diff --git a/.github/workflows/cmake.yml b/.github/workflows/cmake.yml
new file mode 100644
index 00000000..4f69720f
--- /dev/null
+++ b/.github/workflows/cmake.yml
@@ -0,0 +1,70 @@
+name: wolfPKCS11 CMake Build Tests
+
+on:
+  push:
+    branches: [ 'master', 'main', 'release/**' ]
+  pull_request:
+    branches: [ '*' ]
+
+jobs:
+  build:
+    if: github.repository_owner == 'wolfssl'
+    runs-on: ubuntu-latest
+
+    steps:
+# install cmake
+    - name: Install cmake
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y cmake
+
+# pull wolfPKCS11
+    - uses: actions/checkout@v4
+      with:
+        submodules: true
+
+# setup wolfSSL
+    - uses: actions/checkout@master
+      with:
+        repository: wolfssl/wolfssl
+        path: wolfssl
+    - name: Build wolfssl
+      working-directory: ./wolfssl
+      run: |
+        mkdir build
+        cd build
+        cmake -DCMAKE_VERBOSE_MAKEFILE:BOOL=ON -DWOLFSSL_INSTALL=yes -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/install" \
+            -DWOLFSSL_AES:BOOL=yes -DWOLFSSL_AESCBC:BOOL=yes -DWOLFSSL_AESCCM:BOOL=yes -DWOLFSSL_AESCFB:BOOL=yes \
+            -DWOLFSSL_AESECB:BOOL=yes -DWOLFSSL_AESCTR:BOOL=yes -DWOLFSSL_AESGCM:STRING=yes -DWOLFSSL_AESKEYWRAP:BOOL=yes \
+            -DWOLFSSL_AESOFB:BOOL=yes -DWOLFSSL_AESCTS:BOOL=yes -DWOLFSSL_AESSIV:BOOL=yes -DWOLFSSL_ALIGN_DATA:BOOL=yes \
+            -DWOLFSSL_ASM:BOOL=yes -DWOLFSSL_DH:STRING=yes -DWOLFSSL_DH_DEFAULT_PARAMS:BOOL=yes -DWOLFSSL_ECC:STRING=yes \
+            -DWOLFSSL_EXPERIMENTAL:BOOL=yes -DWOLFSSL_HARDEN:BOOL=yes -DWOLFSSL_HASH_DRBG:BOOL=yes \
+            -DWOLFSSL_HKDF:BOOL=yes -DWOLFSSL_INLINE:BOOL=yes -DWOLFSSL_INSTALL:BOOL=yes -DWOLFSSL_KEYGEN:BOOL=yes \
+            -DWOLFSSL_MD5:BOOL=yes -DWOLFSSL_RNG:BOOL=yes -DWOLFSSL_RSA:BOOL=yes -DWOLFSSL_RSA_PSS:BOOL=yes \
+            -DWOLFSSL_SHA:BOOL=yes -DWOLFSSL_SHA224:BOOL=yes -DWOLFSSL_SHA3:STRING=yes -DWOLFSSL_SHA384:BOOL=yes \
+            -DWOLFSSL_SHA512:BOOL=yes -DWOLFSSL_SHAKE128:STRING=yes -DWOLFSSL_SHAKE256:STRING=yes \
+            -DWOLFSSL_SP_MATH_ALL:BOOL=yes -DWOLFSSL_X86_64_BUILD_ASM:BOOL=yes -DWOLFSSL_MLKEM=1 \
+            -DWOLFSSL_LMS=1 -DWOLFSSL_LMSSHA256192=1 -DWOLFSSL_DILITHIUM:BOOL=yes -DWOLFSSL_PUBLIC_MP:BOOL=yes \
+            -DWOLFSSL_WC_RSA_DIRECT:BOOL=yes -DCMAKE_BUILD_TYPE=Release \
+            ..
+        cmake --build .
+        cmake --install .
+        cd ..
+        rm -rf build
+
+# setup wolfPKCS11
+    - name: Build wolfPKCS11
+      run: |
+        mkdir build
+        cd build
+        cmake -DCMAKE_VERBOSE_MAKEFILE:BOOL=ON -DCMAKE_INSTALL_PREFIX="$GITHUB_WORKSPACE/install" \
+            -DCMAKE_EXPORT_COMPILE_COMMANDS=ON -DWOLFPKCS11_INSTALL:BOOL=yes -DWOLFPKCS11_DEBUG:BOOL=yes \
+            -DWOLFPKCS11_AESKEYWRAP:BOOL=yes -DWOLFPKCS11_AESCTR:BOOL=yes -DWOLFPKCS11_AESCCM:BOOL=yes \
+            -DWOLFPKCS11_AESECB:BOOL=yes -DWOLFPKCS11_AESCTS:BOOL=yes -DWOLFPKCS11_AESCMAC:BOOL=yes \
+            -DWOLFPKCS11_PBKDF2:BOOL=yes -DCMAKE_MODULE_PATH="$GITHUB_WORKSPACE/install/${CMAKE_INSTALL_LIBDIR}" \
+            ..
+        cmake --build .
+        ctest -j $(nproc)
+        cmake --install .
+        cd ..
+        rm -rf build
diff --git a/.gitignore b/.gitignore
index 0eca1c49..b2cebf59 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,7 @@
 language.settings.xml
 wolfpkcs11/config.h.in
 autom4te.cache
+build
 build-aux
 aclocal.m4
 libtool.m4
@@ -31,6 +32,9 @@ wolfpkcs11-config
 *.trs
 coverage
 coverage.info
+cmake/wolfpkcs11Config.cmake
+cmake/wolfpkcs11Targets.cmake
+cmake/wolfpkcs11ConfigVersion.cmake
 tests/pkcs11test
 tests/pkcs11mtt
 tests/pkcs11str
@@ -54,6 +58,7 @@ store/pkcs11mtt
 store/pkcs11test
 store/rsa
 store/str
+store/debug
 test/*
 *.gcda
 *.gcno
diff --git a/CMakeLists.txt b/CMakeLists.txt
new file mode 100644
index 00000000..aa8a0597
--- /dev/null
+++ b/CMakeLists.txt
@@ -0,0 +1,876 @@
+# CMakeLists.txt
+#
+# Copyright (C) 2006-2024 wolfSSL Inc.
+#
+# This file is part of wolfPKCS11.
+#
+# Usage:
+# $ mkdir build
+# $ cd build
+# $ cmake ..
+# $ cmake --build .
+#
+# To build with debugging use:
+# $ cmake .. -DCMAKE_BUILD_TYPE=Debug
+
+####################################################
+# Project
+####################################################
+
+cmake_minimum_required(VERSION 3.16)
+
+if(${CMAKE_VERSION} VERSION_LESS "3.22")
+    message(STATUS "This project recommends using CMake version 3.22 or higher. You are using ${CMAKE_VERSION}.")
+else()
+    cmake_policy(SET CMP0128 NEW)
+endif()
+
+if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
+    message(FATAL_ERROR "In-source builds are not allowed.\
+     Run cmake from a separate directory from where CMakeLists.txt lives.\
+     NOTE: cmake will now create CMakeCache.txt and CMakeFiles/*.\
+     You must delete them, or cmake will refuse to work.")
+endif()
+
+project(wolfpkcs11 VERSION 2.0.0 LANGUAGES C)
+
+# shared library versioning
+# increment if interfaces have been removed or changed
+set(WOLFPKCS11_LIBRARY_VERSION_FIRST 4)
+
+# increment if interfaces have been added
+# set to zero if WOLFPKCS11_LIBRARY_VERSION_FIRST is incremented
+set(WOLFPKCS11_LIBRARY_VERSION_SECOND 0)
+
+# increment if source code has changed
+# set to zero if WOLFPKCS11_LIBRARY_VERSION_FIRST is incremented or
+# WOLFPKCS11_LIBRARY_VERSION_SECOND is incremented
+set(WOLFPKCS11_LIBRARY_VERSION_THIRD 0)
+
+set(LIBTOOL_FULL_VERSION ${WOLFPKCS11_LIBRARY_VERSION_FIRST}.${WOLFPKCS11_LIBRARY_VERSION_SECOND}.${WOLFPKCS11_LIBRARY_VERSION_THIRD})
+
+set(WOLFPKCS11_DEFINITIONS)
+set(WOLFPKCS11_LINK_LIBS)
+set(WOLFPKCS11_INCLUDE_DIRS)
+
+set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules/")
+include(${CMAKE_CURRENT_SOURCE_DIR}/cmake/functions.cmake)
+
+####################################################
+# Compiler
+####################################################
+# Let CMake choose default compiler
+
+if(CMAKE_C_COMPILER_ID STREQUAL "AppleClang")
+    # Silence ranlib warning "has no symbols"
+    set(CMAKE_C_ARCHIVE_CREATE   "<CMAKE_AR> Scr <TARGET> <LINK_FLAGS> <OBJECTS>")
+    set(CMAKE_CXX_ARCHIVE_CREATE "<CMAKE_AR> Scr <TARGET> <LINK_FLAGS> <OBJECTS>")
+    set(CMAKE_C_ARCHIVE_FINISH   "<CMAKE_RANLIB> -no_warning_for_no_symbols -c <TARGET>")
+    set(CMAKE_CXX_ARCHIVE_FINISH "<CMAKE_RANLIB> -no_warning_for_no_symbols -c <TARGET>")
+endif()
+
+include(CheckFunctionExists)
+
+# TODO: Also check if these functions are declared by the
+#       expected headers. See comments around
+#       AC_CHECK_FUNCS/AC_CHECK_DECLS in configure.ac.
+check_function_exists("gethostbyname" HAVE_GETHOSTBYNAME)
