diff --git a/contrib/grpc-cmake/CMakeLists.txt b/contrib/grpc-cmake/CMakeLists.txt
index e7cf42cc87f..41263d65109 100644
--- a/contrib/grpc-cmake/CMakeLists.txt
+++ b/contrib/grpc-cmake/CMakeLists.txt
@@ -35,7 +35,7 @@ add_library(ch_contrib::grpc ALIAS _ch_contrib_grpc)
 # Here we are trying to build a binary tool grpc_cpp_plugin in case of cross-compilation.
 # We need this file only during compilation process itself so we need it for our "host"
 # platform, not "target" platform.
-# If we are doing normal compilation this file will be produced in grpc.cmake.
+# If we are doing normal compilation this executable will be produced in grpc.cmake.
 #
 # All code inside this block looks so weird because cmake fundametally doesn't
 # support different toolchains for different targets. So we just running it
@@ -45,6 +45,66 @@ add_library(ch_contrib::grpc ALIAS _ch_contrib_grpc)
 if (NOT CMAKE_HOST_SYSTEM_NAME STREQUAL CMAKE_SYSTEM_NAME
     OR NOT CMAKE_HOST_SYSTEM_PROCESSOR STREQUAL CMAKE_SYSTEM_PROCESSOR)
 
+    # First we need to build openssl for host plaform
+    set(OPENSSL_BUILD_DIR "${_gRPC_BINARY_DIR}/build_openssl")
+
+    set(OPENSSL_SOURCE_DIR "${ClickHouse_SOURCE_DIR}/contrib/openssl-cmake")
+
+    execute_process(
+      COMMAND mkdir -p ${OPENSSL_BUILD_DIR}
+      COMMAND_ECHO STDOUT
+    )
+
+    if (CMAKE_HOST_SYSTEM_PROCESSOR MATCHES "amd64|x86_64")
+        set (HOST_ARCH_AMD64 1)
+    elseif (CMAKE_HOST_SYSTEM_PROCESSOR MATCHES "^(aarch64.*|AARCH64.*|arm64.*|ARM64.*)")
+        set (HOST_ARCH_AARCH64 1)
+    elseif (CMAKE_HOST_SYSTEM_PROCESSOR MATCHES "^(powerpc64le.*|ppc64le.*|PPC64LE.*)")
+        set (HOST_ARCH_PPC64LE 1)
+    elseif (CMAKE_HOST_SYSTEM_PROCESSOR MATCHES "^(s390x.*|S390X.*)")
+        set (HOST_ARCH_S390X 1)
+    elseif (CMAKE_HOST_SYSTEM_PROCESSOR MATCHES "riscv64")
+        set (HOST_ARCH_RISCV64 1)
+    endif ()
+
+    if (CMAKE_HOST_SYSTEM_NAME MATCHES "Linux")
+        set (HOST_OS_LINUX 1)
+    elseif (CMAKE_HOST_SYSTEM_NAME MATCHES "Darwin")
+        set (HOST_OS_DARWIN 1)
+    endif ()
+    execute_process(
+        COMMAND ${CMAKE_COMMAND}
+            "-G${CMAKE_GENERATOR}"
+            "-DCMAKE_MAKE_PROGRAM=${CMAKE_MAKE_PROGRAM}"
+            "-DCMAKE_C_COMPILER=${CMAKE_C_COMPILER}"
+            "-DCMAKE_CXX_COMPILER=${CMAKE_CXX_COMPILER}"
+            "-DARCH_AMD64=${HOST_ARCH_AMD64}"
+            "-DARCH_AARCH64=${HOST_ARCH_AARCH64}"
+            "-DARCH_PPC64LE=${HOST_ARCH_PPC64LE}"
+            "-DARCH_S390X=${HOST_ARCH_S390X}"
+            "-DARCH_RISCV64=${HOST_ARCH_RISCV64}"
+            "-DOS_DARWIN=${HOST_OS_DARWIN}"
+            "-OPENSSL_AUX_BUILD_FOR_CROSS_COMPILATION=1"
+            "-DClickHouse_BINARY_DIR=${ClickHouse_BINARY_DIR}"
+            "-DClickHouse_SOURCE_DIR=${ClickHouse_SOURCE_DIR}"
+            "${OPENSSL_SOURCE_DIR}"
+        WORKING_DIRECTORY "${OPENSSL_BUILD_DIR}"
+        COMMAND_ECHO STDOUT)
+
+    execute_process(
+        COMMAND ${CMAKE_COMMAND} --build "${OPENSSL_BUILD_DIR}"
+        COMMAND_ECHO STDOUT)
+
+    execute_process(
+        COMMAND ${CMAKE_COMMAND} --install "${OPENSSL_BUILD_DIR}"
+        COMMAND_ECHO STDOUT)
+
+    # It's not important on which file we depend, we just want to specify right order
+    add_library(openssl_for_grpc STATIC IMPORTED GLOBAL)
+    set_target_properties (openssl_for_grpc PROPERTIES IMPORTED_LOCATION "${OPENSSL_BUILD_DIR}/libssl.a")
+    add_dependencies(openssl_for_grpc "${OPENSSL_BUILD_DIR}/libssl.a")
+
+    # Okay, openssl ready, let's build grpc_cpp_plugin
     set (GRPC_CPP_PLUGIN_BUILD_DIR "${_gRPC_BINARY_DIR}/build")
 
