diff --git a/Misc/NEWS b/Misc/NEWS
index 6212459..ef9de6b 100644
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -127,6 +127,9 @@
 Build
 -----
 
+- Bug #1535502, build _hashlib on Windows, and use masm assembler
+  code in OpenSSL.
+
 - Bug #1534738, win32 debug version of _msi should be _msi_d.pyd.
 
 - Bug #1530448, ctypes buld failure on Solaris 10 was fixed.
diff --git a/PCbuild/_ssl.mak b/PCbuild/_ssl.mak
index 2c47c6b..61fc953 100644
--- a/PCbuild/_ssl.mak
+++ b/PCbuild/_ssl.mak
@@ -1,21 +1,37 @@
 
 !IFDEF DEBUG
-MODULE=_ssl_d.pyd
-TEMP_DIR=x86-temp-debug/_ssl
+SUFFIX=_d.pyd
+TEMP=x86-temp-debug/
 CFLAGS=/Od /Zi /MDd /LDd /DDEBUG /D_DEBUG /DWIN32
 SSL_LIB_DIR=$(SSL_DIR)/out32.dbg
 !ELSE
-MODULE=_ssl.pyd
-TEMP_DIR=x86-temp-release/_ssl
+SUFFIX=.pyd
+TEMP=x86-temp-release/
 CFLAGS=/Ox /MD /LD /DWIN32
 SSL_LIB_DIR=$(SSL_DIR)/out32
 !ENDIF
 
 INCLUDES=-I ../Include -I ../PC -I $(SSL_DIR)/inc32
-LIBS=gdi32.lib wsock32.lib user32.lib advapi32.lib /libpath:$(SSL_LIB_DIR) libeay32.lib ssleay32.lib
 
-SOURCE=../Modules/_ssl.c $(SSL_LIB_DIR)/libeay32.lib $(SSL_LIB_DIR)/ssleay32.lib
+SSL_LIBS=gdi32.lib wsock32.lib user32.lib advapi32.lib /LIBPATH:$(SSL_LIB_DIR) libeay32.lib ssleay32.lib
+SSL_SOURCE=../Modules/_ssl.c $(SSL_LIB_DIR)/libeay32.lib $(SSL_LIB_DIR)/ssleay32.lib
 
-$(MODULE): $(SOURCE) ../PC/*.h ../Include/*.h
-    @if not exist "$(TEMP_DIR)/." mkdir "$(TEMP_DIR)"
-    cl /nologo $(SOURCE) $(CFLAGS) /Fo$(TEMP_DIR)\$*.obj $(INCLUDES) /link /out:$(MODULE) $(LIBS)
+HASH_LIBS=gdi32.lib user32.lib advapi32.lib /libpath:$(SSL_LIB_DIR) libeay32.lib
+HASH_SOURCE=../Modules/_hashopenssl.c $(SSL_LIB_DIR)/libeay32.lib
+
+all: _ssl$(SUFFIX) _hashlib$(SUFFIX)
+
+# Split compile/link into two steps to better support VSExtComp
+_ssl$(SUFFIX): $(SSL_SOURCE) ../PC/*.h ../Include/*.h
+	@if not exist "$(TEMP)/_ssl/." mkdir "$(TEMP)/_ssl"
+	cl /nologo $(SSL_SOURCE) $(CFLAGS) /Fo$(TEMP)\_ssl\$*.obj $(INCLUDES)
+	link /nologo @<<
+             /dll /out:_ssl$(SUFFIX) $(TEMP)\_ssl\$*.obj $(SSL_LIBS)
+<<
+
+_hashlib$(SUFFIX): $(HASH_SOURCE) ../PC/*.h ../Include/*.h
+    @if not exist "$(TEMP)/_hashlib/." mkdir "$(TEMP)/_hashlib"
+    cl /nologo /c $(HASH_SOURCE) $(CFLAGS) /Fo$(TEMP)\_hashlib\$*.obj $(INCLUDES) 
+    link /nologo @<<
+	/dll /out:_hashlib$(SUFFIX) $(HASH_LIBS) $(TEMP)\_hashlib\$*.obj
+<<
diff --git a/PCbuild/_ssl.vcproj b/PCbuild/_ssl.vcproj
index bc69ee8..c1abd24 100644
--- a/PCbuild/_ssl.vcproj
+++ b/PCbuild/_ssl.vcproj
@@ -75,6 +75,9 @@
 		<File
 			RelativePath="..\Modules\_ssl.c">
 		</File>
+		<File
+			RelativePath="..\Modules\_hashopenssl.c">
+		</File>
 	</Files>
 	<Globals>
 	</Globals>
diff --git a/PCbuild/build_ssl.py b/PCbuild/build_ssl.py
index d4beee5..03f3d76 100644
--- a/PCbuild/build_ssl.py
+++ b/PCbuild/build_ssl.py
@@ -1,7 +1,7 @@
-# Script for building the _ssl module for Windows.
+# Script for building the _ssl and _hashlib modules for Windows.
 # Uses Perl to setup the OpenSSL environment correctly
 # and build OpenSSL, then invokes a simple nmake session
-# for _ssl.pyd itself.
+# for the actual _ssl.pyd and _hashlib.pyd DLLs.
 