+check_function_exists("getaddrinfo" HAVE_GETADDRINFO)
+check_function_exists("gettimeofday" HAVE_GETTIMEOFDAY)
+check_function_exists("inet_ntoa" HAVE_INET_NTOA)
+check_function_exists("memset" HAVE_MEMSET)
+check_function_exists("socket" HAVE_SOCKET)
+
+include(CheckTypeSize)
+
+check_type_size("long long" SIZEOF_LONG_LONG)
+check_type_size("long" SIZEOF_LONG)
+
+
+if(CMAKE_VERSION VERSION_LESS "3.20")
+    # TestBigEndian was deprecated in 3.20
+    include(TestBigEndian)
+    test_big_endian(IS_BIG_ENDIAN)
+    set(CMAKE_C_BYTE_ORDER "LITTLE_ENDIAN")
+    if(IS_BIG_ENDIAN)
+        set(CMAKE_C_BYTE_ORDER "BIG_ENDIAN")
+    endif()
+endif()
+
+if(DEFINED WARNING_C_FLAGS)
+    set(CMAKE_C_FLAGS "${WARNING_C_FLAGS} ${CMAKE_C_FLAGS}")
+elseif(WIN32)
+    # Windows cl.exe does not support the -Wextra, -Wno-unused and -Werror flags.
+    set(CMAKE_C_FLAGS "-Wall ${CMAKE_C_FLAGS}")
+else()
+    set(CMAKE_C_FLAGS "-Wall -Wextra -Wno-unused -Werror ${CMAKE_C_FLAGS}")
+endif()
+
+
+####################################################
+# Build Options
+####################################################
+
+add_option("WOLFPKCS11_INSTALL"
+    "Create install target for WolfPKCS11 project"
+    "yes" "yes;no")
+
+
+# Enable Debugging
+add_option("WOLFPKCS11_DEBUG"
+    "Enables option for debug (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_DEBUG)
+    set(CMAKE_C_FLAGS "-g ${CMAKE_C_FLAGS}")
+    list(APPEND WOLFPKCS11_DEFINITIONS
+        "-DDEBUG"
+        "-DDEBUG_WOLFPKCS11")
+else()
+    set(CMAKE_C_FLAGS "-O2 ${CMAKE_C_FLAGS}")
+    list(APPEND WOLFPKCS11_DEFINITIONS
+        "-DNDEBUG")
+endif()
+
+
+# Coverage
+add_option("WOLFPKCS11_COVERAGE"
+    "Enables option for coverage (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_COVERAGE)
+    set(CMAKE_C_FLAGS "--coverage ${CMAKE_C_FLAGS}")
+endif()
+
+
+# Single threaded
+add_option("WOLFPKCS11_SINGLE_THREADED"
+    "Enable wolfPKCS11 single threaded (default: disabled)"
+    "no" "yes;no")
+
+# TODO: Logic here isn't complete, yet (see AX_PTHREAD)
+if(NOT WOLFPKCS11_SINGLE_THREADED)
+    if(CMAKE_USE_PTHREADS_INIT)
+        list(APPEND WOLFPKCS11_LINK_LIBS Threads::Threads)
+        set(HAVE_PTHREAD 1)
+        list(APPEND WOLFPKCS11_DEFINITIONS
+            "-DHAVE_PTHREAD"
+            "-D_POSIX_THREADS")
+    endif()
+else()
+    set(SINGLE_THREADED 1)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DSINGLE_THREADED")
+endif()
+
+
+# RSA
+add_option("WOLFPKCS11_RSA"
+    "Enable RSA (default: enabled)"
+    "yes" "yes;no")
+
+if(NOT WOLFPKCS11_RSA)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DNO_RSA")
+endif()
+
+
+# RSA-OAEP
+add_option("WOLFPKCS11_OAEP"
+    "Enable RSA OAEP (default: enabled)"
+    "yes" "yes;no")
+
+if(NOT WOLFPKCS11_RSA)
+    override_cache(WOLFPKCS11_OAEP "no")
+endif()
+if(NOT WOLFPKCS11_OAEP)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWC_NO_RSA_OAEP")
+endif()
+
+
+# RSA-PSS
+add_option("WOLFPKCS11_RSA_PSS"
+    "Enable RSA-PSS (default: enabled)"
+    "yes" "yes;no")
+
+if(NOT WOLFPKCS11_RSA)
+    override_cache(WOLFPKCS11_RSA_PSS "no")
+endif()
+if(WOLFPKCS11_RSA_PSS)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWC_RSA_PSS")
+endif()
+
+
+# Key Gen
+add_option("WOLFPKCS11_KEYGEN"
+    "Enable key generation (default: enabled)])"
+    "yes" "yes;no")
+
+if(WOLFPKCS11_KEYGEN)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFSSL_KEY_GEN")
+endif()
+
+
+# ECC
+add_option("WOLFPKCS11_ECC"
+    "Enable ECC (default: enabled)"
+    "yes" "yes;no")
+
+if(WOLFPKCS11_ECC)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DHAVE_ECC")
+endif()
+
+
+# DH
+add_option("WOLFPKCS11_DH"
+    "Enable DH (default: enabled)"
+    "yes" "yes;no;const")
+
+if(NOT WOLFPKCS11_DH)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DNO_DH")
+endif()
+
+
+# AES
+add_option("WOLFPKCS11_AES"
+    "Enable AES (default: enabled)"
+    "yes" "yes;no")
+
+if(NOT WOLFPKCS11_AES)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DNO_AES")
+endif()
+
+# AES KEYWRAP
+add_option("WOLFPKCS11_AESKEYWRAP"
+    "Enable AES KEYWRAP (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_AESKEYWRAP)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DHAVE_AES_KEY_WRAP")
+endif()
+
+# AES-CBC
+add_option("WOLFPKCS11_AESCBC"
+    "Enable wolfPKCS11 AES-CBC support (default: enabled)"
+    "yes" "yes;no")
+
+if(NOT WOLFPKCS11_AESCBC OR NOT WOLFPKCS11_AES)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DNO_AES_CBC")
+endif()
+
+# AES-GCM
+add_option("WOLFPKCS11_AESGCM"
+    "Enable wolfPKCS11 AES-GCM support (default: enabled)"
+    "yes" "yes;no")
+
+if(WOLFPKCS11_AESGCM AND WOLFPKCS11_AES)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DHAVE_AESGCM")
+endif()
+
+# AES-CTR
+add_option("WOLFPKCS11_AESCTR"
+    "Enable wolfPKCS11 AES-CTR support (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_AESCTR AND WOLFPKCS11_AES)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DHAVE_AESCTR")
+endif()
+
+# AES-CCM
+add_option("WOLFPKCS11_AESCCM"
+    "Enable wolfPKCS11 AES-CCM support (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_AESCCM AND WOLFPKCS11_AES)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DHAVE_AESCCM")
+endif()
+
+# AES-ECB
+add_option("WOLFPKCS11_AESECB"
+    "Enable wolfPKCS11 AES-ECB support (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_AESECB AND WOLFPKCS11_AES)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DHAVE_AESECB")
+endif()
+
+# AES-CTS
+add_option("WOLFPKCS11_AESCTS"
+    "Enable wolfPKCS11 AES-CTS support (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_AESCTS AND WOLFPKCS11_AES)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DHAVE_AESCTS")
+endif()
+
+# AES-CMAC
+add_option("WOLFPKCS11_AESCMAC"
+    "Enable wolfPKCS11 AES-CMAC support (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_AESCMAC AND WOLFPKCS11_AES)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DHAVE_AESCMAC")
+endif()
+
+
+# HMAC
+add_option("WOLFPKCS11_HMAC"
+    "Enable wolfPKCS11 HMAC support (default: enabled)"
+    "yes" "yes;no")
+
+if(NOT WOLFPKCS11_HMAC)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DNO_HMAC")
+endif()
+
+
+# HKDF
+add_option("WOLFPKCS11_HKDF"
+    "Enable wolfPKCS11 HKDF support (default: enabled)"
+    "yes" "yes;no")
+
+if(WOLFPKCS11_HKDF)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFPKCS11_HKDF")
+endif()
+
+
+# PBKDF2
+add_option("WOLFPKCS11_PBKDF2"
+    "Enable wolfPKCS11 PBKDF2 support (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_PBKDF2)
+    set(PBKDF2_ITERATIONS 600000 CACHE STRING "Set PBKDF2 iterations (default: 600000)")
