            CoapClientSession::new(
-                session as *mut coap_session_t,
-                #[cfg(feature = "dtls")]
-                None,
-                #[cfg(feature = "dtls")]
-                None,
-            )
+        // SAFETY: Session was just checked for validity.
+        Ok(CoapClientSession {
+            inner: unsafe { CoapClientSessionInner::new(session) },
         })
     }
 
-    /// Initializes a new CoapClientSession from its raw counterpart with the provided initial
-    /// information.
-    ///
-    /// # Safety
-    /// The provided pointer for `raw_session` must be valid and point to the newly constructed raw
-    /// session.
-    ///
-    /// The provided value for `crypto_current_data` must be the one whose memory pointers were used
-    /// when calling `coap_new_client_session_*` (if any was provided).
-    unsafe fn new<'a>(
-        raw_session: *mut coap_session_t,
-        #[cfg(feature = "dtls")] crypto_current_data: Option<CoapCryptoPskInfo>,
-        #[cfg(feature = "dtls")] crypto_provider: Option<Box<dyn CoapClientCryptoProvider>>,
-    ) -> CoapClientSession<'a> {
-        let inner_session = CoapFfiRcCell::new(CoapClientSessionInner {
-            inner: CoapSessionInner::new(raw_session),
-            #[cfg(feature = "dtls")]
-            crypto_provider,
-            #[cfg(feature = "dtls")]
-            crypto_current_data,
-            #[cfg(feature = "dtls")]
-            crypto_last_info_ref: coap_dtls_cpsk_info_t {
-                identity: coap_bin_const_t {
-                    length: 0,
-                    s: std::ptr::null(),
-                },
-                key: coap_bin_const_t {
-                    length: 0,
-                    s: std::ptr::null(),
-                },
-            },
-        });
-
-        let client_session = CoapClientSession {
-            inner: inner_session.clone(),
-        };
-        // SAFETY: raw session is valid, inner session pointer must be valid as it was just created
-        // from one of Rusts smart pointers.
-        coap_session_set_app_data(raw_session, inner_session.create_raw_weak());
-
-        // For insecure protocols, generate a random initial token to prevent off-path response
-        // spoofing, see https://datatracker.ietf.org/doc/html/rfc7252#section-5.3.1
-        if !client_session.proto().is_secure() {
-            let mut token = [0; COAP_TOKEN_DEFAULT_MAX as usize];
-            coap_prng_try_fill(&mut token).expect("unable to generate random initial token");
-            client_session.init_token(&token)
-        }
-
-        client_session
-    }
-
     /// Restores a [CoapClientSession] from its raw counterpart.
     ///
     /// Note that it is not possible to statically infer the lifetime of the created session from
@@ -253,11 +198,13 @@ impl CoapClientSession<'_> {
     /// claim exclusive ownership of the client session.
     ///
     /// # Panics
+    ///
     /// Panics if the given pointer is a null pointer or the raw session is not a client-side
     /// session with app data.
     ///
     /// # Safety
-    /// The provided pointer must be valid.
+    /// The provided pointer must be valid, the provided session's app data must be a valid argument
+    /// to [`CoapFfiRawCell<CoapClientSessionInner>::clone_raw_rc`].
     pub(crate) unsafe fn from_raw<'a>(raw_session: *mut coap_session_t) -> CoapClientSession<'a> {
         assert!(!raw_session.is_null(), "provided raw session was null");
         let raw_session_type = coap_session_get_type(raw_session);
@@ -275,48 +222,6 @@ impl CoapClientSession<'_> {
             _ => unreachable!("unknown session type"),
         }
     }
-
-    /// Sets the provider for cryptographic information for this session.
-    #[cfg(feature = "dtls")]
-    pub fn set_crypto_provider(&mut self, crypto_provider: Option<Box<dyn CoapClientCryptoProvider>>) {
-        self.inner.borrow_mut().crypto_provider = crypto_provider;
-    }
-
-    #[cfg(feature = "dtls")]
-    pub(crate) fn provide_raw_key_for_hint(
-        &mut self,
-        hint: &CoapCryptoPskIdentity,
-    ) -> Option<*const coap_dtls_cpsk_info_t> {
-        let inner_ref = &mut *self.inner.borrow_mut();
-
-        match inner_ref.crypto_provider.as_mut().map(|v| v.provide_key_for_hint(hint)) {
-            Some(CoapCryptoProviderResponse::UseNew(new_data)) => {
-                inner_ref.crypto_current_data = Some(CoapCryptoPskInfo {
-                    identity: Box::from(hint),
-                    key: new_data,
-                });
-                inner_ref
-                    .crypto_current_data
-                    .as_ref()
-                    .unwrap()
-                    .apply_to_cpsk_info(&mut inner_ref.crypto_last_info_ref);
-                Some(&inner_ref.crypto_last_info_ref as *const coap_dtls_cpsk_info_t)
-            },
-            Some(CoapCryptoProviderResponse::UseCurrent) => {
-                if inner_ref.crypto_current_data.is_some() {
-                    inner_ref
-                        .crypto_current_data
-                        .as_ref()
-                        .unwrap()
-                        .apply_to_cpsk_info(&mut inner_ref.crypto_last_info_ref);
-                    Some(&inner_ref.crypto_last_info_ref as *const coap_dtls_cpsk_info_t)
-                } else {
-                    None
-                }
-            },
-            None | Some(CoapCryptoProviderResponse::Unacceptable) => None,
-        }
-    }
 }
 