     execute_process(
@@ -55,11 +115,12 @@ if (NOT CMAKE_HOST_SYSTEM_NAME STREQUAL CMAKE_SYSTEM_NAME
     set(abseil_source_dir "${ClickHouse_SOURCE_DIR}/contrib/abseil-cpp")
     set(protobuf_source_dir "${ClickHouse_SOURCE_DIR}/contrib/google-protobuf")
     set(re2_source_dir "${ClickHouse_SOURCE_DIR}/contrib/re2")
-    set(ssl_source_dir "${ClickHouse_SOURCE_DIR}/contrib/openssl")
+    set(ssl_source_dir "${ClickHouse_SOURCE_DIR}/contrib/openssl-cmake")
     set(zlib_source_dir "${ClickHouse_SOURCE_DIR}/contrib/zlib-ng")
     # For some reason config exists only in this directory
     set(zlib_config_source_dir "${ClickHouse_BINARY_DIR}/contrib/zlib-ng-cmake")
     set(cares_source_dir "${ClickHouse_SOURCE_DIR}/contrib/c-ares")
+
     execute_process(
         COMMAND ${CMAKE_COMMAND}
             "-G${CMAKE_GENERATOR}"
@@ -73,8 +134,10 @@ if (NOT CMAKE_HOST_SYSTEM_NAME STREQUAL CMAKE_SYSTEM_NAME
             "-DPROTOBUF_ROOT_DIR=${protobuf_source_dir}"
             "-DRE2_ROOT_DIR=${re2_source_dir}"
             "-DCARES_ROOT_DIR=${cares_source_dir}"
-            "-DBORINGSSL_ROOT_DIR=${ssl_source_dir}"
+            "-DOPENSSL_ROOT_DIR=${OPENSSL_BUILD_DIR}"
+            "-DOPENSSL_INCLUDE_DIR=${OPENSSL_BUILD_DIR}/include"
             "-DZLIB_ROOT_DIR=${zlib_source_dir}"
+            "-DgRPC_SSL_PROVIDER=package"
             "${_gRPC_SOURCE_DIR}"
         WORKING_DIRECTORY "${GRPC_CPP_PLUGIN_BUILD_DIR}"
         COMMAND_ECHO STDOUT)
@@ -86,4 +149,5 @@ if (NOT CMAKE_HOST_SYSTEM_NAME STREQUAL CMAKE_SYSTEM_NAME
     add_executable(grpc_cpp_plugin IMPORTED GLOBAL)
     set_target_properties (grpc_cpp_plugin PROPERTIES IMPORTED_LOCATION "${GRPC_CPP_PLUGIN_BUILD_DIR}/grpc_cpp_plugin")
     add_dependencies(grpc_cpp_plugin "${GRPC_CPP_PLUGIN_BUILD_DIR}/grpc_cpp_plugin")
+    add_dependencies(grpc_cpp_plugin openssl_for_grpc)
 endif()
diff --git a/contrib/openssl-cmake/CMakeLists.txt b/contrib/openssl-cmake/CMakeLists.txt
index 021c88bcb04..fba1b2edb31 100644
--- a/contrib/openssl-cmake/CMakeLists.txt
+++ b/contrib/openssl-cmake/CMakeLists.txt
@@ -32,9 +32,16 @@ set(OPENSSLDIR "/etc/ssl" CACHE PATH "Set the default openssl directory")
 set(OPENSSL_ENGINESDIR "/usr/local/lib/engines-3" CACHE PATH "Set the default openssl directory for engines")
 set(OPENSSL_MODULESDIR "/usr/local/lib/ossl-modules" CACHE PATH "Set the default openssl directory for modules")
 