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFPKCS11_PBKDF2 -DPBKDF2_ITERATIONS=${PBKDF2_ITERATIONS}")
+endif()
+
+
+# MD5
+add_option("WOLFPKCS11_MD5"
+    "Enable MD5 (default: enabled)"
+    "yes" "yes;no")
+
+if(NOT WOLFPKCS11_MD5)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DNO_MD5")
+endif()
+
+
+# SHA
+add_option("WOLFPKCS11_SHA"
+    "Enable SHA1 (default: enabled)"
+    "yes" "yes;no")
+add_option("WOLFPKCS11_SHA1"
+    "Enable SHA1 (default: enabled)"
+    "yes" "yes;no")
+
+if(NOT WOLFPKCS11_SHA OR NOT WOLFPKCS11_SHA1)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DNO_SHA")
+endif()
+
+# SHA224
+add_option("WOLFPKCS11_SHA224"
+    "Enable wolfPKCS11 SHA-224 support (default: enabled)"
+    "yes" "yes;no")
+
+if(WOLFPKCS11_SHA224)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFSSL_SHA224")
+endif()
+
+# SHA256
+add_option("WOLFPKCS11_SHA256"
+    "Enable wolfPKCS11 SHA-256 support (default: enabled)"
+    "yes" "yes;no")
+
+if(NOT WOLFPKCS11_SHA256)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DNO_SHA256")
+endif()
+
+# SHA384
+add_option("WOLFPKCS11_SHA384"
+    "Enable wolfPKCS11 SHA-384 support (default: enabled)"
+    "yes" "yes;no")
+
+if(WOLFPKCS11_SHA384)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFSSL_SHA384")
+endif()
+
+# SHA512
+add_option("WOLFPKCS11_SHA512"
+    "Enable wolfPKCS11 SHA-512 support (default: enabled)"
+    "yes" "yes;no")
+
+if(WOLFPKCS11_SHA512)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFSSL_SHA512")
+endif()
+
+# SHA3
+add_option("WOLFPKCS11_SHA3"
+    "Enable wolfPKCS11 SHA-3 support (default: enabled)"
+    "yes" "yes;no")
+
+if(WOLFPKCS11_SHA3)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFSSL_SHA3")
+endif()
+
+
+# WolfTPM
+add_option("WOLFPKCS11_TPM"
+    "Enable wolfTPM keystore support (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_TPM)
+    list(APPEND WOLFPKCS11_LINK_LIBS "-lwolftpm")
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFPKCS11_TPM")
+endif()
+
+
+# NSS
+add_option("WOLFPKCS11_NSS"
+    "Enable NSS specific modifications (default: disabled)"
+    "no" "yes;no")
+
+if(WOLFPKCS11_NSS)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFPKCS11_NSS")
+endif()
+
+
+# Default token path
+set(WOLFPKCS11_DEFAULT_TOKEN_PATH "" CACHE STRING "Set default token storage path (default: none)")
+
+if(WOLFPKCS11_DEFAULT_TOKEN_PATH)
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DWOLFPKCS11_DEFAULT_TOKEN_PATH=\"${WOLFPKCS11_DEFAULT_TOKEN_PATH}\"")
+endif()
+
+
+# If wolfpkcs11/options.h exists, delete it to avoid
+# a mixup with build/wolfpkcs11/options.h.
+if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/wolfpkcs11/options.h")
+    file(REMOVE "${CMAKE_CURRENT_SOURCE_DIR}/wolfpkcs11/options.h")
+endif()
+
+# Generate user options header
+message(STATUS "Generating user options header...")
+if (${CMAKE_DISABLE_SOURCE_CHANGES})
+    set(WOLFPKCS11_BUILD_OUT_OF_TREE_DEFAULT "${CMAKE_DISABLE_SOURCE_CHANGES}")
+else()
+    set(WOLFPKCS11_BUILD_OUT_OF_TREE_DEFAULT "yes")
+endif()
+add_option("WOLFPKCS11_BUILD_OUT_OF_TREE"
+    "Don't generate files in the source tree (default: ${WOLFPKCS11_BUILD_OUT_OF_TREE_DEFAULT})"
+    "${WOLFPKCS11_BUILD_OUT_OF_TREE_DEFAULT}" "yes;no")
+if (${WOLFPKCS11_BUILD_OUT_OF_TREE})
+   set(WOLFPKCS11_OUTPUT_BASE ${CMAKE_CURRENT_BINARY_DIR})
+else()
+   set(WOLFPKCS11_OUTPUT_BASE ${CMAKE_CURRENT_SOURCE_DIR})
+endif()
+set(OPTION_FILE "${WOLFPKCS11_OUTPUT_BASE}/wolfpkcs11/options.h")
+
+file(REMOVE ${OPTION_FILE})
+
+
+####################################################
+# Library Target
+####################################################
+
+# TODO: - Build shared/static libs based on enables. Check CMake
+#         global flag BUILD_SHARED_LIBS.
+option(BUILD_SHARED_LIBS
+    "Build shared libraries (.dll/.so) instead of static ones (.lib/.a)"
+    ON)
+
+set(LIB_SOURCES
+    src/internal.c
+    src/wolfpkcs11.c
+    src/slot.c
+    src/crypto.c
+)
+if(BUILD_SHARED_LIBS)
+    message(STATUS "BUILD_SHARED_LIBS enabled: ${LIB_SOURCES}")
+    add_library(wolfpkcs11 SHARED ${LIB_SOURCES})
+else()
+    message(STATUS "Static Libs: ${LIB_SOURCES}")
+    add_library(wolfpkcs11 STATIC ${LIB_SOURCES})
+    list(APPEND WOLFPKCS11_DEFINITIONS "-DHAVE_PKCS11_STATIC")
+endif()
+
+add_library(wolfpkcs11::wolfpkcs11 ALIAS wolfpkcs11)
+
+foreach(DEF IN LISTS WOLFPKCS11_DEFINITIONS)
+    string(REGEX MATCH "^(-D)?([^=]+)(=(.*))?$" DEF_MATCH ${DEF})
+    if (NOT "${CMAKE_MATCH_4}" STREQUAL "")
+        set(${CMAKE_MATCH_2} ${CMAKE_MATCH_4})
+        # message("set(${CMAKE_MATCH_2} ${CMAKE_MATCH_4})")
+    else()
+        set(${CMAKE_MATCH_2} 1)
+        # message("set(${CMAKE_MATCH_2} 1)")
+    endif()
+endforeach()
+
+# If new build options are added please update the cmake/options.h.in
+configure_file(${CMAKE_CURRENT_SOURCE_DIR}/cmake/options.h.in ${OPTION_FILE})
+
+set_target_properties(wolfpkcs11
+    PROPERTIES
+        SOVERSION ${WOLFPKCS11_LIBRARY_VERSION_FIRST}
+        VERSION ${LIBTOOL_FULL_VERSION}
+)
+
+target_compile_definitions(wolfpkcs11 PRIVATE "BUILDING_WOLFPKCS11")
+target_compile_definitions(wolfpkcs11 PRIVATE ${WOLFPKCS11_DEFINITIONS})
+
+# Determine library filename for WOLFPKCS11_DLL_FILENAME
+# This is only needed when building shared libraries
+set(WOLFPKCS11_DLL_DEFINITION "")
+set(WOLFPKCS11_DLL_DEFINITION_FOR_TESTS "")
+set(WOLFPKCS11_DLL_DEFINITION_FOR_EXAMPLES "")
+if(BUILD_SHARED_LIBS)
+    # Get the library output directory
+    get_target_property(LIB_OUTPUT_DIR wolfpkcs11 LIBRARY_OUTPUT_DIRECTORY)
+    if(NOT LIB_OUTPUT_DIR)
+        set(LIB_OUTPUT_DIR ${CMAKE_CURRENT_BINARY_DIR})
+    endif()
+
+    # Determine library filename based on platform
+    if(APPLE)
+        set(WOLFPKCS11_LIB_NAME "libwolfpkcs11.dylib")
+    elseif(WIN32)
+        set(WOLFPKCS11_LIB_NAME "wolfpkcs11.dll")
+    else()
+        set(WOLFPKCS11_LIB_NAME "libwolfpkcs11.so")
+    endif()
+
+    # Calculate relative path from source root to library for tests
+    # Tests run from ${CMAKE_CURRENT_SOURCE_DIR} (source root) to use existing store/ directory
+    # Library is in ${LIB_OUTPUT_DIR} (build directory)
+    file(RELATIVE_PATH WOLFPKCS11_DLL_RELATIVE_PATH_FOR_TESTS
+        ${CMAKE_CURRENT_SOURCE_DIR}
+        ${LIB_OUTPUT_DIR})
+
+    # Calculate relative path from examples directory to library for examples
+    # Examples run from ${WOLFPKCS11_OUTPUT_BASE}/examples
+    file(RELATIVE_PATH WOLFPKCS11_DLL_RELATIVE_PATH_FOR_EXAMPLES
+        ${WOLFPKCS11_OUTPUT_BASE}/examples
+        ${LIB_OUTPUT_DIR})
+
+    # Construct the full relative path to the library for tests (from source root)