 impl DropInnerExclusively for CoapClientSession<'_> {
diff --git a/libcoap/src/session/mod.rs b/libcoap/src/session/mod.rs
index af43aaec..13016e3d 100644
--- a/libcoap/src/session/mod.rs
+++ b/libcoap/src/session/mod.rs
@@ -9,39 +9,34 @@
 
 use std::{
     any::Any,
+    borrow::BorrowMut,
+    cell::{Ref, RefMut},
     collections::{HashMap, VecDeque},
     marker::PhantomData,
     net::{SocketAddr, ToSocketAddrs},
     rc::Rc,
 };
-use std::borrow::BorrowMut;
-use std::cell::{Ref, RefMut};
 
 use libcoap_sys::{
     coap_context_t, coap_fixed_point_t, coap_mid_t, coap_new_message_id, coap_pdu_get_token, coap_pdu_t,
     coap_response_t, coap_send, coap_session_get_ack_random_factor, coap_session_get_ack_timeout,
     coap_session_get_addr_local, coap_session_get_addr_remote, coap_session_get_ifindex,
-    coap_session_get_max_retransmit, coap_session_get_proto, coap_session_get_psk_hint, coap_session_get_psk_identity,
-    coap_session_get_psk_key, coap_session_get_state, coap_session_get_type, coap_session_init_token,
-    coap_session_max_pdu_size, coap_session_new_token, coap_session_send_ping, coap_session_set_ack_random_factor,
-    coap_session_set_ack_timeout, coap_session_set_max_retransmit, coap_session_set_mtu, coap_session_state_t,
-    coap_session_t, coap_session_type_t,
+    coap_session_get_max_retransmit, coap_session_get_proto, coap_session_get_state, coap_session_get_type,
+    coap_session_init_token, coap_session_max_pdu_size, coap_session_new_token, coap_session_send_ping,
+    coap_session_set_ack_random_factor, coap_session_set_ack_timeout, coap_session_set_max_retransmit,
+    coap_session_set_mtu, coap_session_state_t, coap_session_t, coap_session_type_t,
 };
+#[cfg(feature = "dtls-psk")]
+use libcoap_sys::{coap_session_get_psk_hint, coap_session_get_psk_identity, coap_session_get_psk_key};
 
+use self::sealed::{CoapSessionCommonInternal, CoapSessionInnerProvider};
+pub use self::{client::CoapClientSession, server::CoapServerSession};
 use crate::{
     error::{MessageConversionError, SessionGetAppDataError},
-    message::{CoapMessage, CoapMessageCommon},
+    message::{request::CoapRequest, response::CoapResponse, CoapMessage, CoapMessageCommon},
     protocol::CoapToken,
     types::{CoapAddress, CoapMessageId, CoapProtocol, IfIndex, MaxRetransmit},
 };
-#[cfg(feature = "dtls")]
-use crate::crypto::{CoapCryptoPskData, CoapCryptoPskIdentity};
-use crate::message::request::CoapRequest;
-use crate::message::response::CoapResponse;
-
-pub use self::client::CoapClientSession;
-use self::sealed::{CoapSessionCommonInternal, CoapSessionInnerProvider};
-pub use self::server::CoapServerSession;
 
 pub mod client;
 
@@ -117,7 +112,7 @@ pub trait CoapSessionCommon<'a>: CoapSessionCommonInternal<'a> {
     }
 
     /// Sets the application-specific data stored alongside this session.
-    fn set_app_data<T: 'static + Any>(&self, value: Option<T>) {
+    fn set_app_data<T: 'static+Any>(&self, value: Option<T>) {
         let mut inner = self.inner_mut();
         let new_box: Option<Rc<dyn Any>> = value.map(|v| Rc::new(v) as Rc<dyn Any>);
         inner.app_data = new_box;
@@ -232,8 +227,8 @@ pub trait CoapSessionCommon<'a>: CoapSessionCommonInternal<'a> {
     }
 
     /// Returns the current PSK hint for this session.
-    #[cfg(feature = "dtls")]
-    fn psk_hint(&self) -> Option<Box<CoapCryptoPskIdentity>> {
+    #[cfg(feature = "dtls-psk")]
+    fn psk_hint(&self) -> Option<Box<[u8]>> {
         // SAFETY: Provided session pointer being valid is an invariant of CoapSessionInner
         unsafe {
             coap_session_get_psk_hint(self.inner_ref().raw_session)
@@ -243,8 +238,8 @@ pub trait CoapSessionCommon<'a>: CoapSessionCommonInternal<'a> {
     }
 
     /// Returns the current PSK identity for this session.
-    #[cfg(feature = "dtls")]
-    fn psk_identity(&self) -> Option<Box<CoapCryptoPskIdentity>> {
+    #[cfg(feature = "dtls-psk")]
+    fn psk_identity(&self) -> Option<Box<[u8]>> {
         // SAFETY: Provided session pointer being valid is an invariant of CoapSessionInner
         unsafe {
             coap_session_get_psk_identity(self.inner_ref().raw_session)
@@ -254,8 +249,8 @@ pub trait CoapSessionCommon<'a>: CoapSessionCommonInternal<'a> {
     }
 
