@@ -24,6 +24,7 @@ threading = ["rustpython-vm/threading", "rustpython-stdlib/threading"]
 sqlite = ["rustpython-stdlib/sqlite"]
 ssl = []
 ssl-rustls = ["ssl", "rustpython-stdlib/ssl-rustls"]
+ssl-rustls-no-provider = ["ssl", "rustpython-stdlib/ssl-rustls-no-provider"]
 ssl-openssl = ["ssl", "rustpython-stdlib/ssl-openssl"]
 ssl-vendor = ["ssl-openssl", "rustpython-stdlib/ssl-vendor"]
 tkinter = ["rustpython-stdlib/tkinter"]
@@ -130,6 +131,7 @@ resolver = "2"
 members = [
     ".",
     "crates/*",
+    "examples/tls_providers",
 ]
 exclude = ["pymath"]
 
 
@@ -18,8 +18,9 @@ threading = ["rustpython-common/threading", "rustpython-vm/threading"]
 sqlite = ["dep:libsqlite3-sys"]
 # SSL backends - default to rustls
 ssl = []
-ssl-rustls = ["__ssl-rustls", "rustls/aws_lc_rs", "aws-lc-rs"]
+ssl-rustls = ["__ssl-rustls", "rustls/aws_lc_rs"]
 ssl-rustls-fips = ["__ssl-rustls", "rustls/aws_lc_rs", "aws-lc-rs", "aws-lc-rs/fips"]
+ssl-rustls-no-provider = ["__ssl-rustls", "rustls/custom-provider"]
 ssl-openssl = ["ssl", "openssl", "openssl-sys", "foreign-types-shared", "openssl-probe"]
 ssl-vendor = ["ssl-openssl", "openssl/vendored"]
 tkinter = ["dep:tk-sys", "dep:tcl-sys", "dep:widestring"]
 
@@ -108,7 +108,7 @@ mod openssl;
     not(target_arch = "wasm32"),
     feature = "__ssl-rustls"
 ))]
-mod ssl;
+pub mod ssl;
 #[cfg(all(feature = "ssl-openssl", feature = "__ssl-rustls"))]
 compile_error!("features \"ssl-openssl\" and the \"ssl-rustls-*\" family are mutually exclusive");
 
 
@@ -26,6 +26,10 @@ mod compat;
 mod error;
 
 pub(crate) use _ssl::module_def;
+pub use compat::{CryptoExt, set_crypto_provider};
+
+#[cfg(all(feature = "ssl-rustls", not(feature = "ssl-rustls-no-provider")))]
+pub use compat::set_aws_lc_provider;
 
 #[allow(non_snake_case)]
 #[allow(non_upper_case_globals)]
@@ -37,7 +41,6 @@ mod _ssl {
             lock::{PyMutex, PyRwLock},
         },
         socket::{PySocket, SelectKind, sock_select, timeout_error_msg},
-        ssl::compat,
         vm::{
             AsObject, Py, PyObject, PyObjectRef, PyPayload, PyRef, PyResult, TryFromObject,
             VirtualMachine,
@@ -85,9 +88,6 @@ mod _ssl {
     };
     use sha2::{Digest, Sha256};
 
-    #[cfg(feature = "ssl-rustls")]
-    use rustls::crypto::aws_lc_rs::{ALL_CIPHER_SUITES, Ticketer, sign};
-
     // Import certificate operations module
     use super::cert;
 
@@ -96,10 +96,10 @@ mod _ssl {
 
     // Import compat module (OpenSSL compatibility layer)
     use super::compat::{
-        ClientConfigOptions, MultiCertResolver, ProtocolSettings, ServerConfigOptions, SslError,
-        TlsConnection, create_client_config, create_server_config, curve_name_to_kx_group,
-        extract_cipher_info, get_cipher_encryption_desc, is_blocking_io_error,
-        normalize_cipher_name, ssl_do_handshake,
+        CRYPTO_EXT, ClientConfigOptions, MultiCertResolver, ProtocolSettings, ServerConfigOptions,
+        SslError, TlsConnection, create_client_config, create_server_config,
+        curve_name_to_kx_group, extract_cipher_info, get_cipher_encryption_desc,
+        is_blocking_io_error, normalize_cipher_name, ssl_do_handshake,
     };
 
     // Type aliases for better readability
@@ -615,7 +615,10 @@ mod _ssl {
             return Err("No cipher can be selected".to_string());
         }
 