+    # Tests run from ${CMAKE_CURRENT_SOURCE_DIR} to use existing store/ directory
+    # Library is in ${LIB_OUTPUT_DIR} (build directory)
+    # file(RELATIVE_PATH) returns "." when paths are the same, or empty string in some cases
+    if(WOLFPKCS11_DLL_RELATIVE_PATH_FOR_TESTS STREQUAL "." OR WOLFPKCS11_DLL_RELATIVE_PATH_FOR_TESTS STREQUAL "")
+        # Library is in the source root (unlikely but handle it) - use ./ prefix for relative path
+        set(WOLFPKCS11_DLL_FILENAME_FOR_TESTS "./${WOLFPKCS11_LIB_NAME}")
+    else()
+        # Library is in build directory relative to source root - ensure it starts with ./ for relative path
+        # file(RELATIVE_PATH) doesn't include ./ prefix, so we add it
+        set(WOLFPKCS11_DLL_FILENAME_FOR_TESTS "./${WOLFPKCS11_DLL_RELATIVE_PATH_FOR_TESTS}/${WOLFPKCS11_LIB_NAME}")
+    endif()
+
+    # Construct the full relative path to the library for examples (from examples directory)
+    # file(RELATIVE_PATH) returns "." when paths are the same, or empty string in some cases
+    if(WOLFPKCS11_DLL_RELATIVE_PATH_FOR_EXAMPLES STREQUAL "." OR WOLFPKCS11_DLL_RELATIVE_PATH_FOR_EXAMPLES STREQUAL "")
+        # Library is in the same directory as examples - use ./ prefix for relative path
+        set(WOLFPKCS11_DLL_FILENAME_FOR_EXAMPLES "./${WOLFPKCS11_LIB_NAME}")
+    else()
+        # Library is in a different directory - ensure it starts with ./ for relative path
+        # file(RELATIVE_PATH) doesn't include ./ prefix, so we add it
+        set(WOLFPKCS11_DLL_FILENAME_FOR_EXAMPLES "./${WOLFPKCS11_DLL_RELATIVE_PATH_FOR_EXAMPLES}/${WOLFPKCS11_LIB_NAME}")
+    endif()
+
+    # Use test path for tests, example path for examples
+    set(WOLFPKCS11_DLL_FILENAME "${WOLFPKCS11_DLL_FILENAME_FOR_TESTS}")
+
+    # Add to compile definitions for examples and tests
+    # We'll set different values for examples vs tests
+    list(APPEND WOLFPKCS11_DLL_DEFINITION_FOR_TESTS "-DWOLFPKCS11_DLL_FILENAME=\"${WOLFPKCS11_DLL_FILENAME_FOR_TESTS}\"")
+    list(APPEND WOLFPKCS11_DLL_DEFINITION_FOR_EXAMPLES "-DWOLFPKCS11_DLL_FILENAME=\"${WOLFPKCS11_DLL_FILENAME_FOR_EXAMPLES}\"")
+    # message(STATUS "WOLFPKCS11_DLL_FILENAME for tests: ${WOLFPKCS11_DLL_FILENAME_FOR_TESTS}")
+    # message(STATUS "WOLFPKCS11_DLL_FILENAME for examples: ${WOLFPKCS11_DLL_FILENAME_FOR_EXAMPLES}")
+endif()
+
+
+####################################################
+# Include Directories
+####################################################
+
+target_include_directories(wolfpkcs11
+    PUBLIC
+        $<INSTALL_INTERFACE:include>
+        $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
+        $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>
+)
+
+
+####################################################
+# Link Libraries
+####################################################
+
+# wolfSSL
+# Check if wolfSSL target already exists (e.g., from add_subdirectory)
+if(TARGET wolfssl::wolfssl)
+    # wolfSSL is already available as a target, use it directly
+    message(STATUS "Using existing wolfSSL target")
+else()
+    # Try to find wolfSSL as an installed package
+    find_package(wolfssl REQUIRED)
+endif()
+list(APPEND WOLFPKCS11_LINK_LIBS wolfssl::wolfssl)
+
+# Other libraries
+target_link_libraries(wolfpkcs11 PUBLIC ${WOLFPKCS11_LINK_LIBS})
+
+if(WIN32)
+    # For Windows link ws2_32
+    target_link_libraries(wolfpkcs11 PUBLIC
+        $<$<PLATFORM_ID:Windows>:ws2_32 crypt32>)
+else()
+    target_link_libraries(wolfpkcs11
+        PUBLIC m)
+endif()
+
+
+####################################################
+# Examples and Tests
+####################################################
+
+# Enable examples
+add_option("WOLFPKCS11_EXAMPLES"
+    "Enable examples (default: enabled)"
+    "yes" "yes;no")
+
+# Enable tests
+add_option("WOLFPKCS11_TESTS"
+    "Enable tests (default: enabled)"
+    "yes" "yes;no")
+
+enable_testing()
+
+if(WOLFPKCS11_TESTS)
+    set(WPKCS11_TEST_TARGETS
+        pkcs11test
+        pkcs11mtt
+        pkcs11str
+        token_path_test
+        rsa_session_persistence_test
+        debug_test
+        object_id_uniqueness_test)
+
+    foreach(test_target IN LISTS WPKCS11_TEST_TARGETS)
+        add_wpkcs11_test(${test_target}
+            ${CMAKE_CURRENT_SOURCE_DIR}/tests/${test_target}.c)
+    endforeach()
+endif()
+
+if(WOLFPKCS11_EXAMPLES)
+    set(WPKCS11_EXAMPLE_TARGETS
+        add_aes_key
+        add_cert
+        add_cert_file
+        add_hmac_key
+        add_rsa_key
+        add_rsa_key_file
+        init_token
+        mech_info
+        obj_list
+        slot_info
+        token_info)
+
+    foreach(example IN LISTS WPKCS11_EXAMPLE_TARGETS)
+        add_wpkcs11_example(${example}
+            ${CMAKE_CURRENT_SOURCE_DIR}/examples/${example}.c)
+    endforeach()
+
+    # Example: nss_pkcs12_pbe_example (only build when NSS is enabled)
+    if(WOLFPKCS11_NSS)
+        add_wpkcs11_example(nss_pkcs12_pbe_example
+            ${CMAKE_CURRENT_SOURCE_DIR}/examples/nss_pkcs12_pbe_example.c)
+    endif()
+
+    # Add example tests in the same order as examples.test (only when tests are enabled)
+    if(WOLFPKCS11_TESTS)
+        # Since tests run from source root, we need to pass the library path via -lib argument
+        # Use the test library path (relative to source root) for example tests
+        if(BUILD_SHARED_LIBS)
+            set(EXAMPLE_LIB_ARG "-lib" "${WOLFPKCS11_DLL_FILENAME_FOR_TESTS}")
+        else()
+            # For static builds, no library path needed
+            set(EXAMPLE_LIB_ARG "")
+        endif()
+
+        # Initialize the token and setup passwords
+        # Example tests run after all normal tests
+        add_test(NAME init_token
+                COMMAND $<TARGET_FILE:init_token>
+                ${EXAMPLE_LIB_ARG}
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(init_token PROPERTIES DEPENDS pkcs11test  RUN_SERIAL TRUE)
+
+        # Get the slot information and display
+        add_test(NAME slot_info
+                COMMAND $<TARGET_FILE:slot_info>
+                ${EXAMPLE_LIB_ARG}
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(slot_info PROPERTIES DEPENDS init_token RUN_SERIAL TRUE)
+
+        # Get the token information and display
+        add_test(NAME token_info
+                COMMAND $<TARGET_FILE:token_info>
+                ${EXAMPLE_LIB_ARG}
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(token_info PROPERTIES DEPENDS slot_info RUN_SERIAL TRUE)
+
+        # Get information on mechanisms and display
+        add_test(NAME mech_info
+                COMMAND $<TARGET_FILE:mech_info>