     /// Returns the current PSK key for this session.
-    #[cfg(feature = "dtls")]
-    fn psk_key(&self) -> Option<Box<CoapCryptoPskData>> {
+    #[cfg(feature = "dtls-psk")]
+    fn psk_key(&self) -> Option<Box<[u8]>> {
         // SAFETY: Provided session pointer being valid is an invariant of CoapSessionInner
         unsafe {
             coap_session_get_psk_key(self.inner_ref().raw_session)
@@ -265,6 +260,7 @@ pub trait CoapSessionCommon<'a>: CoapSessionCommonInternal<'a> {
     }
 
     /// Returns the current state of this session.
+    #[must_use = "getting the current session state without using it is a no-op"]
     fn state(&self) -> CoapSessionState {
         // SAFETY: Provided session pointer being valid is an invariant of CoapSessionInner
         unsafe { coap_session_get_state(self.inner_ref().raw_session).into() }
@@ -440,10 +436,14 @@ impl<'a> CoapSession<'a> {
     /// claim exclusive ownership of the session.
     ///
     /// # Panics
+    ///
     /// Panics if the given pointer is a null pointer.
     ///
     /// # Safety
-    /// The provided pointer must be valid.
+    /// The provided pointer must be valid, the provided session's app data must be a valid argument
+    /// to [`CoapFfiRcCell<CoapClientSessionInner>::clone_raw_rc`](crate::mem::CoapFfiRcCell::clone_raw_rc)
+    /// or [`CoapFfiRcCell<CoapServerSessionInner>::clone_raw_rc`](crate::mem::CoapFfiRcCell::clone_raw_rc)
+    /// (depending on the session type).
     pub(crate) unsafe fn from_raw(raw_session: *mut coap_session_t) -> CoapSession<'a> {
         assert!(!raw_session.is_null(), "provided raw session was null");
         let raw_session_type = coap_session_get_type(raw_session);
diff --git a/libcoap/src/session/server.rs b/libcoap/src/session/server.rs
index 9ba5918c..29335e58 100644
--- a/libcoap/src/session/server.rs
+++ b/libcoap/src/session/server.rs
@@ -14,10 +14,8 @@ use libcoap_sys::{
     coap_session_set_app_data, coap_session_t, coap_session_type_t,
 };
 
-use crate::mem::CoapFfiRcCell;
-use crate::mem::DropInnerExclusively;
-
 use super::{CoapSessionCommon, CoapSessionInner, CoapSessionInnerProvider};
+use crate::mem::{CoapFfiRcCell, DropInnerExclusively};
 
 impl DropInnerExclusively for CoapServerSession<'_> {
     fn drop_exclusively(self) {
@@ -102,6 +100,8 @@ impl CoapServerSession<'_> {
     ///
     /// # Safety
     /// The provided pointer must be valid for the entire lifetime of this struct.
+    /// The provided session's app data must be a valid argument to
+    /// [`CoapFfiRcCell<CoapServerSessionInner>::clone_raw_rc`](CoapFfiRcCell::clone_raw_rc).
     pub(crate) unsafe fn from_raw<'a>(raw_session: *mut coap_session_t) -> CoapServerSession<'a> {
         let mut session = Self::from_raw_without_refcount(raw_session);
         coap_session_reference(raw_session);
@@ -133,6 +133,9 @@ impl CoapServerSession<'_> {
     ///
     /// This also implies that libcoap *must not* clean up this session during the lifetime of this
     /// struct, which could happen at any time if the libcoap context is not locked.
+    ///
+    /// The provided session's app data must be a valid argument to
+    /// [`CoapFfiRcCell<CoapServerSessionInner>::clone_raw_rc`](CoapFfiRcCell::clone_raw_rc).
     pub(crate) unsafe fn from_raw_without_refcount<'a>(raw_session: *mut coap_session_t) -> CoapServerSession<'a> {
         assert!(!raw_session.is_null(), "provided raw session was null");
         let raw_session_type = coap_session_get_type(raw_session);
@@ -172,6 +175,7 @@ impl<'a> CoapSessionInnerProvider<'a> for CoapServerSession<'a> {
     fn inner_ref<'b>(&'b self) -> Ref<'b, CoapSessionInner<'a>> {
         Ref::map(self.inner.borrow(), |v| &v.inner)
     }
+
     fn inner_mut<'b>(&'b self) -> RefMut<'b, CoapSessionInner<'a>> {
         RefMut::map(self.inner.borrow_mut(), |v| &mut v.inner)
     }
diff --git a/libcoap/src/types.rs b/libcoap/src/types.rs
index a09c8289..9967c799 100644
--- a/libcoap/src/types.rs
+++ b/libcoap/src/types.rs
@@ -12,7 +12,6 @@
 use std::ffi::CString;
 use std::fmt::{Display, Formatter};
 use std::marker::PhantomPinned;
-use std::ops::{Deref, DerefMut};
 use std::pin::Pin;
 use std::{
     fmt::Debug,
@@ -334,26 +333,12 @@ impl From<CoapProtocol> for CoapUriScheme {
 pub struct CoapUri {
     is_proxy: bool,
     raw_uri: coap_uri_t,
-    uri_str: Pin<CoapUriInner>,
+    uri_str: Pin<Box<CoapUriInner>>,
 }
 
 #[derive(Debug)]
 struct CoapUriInner(CString, PhantomPinned);
 
