diff -up openssl-1.1.1c/ssl/record/ssl3_record.c.compliance openssl-1.1.1c/ssl/record/ssl3_record.c
--- openssl-1.1.1c/ssl/record/ssl3_record.c.compliance	2019-05-28 15:12:21.000000000 +0200
+++ openssl-1.1.1c/ssl/record/ssl3_record.c	2019-11-25 13:10:53.890637381 +0100
@@ -559,7 +559,7 @@ int ssl3_get_record(SSL *s)
             RECORD_LAYER_reset_read_sequence(&s->rlayer);
             return 1;
         }
-        SSLfatal(s, SSL_AD_DECRYPTION_FAILED, SSL_F_SSL3_GET_RECORD,
+        SSLfatal(s, SSL_AD_BAD_RECORD_MAC, SSL_F_SSL3_GET_RECORD,
                  SSL_R_BLOCK_CIPHER_PAD_IS_WRONG);
         return -1;
     }
diff -up openssl-1.1.1c/ssl/statem/extensions_srvr.c.compliance openssl-1.1.1c/ssl/statem/extensions_srvr.c
--- openssl-1.1.1c/ssl/statem/extensions_srvr.c.compliance	2019-05-28 15:12:21.000000000 +0200
+++ openssl-1.1.1c/ssl/statem/extensions_srvr.c	2019-11-25 13:12:59.329459528 +0100
@@ -1487,6 +1487,10 @@ EXT_RETURN tls_construct_stoc_status_req
                                              unsigned int context, X509 *x,
                                              size_t chainidx)
 {
+    /* We don't currently support this extension inside a CertificateRequest */
+    if (context == SSL_EXT_TLS1_3_CERTIFICATE_REQUEST)
+        return EXT_RETURN_NOT_SENT;
+
     if (!s->ext.status_expected)
         return EXT_RETURN_NOT_SENT;