+                ${EXAMPLE_LIB_ARG}
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(mech_info PROPERTIES DEPENDS token_info RUN_SERIAL TRUE)
+
+        # Add an AES key to the session
+        add_test(NAME add_aes_key
+                COMMAND $<TARGET_FILE:add_aes_key>
+                ${EXAMPLE_LIB_ARG}
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_aes_key PROPERTIES DEPENDS mech_info RUN_SERIAL TRUE)
+
+        # Add an AES key to the token
+        add_test(NAME add_aes_key_token
+                COMMAND $<TARGET_FILE:add_aes_key>
+                ${EXAMPLE_LIB_ARG}
+                -privId "aes-128"
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_aes_key_token PROPERTIES DEPENDS add_aes_key RUN_SERIAL TRUE)
+
+        # Add an HMAC key to the session
+        add_test(NAME add_hmac_key
+                COMMAND $<TARGET_FILE:add_hmac_key>
+                ${EXAMPLE_LIB_ARG}
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_hmac_key PROPERTIES DEPENDS add_aes_key_token RUN_SERIAL TRUE)
+
+        # Add an HMAC key to the token
+        add_test(NAME add_hmac_key_token
+                COMMAND $<TARGET_FILE:add_hmac_key>
+                ${EXAMPLE_LIB_ARG}
+                -privId "hmac-256"
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_hmac_key_token PROPERTIES DEPENDS add_hmac_key RUN_SERIAL TRUE)
+
+        # Add an RSA key to the session
+        add_test(NAME add_rsa_key
+                COMMAND $<TARGET_FILE:add_rsa_key>
+                ${EXAMPLE_LIB_ARG}
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_rsa_key PROPERTIES DEPENDS add_hmac_key_token RUN_SERIAL TRUE)
+
+        # Add an RSA key to the token
+        add_test(NAME add_rsa_key_token
+                COMMAND $<TARGET_FILE:add_rsa_key>
+                ${EXAMPLE_LIB_ARG}
+                -privId "rsa-2048"
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_rsa_key_token PROPERTIES DEPENDS add_rsa_key RUN_SERIAL TRUE)
+
+        # Add an RSA key from file to the session
+        add_test(NAME add_rsa_key_file
+                COMMAND $<TARGET_FILE:add_rsa_key_file>
+                ${EXAMPLE_LIB_ARG}
+                -rsa ${CMAKE_CURRENT_SOURCE_DIR}/examples/rsa-2048.der
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_rsa_key_file PROPERTIES DEPENDS add_rsa_key_token RUN_SERIAL TRUE)
+
+        # Add an RSA key from file to the token
+        add_test(NAME add_rsa_key_file_token
+                COMMAND $<TARGET_FILE:add_rsa_key_file>
+                ${EXAMPLE_LIB_ARG}
+                -privId "rsa-2048.der"
+                -rsa ${CMAKE_CURRENT_SOURCE_DIR}/examples/rsa-2048.der
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_rsa_key_file_token PROPERTIES DEPENDS add_rsa_key_file RUN_SERIAL TRUE)
+
+        # Add a cert to the session
+        add_test(NAME add_cert
+                COMMAND $<TARGET_FILE:add_cert>
+                ${EXAMPLE_LIB_ARG}
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_cert PROPERTIES DEPENDS add_rsa_key_file_token RUN_SERIAL TRUE)
+
+        # Add a cert to the token
+        add_test(NAME add_cert_token
+                COMMAND $<TARGET_FILE:add_cert>
+                ${EXAMPLE_LIB_ARG}
+                -privId "cert-2048"
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(add_cert_token PROPERTIES DEPENDS add_cert RUN_SERIAL TRUE)
+
+        # Show all objects on token
+        add_test(NAME obj_list
+                COMMAND $<TARGET_FILE:obj_list>
+                ${EXAMPLE_LIB_ARG}
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+        set_tests_properties(obj_list PROPERTIES DEPENDS add_cert_token RUN_SERIAL TRUE)
+    endif()
+endif()
+
+
+####################################################
+# Installation
+####################################################
+
+include(GNUInstallDirs)
+
+set(HEADER_EXCLUDE
+    "internal.h"
+    "options.h"
+    "store.h"
+    "version.h"
+  )
+
+list(JOIN HEADER_EXCLUDE "|" EXCLUDED_HEADERS_REGEX)
+
+string(PREPEND EXCLUDED_HEADERS_REGEX "(")
+string(APPEND  EXCLUDED_HEADERS_REGEX ")")
+
+if(WOLFPKCS11_INSTALL)
+    # CMake config package destination (for find_package(wolfpkcs11))
+    set(WOLFPKCS11_CMAKE_INSTALL_DIR "${CMAKE_INSTALL_LIBDIR}/cmake/wolfpkcs11"
+        CACHE STRING "Installation directory for CMake package config files")
+
+    # Install the library
+    install(TARGETS wolfpkcs11
+            EXPORT wolfpkcs11-targets
+            LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
+            ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
+            RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
+            )
+
+    # Install the export file (wolfpkcs11Targets.cmake) so imported targets are available
+    install(EXPORT wolfpkcs11-targets
+            FILE wolfpkcs11Targets.cmake
+            NAMESPACE wolfpkcs11::
+            DESTINATION ${WOLFPKCS11_CMAKE_INSTALL_DIR})
+
+    # Generate and install relocatable config file (wolfpkcs11Config.cmake)
+    include(CMakePackageConfigHelpers)
+    configure_package_config_file(
+        ${CMAKE_CURRENT_SOURCE_DIR}/cmake/wolfpkcs11Config.cmake.in
+        ${CMAKE_CURRENT_BINARY_DIR}/wolfpkcs11Config.cmake
+        INSTALL_DESTINATION ${WOLFPKCS11_CMAKE_INSTALL_DIR})
+
+    # Generate and install version file for find_package version checks
+    write_basic_package_version_file(
+        ${CMAKE_CURRENT_BINARY_DIR}/wolfpkcs11ConfigVersion.cmake
+        VERSION ${PROJECT_VERSION}
+        COMPATIBILITY AnyNewerVersion)
+
+    install(FILES
+            ${CMAKE_CURRENT_BINARY_DIR}/wolfpkcs11Config.cmake
+            ${CMAKE_CURRENT_BINARY_DIR}/wolfpkcs11ConfigVersion.cmake
+            DESTINATION ${WOLFPKCS11_CMAKE_INSTALL_DIR})
+
+    # Install the headers
+    install(DIRECTORY ${WOLFPKCS11_OUTPUT_BASE}/wolfpkcs11/
+            DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/wolfpkcs11
+            FILES_MATCHING PATTERN "*.h"
+            REGEX ${EXCLUDED_HEADERS_REGEX} EXCLUDE)
+    install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/wolfpkcs11/
+            DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/wolfpkcs11
+            FILES_MATCHING PATTERN "*.h"
+            REGEX ${EXCLUDED_HEADERS_REGEX} EXCLUDE)
+endif()
diff --git a/Makefile.am b/Makefile.am
index e695e19b..cc3f53d3 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -44,6 +44,9 @@ include doc/include.am
 EXTRA_DIST+= README.md
 EXTRA_DIST+= LICENSE
 EXTRA_DIST+= autogen.sh
+EXTRA_DIST+= cmake/wolfpkcs11Config.cmake.in
+EXTRA_DIST+= cmake/wolfpkcs11Targets.cmake.in
+EXTRA_DIST+= cmake/wolfpkcs11ConfigVersion.cmake.in
 