-impl Deref for CoapUriInner {
-    type Target = CString;
-
-    fn deref(&self) -> &Self::Target {
-        &self.0
-    }
-}
-
-impl DerefMut for CoapUriInner {
-    fn deref_mut(&mut self) -> &mut Self::Target {
-        &mut self.0
-    }
-}
-
 impl CoapUri {
     /// Creates a new [CoapUri] for use as a request or location URI from its constituent parts.
     ///
@@ -731,15 +716,15 @@ impl CoapUri {
         // Now, _after_ the uri_str is pinned, we can set the new object's raw_uri string fields.
         result.raw_uri.host = coap_str_const_t {
             length: (*raw_uri).host.length,
-            s: result.uri_str.as_bytes_with_nul()[host_pos..host_pos + 1].as_ptr(),
+            s: result.uri_str.0.as_bytes_with_nul()[host_pos..host_pos + 1].as_ptr(),
         };
         result.raw_uri.path = coap_str_const_t {
             length: (*raw_uri).path.length,
-            s: result.uri_str.as_bytes_with_nul()[path_pos..path_pos + 1].as_ptr(),
+            s: result.uri_str.0.as_bytes_with_nul()[path_pos..path_pos + 1].as_ptr(),
         };
         result.raw_uri.query = coap_str_const_t {
             length: (*raw_uri).query.length,
-            s: result.uri_str.as_bytes_with_nul()[query_pos..query_pos + 1].as_ptr(),
+            s: result.uri_str.0.as_bytes_with_nul()[query_pos..query_pos + 1].as_ptr(),
         };
 
         result
@@ -748,7 +733,7 @@ impl CoapUri {
     /// Create an instance of [CoapUri] with the given `uri_str`, but don't parse the value, i.e.
     /// the resulting `raw_uri` is not set correctly.
     fn create_unparsed_uri(uri_str: CString, is_proxy: bool) -> Self {
-        let uri_str = Pin::new(CoapUriInner(uri_str, PhantomPinned));
+        let uri_str = Box::pin(CoapUriInner(uri_str, PhantomPinned));
         CoapUri {
             raw_uri: coap_uri_t {
                 host: coap_str_const_t {
@@ -790,8 +775,8 @@ impl CoapUri {
         // entire lifetime of this object too.
         if unsafe {
             parsing_fn(
-                uri.uri_str.as_ptr() as *const u8,
-                libc::strlen(uri.uri_str.as_ptr()),
+                uri.uri_str.0.as_ptr() as *const u8,
+                libc::strlen(uri.uri_str.0.as_ptr()),
                 std::ptr::from_mut(&mut uri.raw_uri),
             )
         } < 0
diff --git a/libcoap/tests/common/dtls.rs b/libcoap/tests/common/dtls.rs
new file mode 100644
index 00000000..138ab58f
--- /dev/null
+++ b/libcoap/tests/common/dtls.rs
@@ -0,0 +1,54 @@
+use crate::common;
+use libcoap_rs::crypto::pki_rpk::{
+    KeyDef, KeyType, NonCertVerifying, PkiRpkContext, PkiRpkContextBuilder, ServerPkiRpkCryptoContext,
+};
+use libcoap_rs::crypto::ClientCryptoContext;
+use libcoap_rs::message::CoapMessageCommon;
+use libcoap_rs::protocol::{CoapMessageCode, CoapResponseCode};
+use libcoap_rs::session::{CoapClientSession, CoapSessionCommon};
+use libcoap_rs::CoapContext;
+use std::path::PathBuf;
+use std::time::Duration;
+
+// Is used in some test cases, but not in others (causing a compiler warning)
+#[allow(unused)]
+pub fn dtls_client_server_request_common<KTY: KeyType, FC, FS>(
+    client_key: impl KeyDef<KeyType = KTY> + 'static,
+    server_key: impl KeyDef<KeyType = KTY> + 'static + Send,
+    client_ctx_setup: FC,
+    server_ctx_setup: FS,
+) where
+    FC: FnOnce(PkiRpkContextBuilder<'static, KTY, NonCertVerifying>) -> PkiRpkContext<'static, KTY> + 'static,
+    FS: FnOnce(PkiRpkContextBuilder<'static, KTY, NonCertVerifying>) -> PkiRpkContext<'static, KTY> + Send + 'static,
+    ServerPkiRpkCryptoContext<'static>: From<PkiRpkContext<'static, KTY>>,
+    ClientCryptoContext<'static>: From<PkiRpkContext<'static, KTY>>,
+{
+    let server_address = common::get_unused_server_addr();
+    let client_crypto_ctx = client_ctx_setup(PkiRpkContextBuilder::<'static, KTY, NonCertVerifying>::new(client_key));
+    let server_handle = common::spawn_test_server(move |mut context: CoapContext| {
+        let server_crypto_ctx =
+            server_ctx_setup(PkiRpkContextBuilder::<'static, KTY, NonCertVerifying>::new(server_key));
+        context.set_pki_rpk_context(server_crypto_ctx).unwrap();
+        context.add_endpoint_dtls(server_address).unwrap();
+        #[cfg(feature = "dtls-pki")]
+        context.set_pki_root_ca_paths(Some("./resources/test-keys/ca/ca.crt.pem"), None::<PathBuf>);
+        context
+    });
+
+    let mut context = CoapContext::new().unwrap();
+    #[cfg(feature = "dtls-pki")]
+    context.set_pki_root_ca_paths(Some("./resources/test-keys/ca/ca.crt.pem"), None::<PathBuf>);
+    let session = CoapClientSession::connect_dtls(&mut context, server_address, client_crypto_ctx).unwrap();
+
+    let request = common::gen_test_request();
+    let req_handle = session.send_request(request).unwrap();
+    loop {
+        assert!(context.do_io(Some(Duration::from_secs(10))).expect("error during IO") <= Duration::from_secs(10));
+        for response in session.poll_handle(&req_handle) {
+            assert_eq!(response.code(), CoapMessageCode::Response(CoapResponseCode::Content));
+            assert_eq!(response.data().unwrap().as_ref(), "Hello World!".as_bytes());
+            server_handle.join().expect("Test server crashed with failure.");
+            return;
+        }
+    }
+}
diff --git a/libcoap/tests/common/mod.rs b/libcoap/tests/common/mod.rs
index b082f0f8..af109b34 100644
--- a/libcoap/tests/common/mod.rs
+++ b/libcoap/tests/common/mod.rs
@@ -7,6 +7,9 @@
  * See the README as well as the LICENSE file for more information.
  */
 
