diff --git a/.gitmodules b/.gitmodules
index 696676200fe..3bc71904d45 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -213,6 +213,7 @@
 [submodule "contrib/boringssl"]
 	path = contrib/boringssl
 	url = https://github.com/ClickHouse-Extras/boringssl.git
+	branch = MergeWithUpstream
 [submodule "contrib/NuRaft"]
 	path = contrib/NuRaft
 	url = https://github.com/ClickHouse-Extras/NuRaft.git
diff --git a/contrib/boringssl b/contrib/boringssl
index a6a2e2ab3e4..c1e01a441d6 160000
--- a/contrib/boringssl
+++ b/contrib/boringssl
@@ -1 +1 @@
-Subproject commit a6a2e2ab3e44d97ce98e51c558e989f211de7eb3
+Subproject commit c1e01a441d6db234f4f12e63a7657d1f9e6db9c1
diff --git a/contrib/boringssl-cmake/CMakeLists.txt b/contrib/boringssl-cmake/CMakeLists.txt
index 4502d6e9d42..474e32f3b91 100644
--- a/contrib/boringssl-cmake/CMakeLists.txt
+++ b/contrib/boringssl-cmake/CMakeLists.txt
@@ -4,7 +4,7 @@
 
 # This file is created by generate_build_files.py and edited accordingly.
 
-cmake_minimum_required(VERSION 3.0)
+cmake_minimum_required(VERSION 3.5)
 
 project(BoringSSL LANGUAGES C CXX)
 
@@ -20,12 +20,7 @@ if(CMAKE_COMPILER_IS_GNUCXX OR CLANG)
     set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} -stdlib=libc++")
   endif()
 
-  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fno-common")
-  if((CMAKE_C_COMPILER_VERSION VERSION_GREATER "4.8.99") OR CLANG)
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=c11")
-  else()
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -std=c99")
-  endif()
+  set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -fno-common -std=c11")
 endif()
 
 # pthread_rwlock_t requires a feature flag.
@@ -55,7 +50,7 @@ add_definitions(-DBORINGSSL_IMPLEMENTATION)
 # builds.
 if(NOT OPENSSL_NO_ASM AND CMAKE_OSX_ARCHITECTURES)
   list(LENGTH CMAKE_OSX_ARCHITECTURES NUM_ARCHES)
-  if(NOT ${NUM_ARCHES} EQUAL 1)
+  if(NOT NUM_ARCHES EQUAL 1)
     message(FATAL_ERROR "Universal binaries not supported.")
   endif()
   list(GET CMAKE_OSX_ARCHITECTURES 0 CMAKE_SYSTEM_PROCESSOR)
@@ -78,7 +73,13 @@ elseif(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "AMD64")
 elseif(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "x86")
   set(ARCH "x86")
 elseif(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "i386")
-  set(ARCH "x86")
+  # cmake uses `uname -p` to set the system processor, but Solaris
+  # systems support multiple architectures.
+  if((${CMAKE_SYSTEM_NAME} STREQUAL "SunOS") AND CMAKE_SIZEOF_VOID_P EQUAL 8)
+    set(ARCH "x86_64")
+  else()
+    set(ARCH "x86")
+  endif()
 elseif(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "i686")
   set(ARCH "x86")
 elseif(${CMAKE_SYSTEM_PROCESSOR} STREQUAL "aarch64")
@@ -289,6 +290,21 @@ set(
   mac-x86_64/crypto/test/trampoline-x86_64.S
 )
 
+set(
+  CRYPTO_win_aarch64_SOURCES
+
+  win-aarch64/crypto/chacha/chacha-armv8.S
+  win-aarch64/crypto/fipsmodule/aesv8-armx64.S
+  win-aarch64/crypto/fipsmodule/armv8-mont.S
+  win-aarch64/crypto/fipsmodule/ghash-neon-armv8.S
+  win-aarch64/crypto/fipsmodule/ghashv8-armx64.S
+  win-aarch64/crypto/fipsmodule/sha1-armv8.S
+  win-aarch64/crypto/fipsmodule/sha256-armv8.S
+  win-aarch64/crypto/fipsmodule/sha512-armv8.S
+  win-aarch64/crypto/fipsmodule/vpaes-armv8.S
+  win-aarch64/crypto/test/trampoline-armv8.S
+)
+
 set(
   CRYPTO_win_x86_SOURCES
 
@@ -331,9 +347,9 @@ set(
   win-x86_64/crypto/test/trampoline-x86_64.asm
 )
 