 TEST_EXTENSIONS=.test
 TESTS += $(check_PROGRAMS)
@@ -54,6 +57,18 @@ TESTS += $(check_SCRIPTS)
 test: check
 
 DISTCLEANFILES+= wolfpkcs11-config
+CLEANFILES += \
+	cmake/wolfpkcs11Config.cmake \
+	cmake/wolfpkcs11Targets.cmake \
+	cmake/wolfpkcs11ConfigVersion.cmake
+
+if ENABLED_CMAKE_INSTALL
+cmakepkgconfigdir = $(libdir)/cmake/wolfpkcs11
+cmakepkgconfig_DATA = \
+	cmake/wolfpkcs11Config.cmake \
+	cmake/wolfpkcs11Targets.cmake \
+	cmake/wolfpkcs11ConfigVersion.cmake
+endif
 
 
 maintainer-clean-local:
@@ -104,4 +119,3 @@ merge-clean:
 	@find ./ | $(GREP) \.OTHER | xargs rm -f
 	@find ./ | $(GREP) \.BASE | xargs rm -f
 	@find ./ | $(GREP) \~$$ | xargs rm -f
-
diff --git a/cmake/functions.cmake b/cmake/functions.cmake
new file mode 100644
index 00000000..030c333e
--- /dev/null
+++ b/cmake/functions.cmake
@@ -0,0 +1,83 @@
+function(override_cache VAR VAL)
+    get_property(VAR_STRINGS CACHE ${VAR} PROPERTY STRINGS)
+    LIST(FIND VAR_STRINGS ${VAL} CK)
+    if(-1 EQUAL ${CK} AND DEFINED VAR_STRINGS)
+        message(SEND_ERROR
+            "\"${VAL}\" is not valid override value for \"${VAR}\"."
+            " Please select value from \"${VAR_STRINGS}\"\n")
+    endif()
+    set_property(CACHE ${VAR} PROPERTY VALUE ${VAL})
+endfunction()
+
+function(add_option NAME HELP_STRING DEFAULT VALUES)
+    if(VALUES STREQUAL "yes;no")
+        # Set the default value for the option.
+        set(${NAME} ${DEFAULT} CACHE BOOL ${HELP_STRING})
+    else()
+        # Set the default value for the option.
+        set(${NAME} ${DEFAULT} CACHE STRING ${HELP_STRING})
+        # Set the list of allowed values for the option.
+        set_property(CACHE ${NAME} PROPERTY STRINGS ${VALUES})
+    endif()
+
+    if(DEFINED ${NAME})
+        list(FIND VALUES ${${NAME}} IDX)
+        #
+        # If the given value isn't in the list of allowed values for the option,
+        # reduce it to yes/no according to CMake's "if" logic:
+        # https://cmake.org/cmake/help/latest/command/if.html#basic-expressions
+        #
+        # This has no functional impact; it just makes the settings in
+        # CMakeCache.txt and cmake-gui easier to read.
+        #
+        if (${IDX} EQUAL -1)
+            if(${${NAME}})
+                override_cache(${NAME} "yes")
+            else()
+                override_cache(${NAME} "no")
+            endif()
+        endif()
+    endif()
+endfunction()
+
+function(wpkcs11_common_target_setup target_name runtime_dir dll_defs)
+    target_include_directories(${target_name} PRIVATE
+        ${CMAKE_CURRENT_SOURCE_DIR}
+        ${CMAKE_CURRENT_BINARY_DIR}
+        ${ARGN})
+    target_compile_definitions(${target_name} PRIVATE ${WOLFPKCS11_DEFINITIONS})
+    if(BUILD_SHARED_LIBS)
+        target_compile_definitions(${target_name} PRIVATE ${dll_defs})
+    endif()
+    target_link_libraries(${target_name} wolfssl::wolfssl)
+    if(NOT BUILD_SHARED_LIBS)
+        target_link_libraries(${target_name} wolfpkcs11::wolfpkcs11)
+        target_compile_definitions(${target_name} PRIVATE "HAVE_PKCS11_STATIC")
+    elseif(NOT WIN32)
+        target_link_libraries(${target_name} ${CMAKE_DL_LIBS})
+    endif()
+    set_property(TARGET ${target_name}
+                PROPERTY RUNTIME_OUTPUT_DIRECTORY
+                ${runtime_dir})
+endfunction()
+
+function(add_wpkcs11_example target_name source_file)
+    add_executable(${target_name} ${source_file})
+    wpkcs11_common_target_setup(
+        ${target_name}
+        ${WOLFPKCS11_OUTPUT_BASE}/examples
+        "${WOLFPKCS11_DLL_DEFINITION_FOR_EXAMPLES}"
+        ${ARGN})
+endfunction()
+
+function(add_wpkcs11_test target_name source_file)
+    add_executable(${target_name} ${source_file})
+    wpkcs11_common_target_setup(
+        ${target_name}
+        ${WOLFPKCS11_OUTPUT_BASE}/tests
+        "${WOLFPKCS11_DLL_DEFINITION_FOR_TESTS}"
+        ${CMAKE_CURRENT_SOURCE_DIR}/tests)
+    add_test(NAME ${target_name}
+                COMMAND $<TARGET_FILE:${target_name}>
+                WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
+endfunction()
diff --git a/cmake/options.h.in b/cmake/options.h.in
new file mode 100644
index 00000000..92ba40de
--- /dev/null
+++ b/cmake/options.h.in
@@ -0,0 +1,110 @@
+/* options.h.in
+ *
+ * Copyright (C) 2006-2024 wolfSSL Inc.
+ *
+ * This file is part of wolfPKCS11.
+ *
+ * wolfPKCS11 is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfPKCS11 is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+
+/* default blank options for autoconf */
+
+#ifndef WOLFPKCS11_OPTIONS_H
+#define WOLFPKCS11_OPTIONS_H
+
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#ifndef WOLFSSL_OPTIONS_IGNORE_SYS
+#undef _GNU_SOURCE
+#cmakedefine _GNU_SOURCE
+#undef _POSIX_THREADS
+#cmakedefine _POSIX_THREADS
+#endif
+#undef DEBUG_WOLFPKCS11
+#cmakedefine DEBUG_WOLFPKCS11
+#undef SINGLE_THREADED
+#cmakedefine SINGLE_THREADED
+#undef NO_RSA
+#cmakedefine NO_RSA
+#undef WC_NO_RSA_OAEP
+#cmakedefine WC_NO_RSA_OAEP
+#undef WC_RSA_PSS
+#cmakedefine WC_RSA_PSS
+#undef WOLFSSL_KEY_GEN
+#cmakedefine WOLFSSL_KEY_GEN
+#undef HAVE_ECC
+#cmakedefine HAVE_ECC
+#undef NO_DH
+#cmakedefine NO_DH
+#undef NO_AES
+#cmakedefine NO_AES
+#undef HAVE_AES_KEY_WRAP
+#cmakedefine HAVE_AES_KEY_WRAP
+#undef NO_AES_CBC
+#cmakedefine NO_AES_CBC
+#undef HAVE_AESGCM
+#cmakedefine HAVE_AESGCM
+#undef HAVE_AESCTR
+#cmakedefine HAVE_AESCTR
+#undef HAVE_AESCCM
+#cmakedefine HAVE_AESCCM
+#undef HAVE_AESECB
+#cmakedefine HAVE_AESECB
+#undef HAVE_AESCTS
+#cmakedefine HAVE_AESCTS
+#undef HAVE_AESCMAC
+#cmakedefine HAVE_AESCMAC
+#undef NO_HMAC
+#cmakedefine NO_HMAC
+#undef WOLFPKCS11_HKDF
+#cmakedefine WOLFPKCS11_HKDF
+#undef WOLFPKCS11_PBKDF2
+#cmakedefine WOLFPKCS11_PBKDF2
+#undef PBKDF2_ITERATIONS
+#cmakedefine PBKDF2_ITERATIONS @PBKDF2_ITERATIONS@
+#undef NO_MD5
+#cmakedefine NO_MD5
+#undef NO_SHA
+#cmakedefine NO_SHA
+#undef WOLFSSL_SHA224
+#cmakedefine WOLFSSL_SHA224
+#undef NO_SHA256
+#cmakedefine NO_SHA256
+#undef WOLFSSL_SHA384
+#cmakedefine WOLFSSL_SHA384
+#undef WOLFSSL_SHA512
+#cmakedefine WOLFSSL_SHA512
+#undef WOLFSSL_SHA3
+#cmakedefine WOLFSSL_SHA3
+#undef WOLFPKCS11_TPM
+#cmakedefine WOLFPKCS11_TPM
+#undef WOLFPKCS11_NSS
+#cmakedefine WOLFPKCS11_NSS
+#undef WOLFPKCS11_DEFAULT_TOKEN_PATH
+#cmakedefine WOLFPKCS11_DEFAULT_TOKEN_PATH @WOLFPKCS11_DEFAULT_TOKEN_PATH@
+#undef HAVE_PKCS11_STATIC
+#cmakedefine HAVE_PKCS11_STATIC
+
+#ifdef __cplusplus
+}
+#endif
+
+
+#endif /* WOLFPKCS11_OPTIONS_H */
+
diff --git a/cmake/wolfpkcs11Config.cmake.in b/cmake/wolfpkcs11Config.cmake.in
new file mode 100644
index 00000000..ca33f0c0
--- /dev/null
+++ b/cmake/wolfpkcs11Config.cmake.in
@@ -0,0 +1,15 @@
+@PACKAGE_INIT@
+
+if("@HAVE_PTHREAD@" STREQUAL "1")
+  set(_wolfpkcs11_needs_threads TRUE)
+endif()
+
+include(CMakeFindDependencyMacro)
+find_dependency(wolfssl)
+if (_wolfpkcs11_needs_threads)
+  find_dependency(Threads)
+endif()
+
+include ( "${CMAKE_CURRENT_LIST_DIR}/wolfpkcs11Targets.cmake" )
+
+unset(_wolfpkcs11_needs_threads)
diff --git a/cmake/wolfpkcs11ConfigVersion.cmake.in b/cmake/wolfpkcs11ConfigVersion.cmake.in
new file mode 100644
index 00000000..54acbc2a
--- /dev/null
+++ b/cmake/wolfpkcs11ConfigVersion.cmake.in
@@ -0,0 +1,12 @@
+# Generated by Autoconf.
+
+set(PACKAGE_VERSION "@PACKAGE_VERSION@")
+
+if(PACKAGE_VERSION VERSION_LESS PACKAGE_FIND_VERSION)
+  set(PACKAGE_VERSION_COMPATIBLE FALSE)
+else()
+  set(PACKAGE_VERSION_COMPATIBLE TRUE)
+  if(PACKAGE_FIND_VERSION STREQUAL PACKAGE_VERSION)
+    set(PACKAGE_VERSION_EXACT TRUE)
+  endif()
+endif()
diff --git a/cmake/wolfpkcs11Targets.cmake.in b/cmake/wolfpkcs11Targets.cmake.in
new file mode 100644
index 00000000..dcd83dcb
--- /dev/null
+++ b/cmake/wolfpkcs11Targets.cmake.in
@@ -0,0 +1,35 @@
+# Generated by autoconf; do not edit.
+
+if (NOT TARGET wolfpkcs11::wolfpkcs11)
+  add_library(wolfpkcs11::wolfpkcs11 UNKNOWN IMPORTED)
+
+  set(_wolfpkcs11_libdir "@WOLFPKCS11_LIBDIR_ABS@")
+  set(_wolfpkcs11_includedir "@WOLFPKCS11_INCLUDEDIR_ABS@")
+
+  find_library(WOLFPKCS11_LIBRARY NAMES wolfpkcs11 PATHS "${_wolfpkcs11_libdir}" NO_DEFAULT_PATH)
+  if (NOT WOLFPKCS11_LIBRARY)
+    find_library(WOLFPKCS11_LIBRARY NAMES wolfpkcs11)
+  endif()
+  if (NOT WOLFPKCS11_LIBRARY)
+    message(FATAL_ERROR "wolfpkcs11 library not found. Looked in: ${_wolfpkcs11_libdir}")
+  endif()
+
+  set_target_properties(wolfpkcs11::wolfpkcs11 PROPERTIES
+    IMPORTED_LOCATION "${WOLFPKCS11_LIBRARY}"
+    INTERFACE_INCLUDE_DIRECTORIES "${_wolfpkcs11_includedir}"
+  )
+
+  set_property(TARGET wolfpkcs11::wolfpkcs11 APPEND PROPERTY
+    INTERFACE_LINK_LIBRARIES wolfssl::wolfssl
+  )
+
+  if (@HAVE_PTHREAD@)
+    set_property(TARGET wolfpkcs11::wolfpkcs11 APPEND PROPERTY
+      INTERFACE_LINK_LIBRARIES Threads::Threads
+    )
+  endif()
+endif()
+
+unset(_wolfpkcs11_libdir)
+unset(_wolfpkcs11_includedir)
+unset(WOLFPKCS11_LIBRARY)
diff --git a/configure.ac b/configure.ac
index a574875b..df979a4a 100644
--- a/configure.ac
+++ b/configure.ac
@@ -129,6 +129,10 @@ AS_IF([ test "x$ENABLED_SINGLETHREADED" = "xno" ],[
 