-add_definitions(-DOPENSSL_NO_KTLS -DOPENSSLDIR="${OPENSSLDIR}" -DENGINESDIR="${OPENSSL_ENGINESDIR}" -DMODULESDIR="${OPENSSL_MODULESDIR}" -DOPENSSL_USE_NODELETE -DOPENSSL_PIC)
-target_compile_options(global-group INTERFACE "-Wno-deprecated-declarations")
-target_compile_options(global-group INTERFACE "-Wno-poison-system-directories")
+# special type of build during cross-compilation
+if(OPENSSL_AUX_BUILD_FOR_CROSS_COMPILATION)
+    add_definitions(-DOPENSSL_NO_KTLS -DOPENSSLDIR="\\\"${OPENSSLDIR}\\\"" -DENGINESDIR="\\\"${OPENSSL_ENGINESDIR}\\\"" -DMODULESDIR="\\\"${OPENSSL_MODULESDIR}\\\"" -DOPENSSL_USE_NODELETE -DOPENSSL_PIC)
+    add_compile_options("-Wno-deprecated-declarations")
+    add_compile_options("-Wno-poison-system-directories")
+else()
+    add_definitions(-DOPENSSL_NO_KTLS -DOPENSSLDIR="${OPENSSLDIR}" -DENGINESDIR="${OPENSSL_ENGINESDIR}" -DMODULESDIR="${OPENSSL_MODULESDIR}" -DOPENSSL_USE_NODELETE -DOPENSSL_PIC)
+    target_compile_options(global-group INTERFACE "-Wno-deprecated-declarations")
+    target_compile_options(global-group INTERFACE "-Wno-poison-system-directories")
+endif()
 
 if(ARCH_AMD64)
     if(OS_DARWIN)
@@ -1447,4 +1454,9 @@ target_link_libraries(ssl crypto)
 add_library(OpenSSL::Crypto ALIAS crypto)
 add_library(OpenSSL::SSL ALIAS ssl)
 
-install(FILES openssl.conf fipsmodule.conf DESTINATION "${CLICKHOUSE_ETC_DIR}/clickhouse-server" COMPONENT clickhouse)
+if(OPENSSL_AUX_BUILD_FOR_CROSS_COMPILATION)
+    install(DIRECTORY "${PLATFORM_DIRECTORY}/include" DESTINATION "${CMAKE_BINARY_DIR}")
+    install(DIRECTORY "${OPENSSL_SOURCE_DIR}/include" DESTINATION "${CMAKE_BINARY_DIR}")
+else()
+    install(FILES openssl.conf fipsmodule.conf DESTINATION "${CLICKHOUSE_ETC_DIR}/clickhouse-server" COMPONENT clickhouse)
+endif()