+#[cfg(any(feature = "dtls-pki", feature = "dtls-rpk"))]
+pub mod dtls;
+
 use std::net::{SocketAddr, UdpSocket};
 use std::rc::Rc;
 use std::sync::{Arc, Condvar, Mutex};
@@ -18,6 +21,7 @@ use libcoap_rs::{CoapContext, CoapRequestHandler, CoapResource};
 use libcoap_rs::message::{CoapMessageCommon, CoapRequest, CoapResponse};
 use libcoap_rs::protocol::{CoapMessageCode, CoapMessageType, CoapRequestCode, CoapResponseCode};
 use libcoap_rs::session::CoapSessionCommon;
+use libcoap_sys::{coap_dtls_set_log_level, coap_log_t, coap_set_log_level};
 
 pub(crate) fn get_unused_server_addr() -> SocketAddr {
     // This will give us a SocketAddress with a port in the local port range automatically
@@ -41,7 +45,7 @@ pub(crate) fn get_unused_server_addr() -> SocketAddr {
 /// As the context_configurator closure is responsible for binding to sockets, this can be used to
 /// spawn a test server and wait for it to be ready to accept requests before returning (avoiding
 /// test failure due to "Connection Refused" errors).
-pub(crate) fn spawn_test_server<F: FnOnce(&mut CoapContext) + Send + 'static>(
+pub(crate) fn spawn_test_server<F: FnOnce(CoapContext<'static>) -> CoapContext<'static> + Send + 'static>(
     context_configurator: F,
 ) -> JoinHandle<()> {
     let ready_condition = Arc::new((Mutex::new(false), Condvar::new()));
@@ -50,10 +54,11 @@ pub(crate) fn spawn_test_server<F: FnOnce(&mut CoapContext) + Send + 'static>(
     let server_handle = std::thread::spawn(move || {
         let (ready_var, ready_cond) = &*ready_condition2;
         run_test_server(|context| {
-            context_configurator(context);
+            let context = context_configurator(context);
             let mut ready_var = ready_var.lock().expect("ready condition mutex is poisoned");
             *ready_var = true;
             ready_cond.notify_all();
+            context
         });
     });
 
@@ -69,9 +74,14 @@ pub(crate) fn spawn_test_server<F: FnOnce(&mut CoapContext) + Send + 'static>(
 }
 