-if(APPLE AND ${ARCH} STREQUAL "aarch64")
+if(APPLE AND ARCH STREQUAL "aarch64")
   set(CRYPTO_ARCH_SOURCES ${CRYPTO_ios_aarch64_SOURCES})
-elseif(APPLE AND ${ARCH} STREQUAL "arm")
+elseif(APPLE AND ARCH STREQUAL "arm")
   set(CRYPTO_ARCH_SOURCES ${CRYPTO_ios_arm_SOURCES})
 elseif(APPLE)
   set(CRYPTO_ARCH_SOURCES ${CRYPTO_mac_${ARCH}_SOURCES})
@@ -360,6 +376,7 @@ add_library(
   "${BORINGSSL_SOURCE_DIR}/crypto/asn1/a_object.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/asn1/a_octet.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/asn1/a_print.c"
+  "${BORINGSSL_SOURCE_DIR}/crypto/asn1/a_strex.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/asn1/a_strnid.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/asn1/a_time.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/asn1/a_type.c"
@@ -389,6 +406,7 @@ add_library(
   "${BORINGSSL_SOURCE_DIR}/crypto/bio/printf.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/bio/socket.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/bio/socket_helper.c"
+  "${BORINGSSL_SOURCE_DIR}/crypto/blake2/blake2.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/bn_extra/bn_asn1.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/bn_extra/convert.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/buf/buf.c"
@@ -413,6 +431,7 @@ add_library(
   "${BORINGSSL_SOURCE_DIR}/crypto/conf/conf.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/cpu-aarch64-fuchsia.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/cpu-aarch64-linux.c"
+  "${BORINGSSL_SOURCE_DIR}/crypto/cpu-aarch64-win.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/cpu-arm-linux.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/cpu-arm.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/cpu-intel.c"
@@ -452,7 +471,6 @@ add_library(
   "${BORINGSSL_SOURCE_DIR}/crypto/ex_data.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/fipsmodule/bcm.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/fipsmodule/fips_shared_support.c"
-  "${BORINGSSL_SOURCE_DIR}/crypto/fipsmodule/is_fips.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/hkdf/hkdf.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/hpke/hpke.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/hrss/hrss.c"
@@ -499,13 +517,13 @@ add_library(
   "${BORINGSSL_SOURCE_DIR}/crypto/trust_token/voprf.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/a_digest.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/a_sign.c"
-  "${BORINGSSL_SOURCE_DIR}/crypto/x509/a_strex.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/a_verify.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/algorithm.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/asn1_gen.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/by_dir.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/by_file.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/i2d_pr.c"
+  "${BORINGSSL_SOURCE_DIR}/crypto/x509/name_print.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/rsa_pss.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/t_crl.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/t_req.c"
@@ -519,7 +537,6 @@ add_library(
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/x509_ext.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/x509_lu.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/x509_obj.c"
-  "${BORINGSSL_SOURCE_DIR}/crypto/x509/x509_r2x.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/x509_req.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/x509_set.c"
   "${BORINGSSL_SOURCE_DIR}/crypto/x509/x509_trs.c"
@@ -589,6 +606,8 @@ add_library(
   "${BORINGSSL_SOURCE_DIR}/ssl/d1_srtp.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/dtls_method.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/dtls_record.cc"
+  "${BORINGSSL_SOURCE_DIR}/ssl/encrypted_client_hello.cc"
+  "${BORINGSSL_SOURCE_DIR}/ssl/extensions.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/handoff.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/handshake.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/handshake_client.cc"
@@ -611,7 +630,6 @@ add_library(
   "${BORINGSSL_SOURCE_DIR}/ssl/ssl_versions.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/ssl_x509.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/t1_enc.cc"
-  "${BORINGSSL_SOURCE_DIR}/ssl/t1_lib.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/tls13_both.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/tls13_client.cc"
   "${BORINGSSL_SOURCE_DIR}/ssl/tls13_enc.cc"
@@ -633,6 +651,7 @@ add_executable(
   "${BORINGSSL_SOURCE_DIR}/tool/digest.cc"
   "${BORINGSSL_SOURCE_DIR}/tool/fd.cc"
   "${BORINGSSL_SOURCE_DIR}/tool/file.cc"
+  "${BORINGSSL_SOURCE_DIR}/tool/generate_ech.cc"
   "${BORINGSSL_SOURCE_DIR}/tool/generate_ed25519.cc"
   "${BORINGSSL_SOURCE_DIR}/tool/genrsa.cc"
   "${BORINGSSL_SOURCE_DIR}/tool/pkcs12.cc"