diff --git a/lib/tls/openssl/lws-genaes.c b/lib/tls/openssl/lws-genaes.c
index f3704f0df..cf3ac369d 100644
--- a/lib/tls/openssl/lws-genaes.c
+++ b/lib/tls/openssl/lws-genaes.c
@@ -320,6 +320,7 @@ lws_genaes_crypt(struct lws_genaes_ctx *ctx,
 		}
 
 		if (!n) {
+			lws_tls_err_describe_clear();
 			lwsl_err("%s: init failed (cipher %p)\n",
 				 __func__, ctx->cipher);
 
diff --git a/minimal-examples/api-tests/api-test-gencrypto/lws-genaes.c b/minimal-examples/api-tests/api-test-gencrypto/lws-genaes.c
index d5087faea..906364720 100644
--- a/minimal-examples/api-tests/api-test-gencrypto/lws-genaes.c
+++ b/minimal-examples/api-tests/api-test-gencrypto/lws-genaes.c
@@ -557,21 +557,22 @@ static const uint8_t
 	 * Fedora openssl tool doesn't support xts... this data produced
 	 * by testing on mbedtls + OpenSSL and getting the same result
 	 *
-	 * NOTICE that xts requires a double-length key...
+	 * NOTICE that xts requires a double-length key... OpenSSL now checks
+	 * the key for duplication so we use a random key
 	 */
 	*xts	= (uint8_t *)"test plaintext\0\0",
 	xts_enc[] = {
-		0xA9, 0x26, 0xFD, 0x68, 0x1E, 0x6A, 0x80, 0xCA,
-		0x18, 0xD5, 0xEB, 0x08, 0x23, 0xF1, 0x90, 0x15
+		0x87, 0x83, 0x20, 0x8B, 0x15, 0x89, 0xA1, 0x13,
+		0xDC, 0xEA, 0x82, 0xB6, 0xFF, 0x8D, 0x76, 0x3A
 	}, xts_key[] = {
-		0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
-		0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
-		0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
-		0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
-		0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
-		0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
-		0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef,
-		0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10,
+		0xa4, 0xd6, 0xa2, 0x1a, 0x3b, 0x34, 0x34, 0x43,
+		0x9a, 0xe2, 0x6a, 0x01, 0x1c, 0x73, 0x80, 0x3b,
+		0xdd, 0xf6, 0xd4, 0x37, 0x5e, 0x0e, 0x1c, 0x72,
+		0x8e, 0xe5, 0x18, 0x69, 0xfd, 0x08, 0x40, 0x2b,
+		0x98, 0xf9, 0x75, 0xa8, 0x36, 0xd5, 0x0f, 0xa2,
+		0x20, 0x04, 0x43, 0xa7, 0x3a, 0xa6, 0x4a, 0xdc,
+		0xe9, 0x54, 0x50, 0xfa, 0x38, 0xad, 0x6d, 0x96,
+		0x5f, 0x31, 0x9e, 0xcd, 0x33, 0x08, 0xa0, 0x44
 	}
 ;