 AS_IF([ test "x$ENABLED_SINGLETHREADED" = "xyes" ],[ AM_CFLAGS="-DSINGLE_THREADED $AM_CFLAGS" ])
 
+HAVE_PTHREAD=0
+AS_IF([test "x$ax_pthread_ok" = "xyes"],[HAVE_PTHREAD=1])
+AC_SUBST([HAVE_PTHREAD])
+
 
 AC_ARG_ENABLE([rsa],
     [AS_HELP_STRING([--enable-rsa],[Enable RSA (default: enabled)])],
@@ -471,6 +475,13 @@ fi
 
 AM_CONDITIONAL([ENABLED_NSS],[test "x$enable_nss" = "xyes"])
 
+AC_ARG_ENABLE([cmake-install],
+    [AS_HELP_STRING([--enable-cmake-install],[Enable installation of CMake config/targets files (default: enabled)])],
+    [ ENABLED_CMAKE_INSTALL=$enableval ],
+    [ ENABLED_CMAKE_INSTALL=yes ])
+
+AM_CONDITIONAL([ENABLED_CMAKE_INSTALL],[test "x$ENABLED_CMAKE_INSTALL" = "xyes"])
+
 AC_ARG_WITH([default-token-path],
     [AS_HELP_STRING([--with-default-token-path=PATH],[Set default token storage path (default: none)])],
     [ WOLFPKCS11_DEFAULT_TOKEN_PATH=$withval ],
@@ -498,10 +509,23 @@ AC_SUBST([AM_CPPFLAGS])
 AC_SUBST([AM_CFLAGS])
 AC_SUBST([AM_LDFLAGS])
 
+PACKAGE_INIT='get_filename_component(PACKAGE_PREFIX_DIR "${CMAKE_CURRENT_LIST_DIR}/../../.." ABSOLUTE)'
+AC_SUBST([PACKAGE_INIT])
+
+WOLFPKCS11_LIBDIR_ABS=`eval echo "$libdir"`
+WOLFPKCS11_INCLUDEDIR_ABS=`eval echo "$includedir"`
+AC_SUBST([WOLFPKCS11_LIBDIR_ABS])
+AC_SUBST([WOLFPKCS11_INCLUDEDIR_ABS])
+
 # FINAL
 AC_CONFIG_FILES([Makefile])
 AC_CONFIG_FILES([wolfpkcs11/version.h])
 AC_CONFIG_FILES([wolfpkcs11/options.h])
+AS_IF([test "x$ENABLED_CMAKE_INSTALL" = "xyes"],[
+  AC_CONFIG_FILES([cmake/wolfpkcs11Config.cmake:cmake/wolfpkcs11Config.cmake.in])
+  AC_CONFIG_FILES([cmake/wolfpkcs11Targets.cmake:cmake/wolfpkcs11Targets.cmake.in])
+  AC_CONFIG_FILES([cmake/wolfpkcs11ConfigVersion.cmake:cmake/wolfpkcs11ConfigVersion.cmake.in])
+])
 
 AX_CREATE_GENERIC_CONFIG
 AX_AM_JOBSERVER([yes])
diff --git a/examples/add_aes_key.c b/examples/add_aes_key.c
index 28a89ced..6fb563f7 100644
--- a/examples/add_aes_key.c
+++ b/examples/add_aes_key.c
@@ -67,7 +67,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 
 static byte* userPin = (byte*)"wolfpkcs11-test";
@@ -129,13 +129,16 @@ static CK_RV pkcs11_init(const char* library, CK_SESSION_HANDLE* session)
 
 static void pkcs11_final(CK_SESSION_HANDLE session)
 {
-    if (userPinLen != 0)
-        funcList->C_Logout(session);
-    funcList->C_CloseSession(session);
-
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        if (userPinLen != 0)
+            funcList->C_Logout(session);
+        funcList->C_CloseSession(session);
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/add_cert.c b/examples/add_cert.c
index 1ddaabab..48ff2ccd 100644
--- a/examples/add_cert.c
+++ b/examples/add_cert.c
@@ -67,7 +67,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 
 static byte* userPin = (byte*)"wolfpkcs11-test";
@@ -129,13 +129,16 @@ static CK_RV pkcs11_init(const char* library, CK_SESSION_HANDLE* session)
 
 static void pkcs11_final(CK_SESSION_HANDLE session)
 {
-    if (userPinLen != 0)
-        funcList->C_Logout(session);
-    funcList->C_CloseSession(session);
-
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        if (userPinLen != 0)
+            funcList->C_Logout(session);
+        funcList->C_CloseSession(session);
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/add_cert_file.c b/examples/add_cert_file.c
index 67d618a3..46b8ab7a 100644
--- a/examples/add_cert_file.c
+++ b/examples/add_cert_file.c
@@ -67,7 +67,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 
 static byte* userPin = (byte*)"wolfpkcs11-test";
@@ -133,13 +133,16 @@ static CK_RV pkcs11_init(const char* library, CK_SESSION_HANDLE* session)
 
 static void pkcs11_final(CK_SESSION_HANDLE session)
 {
-    if (userPinLen != 0)
-        funcList->C_Logout(session);
-    funcList->C_CloseSession(session);
-
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        if (userPinLen != 0)
+            funcList->C_Logout(session);
+        funcList->C_CloseSession(session);
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/add_hmac_key.c b/examples/add_hmac_key.c
index 90f02043..f046cf76 100644
--- a/examples/add_hmac_key.c
+++ b/examples/add_hmac_key.c
@@ -67,7 +67,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 
 static byte* userPin = (byte*)"wolfpkcs11-test";
@@ -129,13 +129,16 @@ static CK_RV pkcs11_init(const char* library, CK_SESSION_HANDLE* session)
 
 static void pkcs11_final(CK_SESSION_HANDLE session)
 {
-    if (userPinLen != 0)
-        funcList->C_Logout(session);
-    funcList->C_CloseSession(session);
-
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        if (userPinLen != 0)
+            funcList->C_Logout(session);
+        funcList->C_CloseSession(session);
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/add_rsa_key.c b/examples/add_rsa_key.c
index 0889d097..ac321446 100644
--- a/examples/add_rsa_key.c
+++ b/examples/add_rsa_key.c
@@ -73,7 +73,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 
 static byte* userPin = (byte*)"wolfpkcs11-test";
@@ -135,13 +135,16 @@ static CK_RV pkcs11_init(const char* library, CK_SESSION_HANDLE* session)
 
 static void pkcs11_final(CK_SESSION_HANDLE session)
 {
-    if (userPinLen != 0)
-        funcList->C_Logout(session);
-    funcList->C_CloseSession(session);
-
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        if (userPinLen != 0)
+            funcList->C_Logout(session);
+        funcList->C_CloseSession(session);
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/add_rsa_key_file.c b/examples/add_rsa_key_file.c
index 2661bab8..b3ee2cda 100644
--- a/examples/add_rsa_key_file.c
+++ b/examples/add_rsa_key_file.c
@@ -73,7 +73,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 
 static byte* userPin = (byte*)"wolfpkcs11-test";
@@ -135,13 +135,16 @@ static CK_RV pkcs11_init(const char* library, CK_SESSION_HANDLE* session)
 
 static void pkcs11_final(CK_SESSION_HANDLE session)
 {
-    if (userPinLen != 0)
-        funcList->C_Logout(session);
-    funcList->C_CloseSession(session);
-
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        if (userPinLen != 0)
+            funcList->C_Logout(session);
+        funcList->C_CloseSession(session);
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/init_token.c b/examples/init_token.c
index 413b957e..7ee2b28e 100644
--- a/examples/init_token.c
+++ b/examples/init_token.c
@@ -66,7 +66,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 static const char* tokenName = "wolfpkcs11";
 