 /// Configures and starts a test server in the current thread.
-pub(crate) fn run_test_server<F: FnOnce(&mut CoapContext)>(context_configurator: F) {
+pub(crate) fn run_test_server<F: FnOnce(CoapContext<'static>) -> CoapContext<'static>>(context_configurator: F) {
+    unsafe {
+        libcoap_sys::coap_startup_with_feature_checks();
+        coap_dtls_set_log_level(coap_log_t::COAP_LOG_DEBUG);
+        coap_set_log_level(coap_log_t::COAP_LOG_DEBUG);
+    }
     let mut context = CoapContext::new().unwrap();
-    context_configurator(&mut context);
+    context = context_configurator(context);
     let request_completed = Rc::new(AtomicBool::new(false));
     let resource = CoapResource::new("test1", request_completed.clone(), false);
     resource.set_method_handler(
diff --git a/libcoap/tests/dtls_client_server_test.rs b/libcoap/tests/dtls_client_server_test.rs
deleted file mode 100644
index 1230987d..00000000
--- a/libcoap/tests/dtls_client_server_test.rs
+++ /dev/null
@@ -1,86 +0,0 @@
-// SPDX-License-Identifier: BSD-2-Clause
-/*
- * dtls_client_server_test.rs - Tests for DTLS clients+servers.
- * This file is part of the libcoap-rs crate, see the README and LICENSE files for
- * more information and terms of use.
- * Copyright © 2021-2023 The NAMIB Project Developers, all rights reserved.
- * See the README as well as the LICENSE file for more information.
- */
-
-#![cfg(feature = "dtls")]
-use std::fmt::Debug;
-use std::time::Duration;
-
-use libcoap_rs::{
-    CoapContext,
-    message::CoapMessageCommon,
-    protocol::{CoapMessageCode, CoapResponseCode},
-    session::CoapSessionCommon,
-};
-use libcoap_rs::crypto::{
-    CoapClientCryptoProvider, CoapCryptoProviderResponse, CoapCryptoPskData, CoapCryptoPskIdentity, CoapCryptoPskInfo,
-    CoapServerCryptoProvider,
-};
-use libcoap_rs::session::CoapClientSession;
-
-mod common;
-
-#[derive(Debug)]
-struct DummyCryptoProvider;
-
-impl CoapServerCryptoProvider for DummyCryptoProvider {
-    fn provide_key_for_identity(
-        &mut self,
-        _identity: &CoapCryptoPskIdentity,
-    ) -> CoapCryptoProviderResponse<Box<CoapCryptoPskData>> {
-        CoapCryptoProviderResponse::UseCurrent
-    }
-
-    fn provide_default_info(&mut self) -> CoapCryptoPskInfo {
-        CoapCryptoPskInfo {
-            identity: String::from("dtls_test_identity").into_boxed_str().into(),
-            key: String::from("dtls_test_key___").into_boxed_str().into(),
-        }
-    }
-}
-
-impl CoapClientCryptoProvider for DummyCryptoProvider {
-    fn provide_key_for_hint(
-        &mut self,
-        _hint: &CoapCryptoPskIdentity,
-    ) -> CoapCryptoProviderResponse<Box<CoapCryptoPskData>> {
-        CoapCryptoProviderResponse::UseCurrent
-    }
-
-    fn provide_default_info(&mut self) -> CoapCryptoPskInfo {
-        CoapCryptoPskInfo {
-            identity: String::from("dtls_test_identity").into_boxed_str().into(),
-            key: String::from("dtls_test_key___").into_boxed_str().into(),
-        }
-    }
-}
-
-#[test]
-pub fn dtls_client_server_request() {
-    let server_address = common::get_unused_server_addr();
-
-    let server_handle = common::spawn_test_server(move |context| {
-        context.set_server_crypto_provider(Some(Box::new(DummyCryptoProvider {})));
-        context.add_endpoint_dtls(server_address).unwrap();
-    });
-
-    let mut context = CoapContext::new().unwrap();
-    let session = CoapClientSession::connect_dtls(&mut context, server_address, DummyCryptoProvider {}).unwrap();
-
-    let request = common::gen_test_request();
-    let req_handle = session.send_request(request).unwrap();
-    loop {
-        assert!(context.do_io(Some(Duration::from_secs(10))).expect("error during IO") <= Duration::from_secs(10));
-        for response in session.poll_handle(&req_handle) {
-            assert_eq!(response.code(), CoapMessageCode::Response(CoapResponseCode::Content));
-            assert_eq!(response.data().unwrap().as_ref(), "Hello World!".as_bytes());
-            server_handle.join().expect("Test server crashed with failure.");
-            return;
-        }
-    }
-}
diff --git a/libcoap/tests/dtls_pki_client_server_test.rs b/libcoap/tests/dtls_pki_client_server_test.rs
new file mode 100644
index 00000000..bc97761f
--- /dev/null
+++ b/libcoap/tests/dtls_pki_client_server_test.rs
@@ -0,0 +1,120 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * dtls_rpk_client_server_test.rs - Tests for DTLS RPK clients+servers.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+#![cfg(feature = "dtls-pki")]
+
+use crate::common::dtls::dtls_client_server_request_common;
+use libcoap_rs::crypto::pki_rpk::{Asn1PrivateKeyType, DerFileKeyComponent, NonCertVerifying, PkiRpkContextBuilder};
+use libcoap_rs::crypto::pki_rpk::{Pki, PkiKeyDef};
+use std::path::PathBuf;
+
+mod common;
+
+#[test]
+pub fn dtls_pki_pem_file_client_server_request() {
+    let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let key_storage = manifest_dir.join("./resources/test-keys");
+    let client_key = PkiKeyDef::with_pem_files(
+        Some(key_storage.join("./ca/ca.crt.pem")),