-        let all_suites = ALL_CIPHER_SUITES;
+        let crypto_ext = CRYPTO_EXT
+            .get()
+            .expect("A CryptoProvider must be set before SSL");
+        let all_suites = crypto_ext.all_ciphers_or_default();
         let mut selected = Vec::new();
 
         for part in cipher_str.split(':') {
@@ -1050,6 +1053,10 @@ mod _ssl {
 
         #[pymethod]
         fn load_cert_chain(&self, args: LoadCertChainArgs, vm: &VirtualMachine) -> PyResult<()> {
+            let crypto_ext = CRYPTO_EXT
+                .get()
+                .expect("A CryptoProvider must be set before SSL");
+
             // Parse certfile argument (str or bytes) to path
             let cert_path = Self::parse_path_arg(&args.certfile, vm)?;
 
@@ -1192,7 +1199,7 @@ mod _ssl {
             }
 
             // Additional validation: Create CertifiedKey to ensure rustls accepts it
-            let signing_key = sign::any_supported_type(&key).map_err(|_| {
+            let signing_key = crypto_ext.any_supported_key(&key).map_err(|_| {
                 vm.new_os_subtype_error(
                     PySSLError::class(&vm.ctx).to_owned(),
                     None,
@@ -1523,7 +1530,11 @@ mod _ssl {
             // Dynamically generate cipher list from rustls ALL_CIPHER_SUITES
             // This automatically includes all cipher suites supported by the current rustls version
 
-            let cipher_list = ALL_CIPHER_SUITES
+            let crypto_ext = CRYPTO_EXT
+                .get()
+                .expect("A CryptoProvider must be set before SSL");
+            let cipher_list = crypto_ext
+                .all_ciphers_or_default()
                 .iter()
                 .map(|suite| {
                     // Extract cipher information using unified helper
@@ -2203,6 +2214,10 @@ mod _ssl {
             (protocol,): Self::Args,
             vm: &VirtualMachine,
         ) -> PyResult<Self> {
+            let crypto_ext = CRYPTO_EXT
+                .get()
+                .expect("A CryptoProvider must be set before SSL");
+
             // Validate protocol
             match protocol {
                 PROTOCOL_TLS | PROTOCOL_TLS_CLIENT | PROTOCOL_TLS_SERVER | PROTOCOL_TLSv1_2
@@ -2297,7 +2312,7 @@ mod _ssl {
                 rustls_server_session_store: rustls::server::ServerSessionMemoryCache::new(
                     SSL_SESSION_CACHE_SIZE,
                 ),
-                server_ticketer: Ticketer::new()
+                server_ticketer: (crypto_ext.ticketer)()
                     .expect("Failed to create shared ticketer for TLS 1.2 session resumption"),
                 accept_count: AtomicUsize::new(0),
                 session_hits: AtomicUsize::new(0),
@@ -4874,9 +4889,8 @@ mod _ssl {
 
     #[pyfunction]
     fn RAND_bytes(n: i64, vm: &VirtualMachine) -> PyResult<PyBytesRef> {
-        compat::ensure_default_provider();
         let default_provider =
-            CryptoProvider::get_default().expect("A CryptoProvider should have been set earlier");
+            CryptoProvider::get_default().expect("A CryptoProvider must be set before SSL");
 
         // Validate n is not negative
         if n < 0 {
 
@@ -22,10 +22,7 @@ use rustpython_vm::{PyObjectRef, PyResult, VirtualMachine};
 use std::collections::HashSet;
 use x509_parser::prelude::*;
 
-use super::compat::{VERIFY_X509_PARTIAL_CHAIN, VERIFY_X509_STRICT};
-
-#[cfg(feature = "ssl-rustls")]
-use rustls::crypto::aws_lc_rs::sign;
+use super::compat::{CRYPTO_EXT, VERIFY_X509_PARTIAL_CHAIN, VERIFY_X509_STRICT};
 
 // Certificate Verification Constants
 
@@ -1268,10 +1265,13 @@ pub(super) fn validate_cert_key_match(
     if certs.is_empty() {
         return Err("Certificate chain is empty".to_string());
     }
+    let crypto_ext = CRYPTO_EXT
+        .get()
+        .expect("A CryptoProvider must be set before SSL");
 
     // For rustls, the actual validation happens when creating CertifiedKey
     // We can attempt to create a signing key to verify the key is valid
-    match sign::any_supported_type(private_key) {
+    match crypto_ext.any_supported_key(private_key) {
         Ok(_signing_key) => {
             // If we can create a signing key, the private key is valid
             // Rustls will validate the cert-key match when building config
 