@@ -120,9 +120,13 @@ static CK_RV pkcs11_init(const char* library)
 
 static void pkcs11_final(void)
 {
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/mech_info.c b/examples/mech_info.c
index 7d97cbb1..e27d58bd 100644
--- a/examples/mech_info.c
+++ b/examples/mech_info.c
@@ -66,7 +66,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 
 
 /* Load and initialize PKCS#11 library by name.
@@ -120,9 +120,13 @@ static CK_RV pkcs11_init(const char* library)
  */
 static void pkcs11_final(void)
 {
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/nss_pkcs12_pbe_example.c b/examples/nss_pkcs12_pbe_example.c
index 58404726..cffd03dc 100644
--- a/examples/nss_pkcs12_pbe_example.c
+++ b/examples/nss_pkcs12_pbe_example.c
@@ -68,7 +68,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 
 static byte* userPin = (byte*)"wolfpkcs11-test";
@@ -144,10 +144,14 @@ static CK_RV pkcs11_init(const char* library, CK_SESSION_HANDLE* session)
  */
 static void pkcs11_final(CK_SESSION_HANDLE session)
 {
-    funcList->C_CloseSession(session);
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        funcList->C_CloseSession(session);
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/obj_list.c b/examples/obj_list.c
index f73eff89..7599cf67 100644
--- a/examples/obj_list.c
+++ b/examples/obj_list.c
@@ -67,7 +67,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 
 CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 static byte* userPin = (byte*)"wolfpkcs11-test";
@@ -136,13 +136,16 @@ static CK_RV pkcs11_init(const char* library, CK_SESSION_HANDLE* session)
  */
 static void pkcs11_final(CK_SESSION_HANDLE session)
 {
-    if (userPinLen != 0)
-        funcList->C_Logout(session);
-    funcList->C_CloseSession(session);
-
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        if (userPinLen != 0)
+            funcList->C_Logout(session);
+        funcList->C_CloseSession(session);
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/slot_info.c b/examples/slot_info.c
index f6550a50..14084fda 100644
--- a/examples/slot_info.c
+++ b/examples/slot_info.c
@@ -66,7 +66,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 
 
 /* Load and initialize PKCS#11 library by name.
@@ -120,9 +120,13 @@ static CK_RV pkcs11_init(const char* library)
  */
 static void pkcs11_final(void)
 {
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/examples/stm32_dhuk_aes_key.c b/examples/stm32_dhuk_aes_key.c
index 69a7e0fa..473a5e88 100644
--- a/examples/stm32_dhuk_aes_key.c
+++ b/examples/stm32_dhuk_aes_key.c
@@ -62,7 +62,7 @@ extern int uart_printf(const char* format, ...);
     #define WOLFPKCS11_DLL_SLOT 1
 #endif
 
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 
 static byte* userDefaultPin = (byte*)"wolfpkcs11-test";
@@ -98,11 +98,12 @@ static CK_RV pkcs11_init(CK_SESSION_HANDLE* session, char* userPin,
 
 static void pkcs11_final(CK_SESSION_HANDLE session)
 {
-    if (userPinLen != 0)
-        funcList->C_Logout(session);
-    funcList->C_CloseSession(session);
-
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        if (userPinLen != 0)
+            funcList->C_Logout(session);
+        funcList->C_CloseSession(session);
+        funcList->C_Finalize(NULL);
+    }
 }
 
 
diff --git a/examples/token_info.c b/examples/token_info.c
index b999f7f6..3c42a0ab 100644
--- a/examples/token_info.c
+++ b/examples/token_info.c
@@ -66,7 +66,7 @@
 #ifndef HAVE_PKCS11_STATIC
 static void* dlib;
 #endif
-static CK_FUNCTION_LIST* funcList;
+static CK_FUNCTION_LIST* funcList = NULL;
 static CK_SLOT_ID slot = WOLFPKCS11_DLL_SLOT;
 
 
@@ -121,9 +121,13 @@ static CK_RV pkcs11_init(const char* library)
  */
 static void pkcs11_final(void)
 {
-    funcList->C_Finalize(NULL);
+    if (funcList != NULL) {
+        funcList->C_Finalize(NULL);
+    }
 #ifndef HAVE_PKCS11_STATIC
-    dlclose(dlib);
+    if (dlib != NULL) {
+        dlclose(dlib);
+    }
 #endif
 }
 
diff --git a/src/internal.c b/src/internal.c
index dac23e3f..0311ad2a 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -1416,7 +1416,7 @@ int wolfPKCS11_Store_Remove(int type, CK_ULONG id1, CK_ULONG id2)
 #else
     /* remove file */
     ret = wolfPKCS11_Store_Name(type, id1, id2, name, sizeof(name));
-    if (ret == 0) {
+    if (ret > 0 && ret < (int)sizeof(name)) {
         ret = remove(name);
         if (ret < 0) {
             printf("remove(%s) failed: %d\n", name, ret);
@@ -2689,6 +2689,11 @@ int WP11_Object_Copy(WP11_Object *src, WP11_Object *dest)
                     }
 
                     XFREE(derBuf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
+
+                    /* Free destination key on failure */
+                    if (ret != 0) {
+                        wc_FreeRsaKey(dest->data.rsaKey);
+                    }
                     break;
                 }
 #endif
diff --git a/tests/debug_test.c b/tests/debug_test.c
index 6c22dfa4..2fa0946e 100644
--- a/tests/debug_test.c
+++ b/tests/debug_test.c
@@ -40,6 +40,18 @@
 #endif
 #include <wolfpkcs11/pkcs11.h>
 
+/* DLL Location and slot */
+#ifndef WOLFPKCS11_DLL_FILENAME
+    #ifdef __MACH__
+    #define WOLFPKCS11_DLL_FILENAME "./src/.libs/libwolfpkcs11.dylib"
+    #else
+    #define WOLFPKCS11_DLL_FILENAME "./src/.libs/libwolfpkcs11.so"
+    #endif
+#endif
+#ifndef WOLFPKCS11_DLL_SLOT
+    #define WOLFPKCS11_DLL_SLOT 1
+#endif
+
 #ifdef DEBUG_WOLFPKCS11
 #ifndef HAVE_PKCS11_STATIC
 #include <dlfcn.h>
@@ -162,7 +174,7 @@ int main(void)
 #else
     CK_RV rv;
     int debug_found;
-    const char* library = "./src/.libs/libwolfpkcs11.so";
+    const char* library = WOLFPKCS11_DLL_FILENAME;
 
 #ifndef WOLFPKCS11_NO_ENV
     if (!XGETENV("WOLFPKCS11_TOKEN_PATH")) {
diff --git a/tests/pkcs11mtt.c b/tests/pkcs11mtt.c
index c58cea02..3cd94908 100644
--- a/tests/pkcs11mtt.c
+++ b/tests/pkcs11mtt.c
@@ -1523,7 +1523,7 @@ static CK_RV test_recover(void* args)
     }
     if (ret == CKR_OK) {
         ret = funcList->C_VerifyRecover(session, sig, sigSz, data, &dataSz);
-#ifndef NO_RSA
+#if !defined(NO_RSA) && defined(WC_RSA_DIRECT)
         CHECK_CKR_FAIL(ret, CKR_OPERATION_NOT_INITIALIZED,
                                               "Verify Recover not initialized");
 #else
diff --git a/tests/pkcs11test.c b/tests/pkcs11test.c
index 547a2d75..fc858ee6 100644
--- a/tests/pkcs11test.c
+++ b/tests/pkcs11test.c
@@ -5353,7 +5353,7 @@ static CK_RV test_recover(void* args)
     }
     if (ret == CKR_OK) {
         ret = funcList->C_VerifyRecover(session, sig, sigSz, data, &dataSz);
-#ifndef NO_RSA
+#if !defined(NO_RSA) && defined(WC_RSA_DIRECT)
         CHECK_CKR_FAIL(ret, CKR_OPERATION_NOT_INITIALIZED,
                                               "Verify Recover not initialized");
 #else
@@ -5365,7 +5365,7 @@ static CK_RV test_recover(void* args)
     return ret;
 }
 
-#ifndef NO_RSA
+#if !defined(NO_RSA) && defined(WC_RSA_DIRECT)
 static CK_RV rsa_verify_recover(CK_SESSION_HANDLE session,
                                 CK_MECHANISM_TYPE mech_type)
 {
@@ -15793,7 +15793,7 @@ static TEST_FUNC testFunc[] = {
     PKCS11TEST_FUNC_SESS_DECL(test_digest_fail),
     PKCS11TEST_FUNC_SESS_DECL(test_sign_verify),
     PKCS11TEST_FUNC_SESS_DECL(test_recover),
-#ifndef NO_RSA
+#if !defined(NO_RSA) && defined(WC_RSA_DIRECT)
     PKCS11TEST_FUNC_SESS_DECL(test_verify_recover_pkcs),
     PKCS11TEST_FUNC_SESS_DECL(test_verify_recover_x509),
 #endif