+        key_storage.join("./client/client.crt.pem"),
+        key_storage.join("./client/client.key.pem"),
+    );
+    let server_key = PkiKeyDef::with_pem_files(
+        Some(key_storage.join("./ca/ca.crt.pem")),
+        key_storage.join("./server/server.crt.pem"),
+        key_storage.join("./server/server.key.pem"),
+    );
+
+    let ctx_configurator = |ctx: PkiRpkContextBuilder<'static, Pki, NonCertVerifying>| {
+        ctx.verify_peer_cert().check_common_ca(true).build()
+    };
+    dtls_client_server_request_common(client_key, server_key, ctx_configurator, ctx_configurator)
+}
+
+#[test]
+pub fn dtls_pki_pem_memory_client_server_request() {
+    const PEM_CA_CERT: &str = include_str!("../resources/test-keys/ca/ca.crt.pem");
+    const PEM_CLIENT_PUBLIC_CERT: &str = include_str!("../resources/test-keys/client/client.crt.pem");
+    const PEM_SERVER_PUBLIC_CERT: &str = include_str!("../resources/test-keys/server/server.crt.pem");
+    const PEM_CLIENT_PRIVATE_KEY: &str = include_str!("../resources/test-keys/client/client.key.pem");
+    const PEM_SERVER_PRIVATE_KEY: &str = include_str!("../resources/test-keys/server/server.key.pem");
+    let client_key = PkiKeyDef::with_pem_memory(
+        Some(Vec::from(PEM_CA_CERT)),
+        Vec::from(PEM_CLIENT_PUBLIC_CERT),
+        Vec::from(PEM_CLIENT_PRIVATE_KEY),
+    );
+    let server_key = PkiKeyDef::with_pem_memory(
+        Some(Vec::from(PEM_CA_CERT)),
+        Vec::from(PEM_SERVER_PUBLIC_CERT),
+        Vec::from(PEM_SERVER_PRIVATE_KEY),
+    );
+
+    let ctx_configurator = |ctx: PkiRpkContextBuilder<'static, Pki, NonCertVerifying>| {
+        ctx.verify_peer_cert().check_common_ca(true).build()
+    };
+    dtls_client_server_request_common(client_key, server_key, ctx_configurator, ctx_configurator)
+}
+
+#[test]
+pub fn dtls_pki_asn1_file_client_server_request() {
+    let manifest_dir = PathBuf::from(env!("CARGO_MANIFEST_DIR"));
+    let key_storage = manifest_dir.join("./resources/test-keys");
+    let client_key = PkiKeyDef::with_asn1_files(
+        None::<DerFileKeyComponent>,
+        key_storage.join("./client/client.crt.der"),
+        key_storage.join("./client/client.key.der"),
+        Asn1PrivateKeyType::Ec,
+    );
+    let server_key = PkiKeyDef::with_asn1_files(
+        // For some inexplicable reason, setting the CA cert fails _only_ with ASN1 files using the
+        // OpenSSL library.
+        // I'm pretty sure this is a libcoap issue, so we'll not set the CA cert there for now.
+        #[cfg(not(feature = "dtls_openssl"))]
+        Some(key_storage.join("./ca/ca.crt.der")),
+        #[cfg(feature = "dtls_openssl")]
+        None::<DerFileKeyComponent>,
+        key_storage.join("./server/server.crt.der"),
+        key_storage.join("./server/server.key.der"),
+        Asn1PrivateKeyType::Ec,
+    );
+
+    let ctx_configurator = |ctx: PkiRpkContextBuilder<'static, Pki, NonCertVerifying>| {
+        ctx.verify_peer_cert().check_common_ca(true).build()
+    };
+    dtls_client_server_request_common(client_key, server_key, ctx_configurator, ctx_configurator)
+}
+
+#[test]
+// GnuTLS does not like DER-encoded EC keys from memory (for some reason. Loading them from files as
+// done in the test above works fine).
+#[cfg(not(feature = "dtls_gnutls"))]
+pub fn dtls_pki_asn1_memory_client_server_request() {
+    const DER_CA_CERT: &[u8] = include_bytes!("../resources/test-keys/ca/ca.crt.der");
+    const DER_CLIENT_PUBLIC_CERT: &[u8] = include_bytes!("../resources/test-keys/client/client.crt.der");
+    const DER_SERVER_PUBLIC_CERT: &[u8] = include_bytes!("../resources/test-keys/server/server.crt.der");
+    const DER_CLIENT_PRIVATE_KEY: &[u8] = include_bytes!("../resources/test-keys/client/client.key.der");
+    const DER_SERVER_PRIVATE_KEY: &[u8] = include_bytes!("../resources/test-keys/server/server.key.der");
+    let client_key = PkiKeyDef::with_asn1_memory(
+        Some(Vec::from(DER_CA_CERT)),
+        Vec::from(DER_CLIENT_PUBLIC_CERT),
+        Vec::from(DER_CLIENT_PRIVATE_KEY),
+        Asn1PrivateKeyType::Ec,
+    );
+    let server_key = PkiKeyDef::with_asn1_memory(
+        Some(Vec::from(DER_CA_CERT)),
+        Vec::from(DER_SERVER_PUBLIC_CERT),
+        Vec::from(DER_SERVER_PRIVATE_KEY),
+        Asn1PrivateKeyType::Ec,
+    );
+
+    let ctx_configurator = |ctx: PkiRpkContextBuilder<'static, Pki, NonCertVerifying>| {
+        ctx.verify_peer_cert().check_common_ca(true).build()
+    };
+    dtls_client_server_request_common(client_key, server_key, ctx_configurator, ctx_configurator)
+}
diff --git a/libcoap/tests/dtls_psk_client_server_test.rs b/libcoap/tests/dtls_psk_client_server_test.rs
new file mode 100644
index 00000000..757e9612
--- /dev/null
+++ b/libcoap/tests/dtls_psk_client_server_test.rs
@@ -0,0 +1,52 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * dtls_psk_client_server_test.rs - Tests for DTLS PSK clients+servers.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+#![cfg(feature = "dtls-psk")]
+use std::time::Duration;
+
+use libcoap_rs::crypto::psk::PskKey;