@@ -15,21 +15,20 @@ use crate::socket::{SelectKind, timeout_error_msg};
 use crate::vm::VirtualMachine;
 use alloc::sync::Arc;
 use parking_lot::RwLock as ParkingRwLock;
-use rustls::RootCertStore;
-use rustls::client::ClientConfig;
-use rustls::client::ClientConnection;
-use rustls::crypto::SupportedKxGroup;
+use rustls::client::{ClientConfig, ClientConnection};
+use rustls::crypto::{CryptoProvider, SupportedKxGroup};
 use rustls::pki_types::{CertificateDer, CertificateRevocationListDer, PrivateKeyDer};
-use rustls::server::ResolvesServerCert;
-use rustls::server::ServerConfig;
-use rustls::server::ServerConnection;
-use rustls::sign::CertifiedKey;
+use rustls::server::{
+    ProducesTickets, ResolvesServerCert, ServerConfig, ServerConnection, WebPkiClientVerifier,
+};
+use rustls::sign::{CertifiedKey, SigningKey};
+use rustls::{RootCertStore, SignatureScheme, SupportedCipherSuite};
 use rustpython_vm::builtins::{PyBaseException, PyBaseExceptionRef};
 use rustpython_vm::convert::IntoPyException;
 use rustpython_vm::function::ArgBytesLike;
 use rustpython_vm::{AsObject, Py, PyObjectRef, PyPayload, PyResult, TryFromObject};
 use std::io::Read;
-use std::sync::Once;
+use std::sync::OnceLock;
 
 // Import PySSLSocket from parent module
 use super::_ssl::PySSLSocket;
@@ -57,14 +56,114 @@ pub(super) const VERIFY_X509_PARTIAL_CHAIN: i32 = 0x80000;
 /// This is necessary because rustls 0.23+ requires a process-level CryptoProvider
 /// to be installed before using default_provider(). We use Once to ensure this
 /// happens exactly once, even if called from multiple threads.
-static INIT_PROVIDER: Once = Once::new();
-
-pub(super) fn ensure_default_provider() {
-    INIT_PROVIDER.call_once(|| {
-        let _ = rustls::crypto::CryptoProvider::install_default(
-            rustls::crypto::aws_lc_rs::default_provider(),
-        );
-    });
+pub(super) static CRYPTO_EXT: OnceLock<CryptoExt> = OnceLock::new();
+
+#[derive(Clone, Copy)]
+pub struct CryptoExt {
+    pub all_cipher_suites: Option<&'static [SupportedCipherSuite]>,
+    pub all_kx_groups: Option<&'static [&'static dyn SupportedKxGroup]>,
+    pub any_supported_key:
+        Option<fn(&PrivateKeyDer<'_>) -> Result<Arc<dyn SigningKey>, rustls::Error>>,
+    pub ticketer: fn() -> Result<Arc<dyn ProducesTickets>, rustls::Error>,
+}
+
+impl CryptoExt {
+    /// Returns all [`SupportedCipherSuite`] or the provider's defaults.
+    ///
+    /// # Panics
+    /// Panics if a [`CryptoProvider`] hasn't been set.
+    pub fn all_ciphers_or_default(&self) -> &'static [SupportedCipherSuite] {
+        self.all_cipher_suites.unwrap_or_else(|| {
+            CryptoProvider::get_default()
+                .expect("A CryptoProvider has been set if CryptoExt is set")
+                .cipher_suites
+                .as_slice()
+        })
+    }
+
+    /// Returns all [`SupportedKxGroup`] or the provider's defaults.
+    ///
+    /// # Panics
+    /// Panics if a [`CryptoProvider`] hasn't been set.
+    pub fn all_kx_or_default(&self) -> &'static [&'static dyn SupportedKxGroup] {
+        self.all_kx_groups.unwrap_or_else(|| {
+            CryptoProvider::get_default()
+                .expect("A CryptoProvider has been set if CryptoExt is set")
+                .kx_groups
+                .as_slice()
+        })
+    }
+
+    /// Return the first supported [`SigningKey`] for a [`PrivateKeyDer`].
+    ///
+    /// Ideally, this function should be provided by the backend implementation or
+    /// the user. This fallback filters out insecure algorithms then picks the first available key
+    /// if it exists.
+    ///
+    /// # Panics
+    /// Panics if a [`CryptoProvider`] hasn't been set.
+    pub fn any_supported_key(
+        &self,
+        der: &PrivateKeyDer<'_>,
+    ) -> Result<Arc<dyn SigningKey>, rustls::Error> {
+        self.any_supported_key.map(|f| f(der)).unwrap_or_else(|| {
+            let provider = CryptoProvider::get_default()
+                .expect("A CryptoProvider has been set if CryptoExt is set");
+            let key = provider.key_provider.load_private_key(der.clone_key())?;
+
+            for scheme in provider
+                .signature_verification_algorithms
+                .mapping
+                .iter()
+                .filter_map(|(scheme, _)| {
+                    (!matches!(
+                        scheme,
+                        SignatureScheme::RSA_PKCS1_SHA1
+                            | SignatureScheme::ECDSA_SHA1_Legacy
+                            | SignatureScheme::Unknown(_),
+                    ))
+                    .then_some(*scheme)
+                })
+            {
+                if key.choose_scheme(&[scheme]).is_some() {
+                    return Ok(key);
+                }
+            }
+
+            Err(rustls::Error::General(
+                "failed to parse private key as RSA, ECDSA, or EcDSA".into(),
+            ))
+        })
+    }
+}
+
+#[cfg(all(feature = "ssl-rustls", not(feature = "ssl-rustls-no-provider")))]
+pub fn set_aws_lc_provider() -> Result<(), rustls::Error> {
+    use rustls::crypto::aws_lc_rs;
+    let provider = aws_lc_rs::default_provider();
+    let ext = CryptoExt {
+        all_cipher_suites: Some(aws_lc_rs::ALL_CIPHER_SUITES),
+        all_kx_groups: Some(aws_lc_rs::ALL_KX_GROUPS),
+        any_supported_key: Some(aws_lc_rs::sign::any_supported_type),
+        ticketer: aws_lc_rs::Ticketer::new,
+    };
+    set_crypto_provider(provider, ext)
+}
+
+/// Set a process [`CryptoProvider`].
+///
+/// A provider must be set before any cryptographic operations. All crypto ops panic if a provider
+/// is unset. See [`set_aws_lc_provider`] for the default provider.
+pub fn set_crypto_provider(
+    provider: CryptoProvider,
+    extension: CryptoExt,
+) -> Result<(), rustls::Error> {
+    provider
+        .install_default()
+        .map_err(|_| rustls::Error::General("A default CryptoProvider is already set".into()))?;
+    CRYPTO_EXT
+        .set(extension)
+        .map_err(|_| rustls::Error::General("A CryptoExt is already set".into()))
 }
 