+use libcoap_rs::crypto::psk::{ClientPskContextBuilder, ServerPskContextBuilder};
+use libcoap_rs::session::CoapClientSession;
+use libcoap_rs::{
+    message::CoapMessageCommon,
+    protocol::{CoapMessageCode, CoapResponseCode},
+    session::CoapSessionCommon,
+    CoapContext,
+};
+
+mod common;
+
+#[test]
+pub fn dtls_psk_client_server_request() {
+    let server_address = common::get_unused_server_addr();
+    let dummy_key = PskKey::new(Some("dtls_test_id"), "dtls_test_key___");
+    let client_psk_context = ClientPskContextBuilder::new(dummy_key.clone()).build();
+
+    let server_handle = common::spawn_test_server(move |mut context| {
+        let server_psk_context = ServerPskContextBuilder::new(dummy_key.clone()).build();
+        context.set_psk_context(server_psk_context).unwrap();
+        context.add_endpoint_dtls(server_address).unwrap();
+        context
+    });
+
+    let mut context = CoapContext::new().unwrap();
+    let session = CoapClientSession::connect_dtls(&mut context, server_address, client_psk_context).unwrap();
+
+    let request = common::gen_test_request();
+    let req_handle = session.send_request(request).unwrap();
+    loop {
+        assert!(context.do_io(Some(Duration::from_secs(10))).expect("error during IO") <= Duration::from_secs(10));
+        for response in session.poll_handle(&req_handle) {
+            assert_eq!(response.code(), CoapMessageCode::Response(CoapResponseCode::Content));
+            assert_eq!(response.data().unwrap().as_ref(), "Hello World!".as_bytes());
+            server_handle.join().expect("Test server crashed with failure.");
+            return;
+        }
+    }
+}
diff --git a/libcoap/tests/dtls_rpk_client_server_test.rs b/libcoap/tests/dtls_rpk_client_server_test.rs
new file mode 100644
index 00000000..5ed48495
--- /dev/null
+++ b/libcoap/tests/dtls_rpk_client_server_test.rs
@@ -0,0 +1,30 @@
+// SPDX-License-Identifier: BSD-2-Clause
+/*
+ * dtls_rpk_client_server_test.rs - Tests for DTLS RPK clients+servers.
+ * This file is part of the libcoap-rs crate, see the README and LICENSE files for
+ * more information and terms of use.
+ * Copyright © 2021-2024 The NAMIB Project Developers, all rights reserved.
+ * See the README as well as the LICENSE file for more information.
+ */
+
+#![cfg(feature = "dtls-rpk")]
+
+use crate::common::dtls::dtls_client_server_request_common;
+use libcoap_rs::crypto::pki_rpk::{NonCertVerifying, PkiRpkContextBuilder};
+use libcoap_rs::crypto::pki_rpk::{Rpk, RpkKeyDef};
+
+mod common;
+
+#[test]
+pub fn dtls_pki_pem_memory_client_server_request() {
+    // TODO Implement validator using https://docs.rs/spki/0.7.3/spki/struct.SubjectPublicKeyInfo.html#impl-Eq-for-SubjectPublicKeyInfo%3CParams,+Key%3E
+    const PEM_CLIENT_PUBLIC_KEY: &str = include_str!("../resources/test-keys/client/client.pub.pem");
+    const PEM_SERVER_PUBLIC_KEY: &str = include_str!("../resources/test-keys/server/server.pub.pem");
+    const PEM_CLIENT_PRIVATE_KEY: &str = include_str!("../resources/test-keys/client/client.key.pem");
+    const PEM_SERVER_PRIVATE_KEY: &str = include_str!("../resources/test-keys/server/server.key.pem");
+    let client_key = RpkKeyDef::with_pem_memory(Vec::from(PEM_CLIENT_PUBLIC_KEY), Vec::from(PEM_CLIENT_PRIVATE_KEY));
+    let server_key = RpkKeyDef::with_pem_memory(Vec::from(PEM_SERVER_PUBLIC_KEY), Vec::from(PEM_SERVER_PRIVATE_KEY));
+
+    let ctx_configurator = |ctx: PkiRpkContextBuilder<'static, Rpk, NonCertVerifying>| ctx.build();
+    dtls_client_server_request_common(client_key, server_key, ctx_configurator, ctx_configurator)
+}
diff --git a/libcoap/tests/tcp_client_server_test.rs b/libcoap/tests/tcp_client_server_test.rs
index da5db4f7..e5a64258 100644
--- a/libcoap/tests/tcp_client_server_test.rs
+++ b/libcoap/tests/tcp_client_server_test.rs
@@ -23,7 +23,10 @@ mod common;
 pub fn basic_client_server_request() {
     let server_address = common::get_unused_server_addr();
 
-    let server_handle = common::spawn_test_server(move |context| context.add_endpoint_tcp(server_address).unwrap());
+    let server_handle = common::spawn_test_server(move |mut context| {
+        context.add_endpoint_tcp(server_address).unwrap();
+        context
+    });
 
     let mut context = CoapContext::new().unwrap();
     let session = CoapClientSession::connect_tcp(&mut context, server_address).unwrap();
diff --git a/libcoap/tests/udp_client_server_test.rs b/libcoap/tests/udp_client_server_test.rs
index 88250e04..c3d9d27e 100644
--- a/libcoap/tests/udp_client_server_test.rs
+++ b/libcoap/tests/udp_client_server_test.rs
@@ -22,7 +22,10 @@ mod common;
 pub fn basic_client_server_request() {
     let server_address = common::get_unused_server_addr();
 
-    let server_handle = common::spawn_test_server(move |context| context.add_endpoint_udp(server_address).unwrap());
+    let server_handle = common::spawn_test_server(move |mut context| {
+        context.add_endpoint_udp(server_address).unwrap();
+        context
+    });
 
     let mut context = CoapContext::new().unwrap();
     let session = CoapClientSession::connect_udp(&mut context, server_address).unwrap();