 // OpenSSL Constants:
@@ -662,13 +761,13 @@ pub(super) struct ClientConfigOptions {
 /// This helper function consolidates the duplicated CryptoProvider creation logic
 /// for both server and client configurations.
 fn create_custom_crypto_provider(
-    cipher_suites: Option<Vec<rustls::SupportedCipherSuite>>,
-    kx_groups: Option<Vec<&'static dyn rustls::crypto::SupportedKxGroup>>,
-) -> Arc<rustls::crypto::CryptoProvider> {
-    let default_provider = rustls::crypto::CryptoProvider::get_default()
-        .expect("A CryptoProvider should have been set earlier");
+    cipher_suites: Option<Vec<SupportedCipherSuite>>,
+    kx_groups: Option<Vec<&'static dyn SupportedKxGroup>>,
+) -> Arc<CryptoProvider> {
+    let default_provider =
+        CryptoProvider::get_default().expect("A CryptoProvider must be set before SSL");
 
-    Arc::new(rustls::crypto::CryptoProvider {
+    Arc::new(CryptoProvider {
         cipher_suites: cipher_suites.unwrap_or_else(|| default_provider.cipher_suites.clone()),
         kx_groups: kx_groups.unwrap_or_else(|| default_provider.kx_groups.clone()),
         signature_verification_algorithms: default_provider.signature_verification_algorithms,
@@ -682,11 +781,6 @@ fn create_custom_crypto_provider(
 /// This abstracts the complex rustls ServerConfig building logic,
 /// matching SSL_CTX initialization for server sockets.
 pub(super) fn create_server_config(options: ServerConfigOptions) -> Result<ServerConfig, String> {
-    use rustls::server::WebPkiClientVerifier;
-
-    // Ensure default CryptoProvider is installed
-    ensure_default_provider();
-
     // Create custom crypto provider using helper function
     let custom_provider = create_custom_crypto_provider(
         options.protocol_settings.cipher_suites.clone(),
@@ -864,9 +958,6 @@ fn apply_alpn_with_fallback(config_alpn: &mut Vec<Vec<u8>>, alpn_protocols: &[Ve
 /// This abstracts the complex rustls ClientConfig building logic,
 /// matching SSL_CTX initialization for client sockets.
 pub(super) fn create_client_config(options: ClientConfigOptions) -> Result<ClientConfig, String> {
-    // Ensure default CryptoProvider is installed
-    ensure_default_provider();
-
     // Create custom crypto provider using helper function
     let custom_provider = create_custom_crypto_provider(
         options.protocol_settings.cipher_suites.clone(),
@@ -2365,9 +2456,10 @@ pub(super) fn curve_name_to_kx_group(
     curve: &str,
 ) -> Result<Vec<&'static dyn SupportedKxGroup>, String> {
     // Get the default crypto provider's key exchange groups
-    let provider = rustls::crypto::CryptoProvider::get_default()
-        .expect("A CryptoProvider should have been set earlier");
-    let all_groups = &provider.kx_groups;
+    let crypto_ext = CRYPTO_EXT
+        .get()
+        .expect("A CryptoProvider must be set before SSL");
+    let all_groups = crypto_ext.all_kx_or_default();
 
     match curve {
         // P-256 (also known as secp256r1 or prime256v1)