 # THEORETICALLY, you can:
 # * Unpack the latest SSL release one level above your main Python source
@@ -10,8 +10,8 @@
 # * Install ActivePerl and ensure it is somewhere on your path.
 # * Run this script from the PCBuild directory.
 #
-# it should configure and build SSL, then build the ssl Python extension
-# without intervention.
+# it should configure and build SSL, then build the _ssl and _hashlib
+# Python extensions without intervention.
 
 import os, sys, re
 
@@ -59,7 +59,8 @@
     candidates = []
     for s in sources:
         try:
-            s = os.path.abspath(s)
+            # note: do not abspath s; the build will fail if any
+            # higher up directory name has spaces in it.
             fnames = os.listdir(s)
         except os.error:
             fnames = []
@@ -82,31 +83,9 @@
         print "Found an SSL directory at '%s'" % (best_name,)
     else:
         print "Could not find an SSL directory in '%s'" % (sources,)
+    sys.stdout.flush()
     return best_name
 
-def run_32all_py():
-    # ms\32all.bat will reconfigure OpenSSL and then try to build
-    # all outputs (debug/nondebug/dll/lib).  So we filter the file
-    # to exclude any "nmake" commands and then execute.
-    tempname = "ms\\32all_py.bat"
-
-    in_bat  = open("ms\\32all.bat")
-    temp_bat = open(tempname,"w")
-    while 1:
-        cmd = in_bat.readline()
-        print 'cmd', repr(cmd)
-        if not cmd: break
-        if cmd.strip()[:5].lower() == "nmake":
-            continue
-        temp_bat.write(cmd)
-    in_bat.close()
-    temp_bat.close()
-    os.system(tempname)
-    try:
-        os.remove(tempname)
-    except:
-        pass
-
 def run_configure(configure, do_script):
     os.system("perl Configure "+configure)
     os.system(do_script)
@@ -117,12 +96,14 @@
         arch = "x86"
         debug = False
         configure = "VC-WIN32"
-        makefile = "32.mak"
+        do_script = "ms\\do_masm"
+        makefile = "ms\\nt.mak"
     elif sys.argv[1] == "Debug":
         arch = "x86"
         debug = True
         configure = "VC-WIN32"
-        makefile="d32.mak"
+        do_script = "ms\\do_masm"
+        makefile="ms\\d32.mak"
     elif sys.argv[1] == "ReleaseItanium":
         arch = "ia64"
         debug = False
@@ -148,8 +129,9 @@
         sys.exit(1)
 
     print "Found a working perl at '%s'" % (perl,)
+    sys.stdout.flush()
     # Look for SSL 2 levels up from pcbuild - ie, same place zlib etc all live.
-    ssl_dir = find_best_ssl_dir(("../..",))
+    ssl_dir = find_best_ssl_dir(("..\\..",))
     if ssl_dir is None:
         sys.exit(1)
 
@@ -159,29 +141,35 @@
         # If the ssl makefiles do not exist, we invoke Perl to generate them.
         if not os.path.isfile(makefile):
             print "Creating the makefiles..."
+            sys.stdout.flush()
             # Put our working Perl at the front of our path
-            os.environ["PATH"] = os.path.split(perl)[0] + \
+            os.environ["PATH"] = os.path.dirname(perl) + \
                                           os.pathsep + \
                                           os.environ["PATH"]
-            if arch=="x86":
-                run_32all_py()
-            else:
-                run_configure(configure, do_script)
+            if arch=="x86" and debug:
+                # the do_masm script in openssl doesn't generate a debug
+                # build makefile so we generate it here:
+                os.system("perl util\mk1mf.pl debug "+configure+" >"+makefile)
+            run_configure(configure, do_script)
 
         # Now run make.
         print "Executing nmake over the ssl makefiles..."
-        rc = os.system("nmake /nologo -f "+makefile)
+        sys.stdout.flush()
+        rc = os.system("nmake /nologo PERL=\"%s\" -f \"%s\"" %(perl, makefile))
         if rc:
-            print "Executing d32.mak failed"
+            print "Executing "+makefile+" failed"
             print rc
             sys.exit(rc)
     finally:
         os.chdir(old_cd)
     # And finally, we can build the _ssl module itself for Python.
-    defs = "SSL_DIR=%s" % (ssl_dir,)
+    defs = "SSL_DIR=\"%s\"" % (ssl_dir,)
     if debug:
         defs = defs + " " + "DEBUG=1"
-    rc = os.system('nmake /nologo -f _ssl.mak ' + defs + " " + make_flags)
+    makeCommand = 'nmake /nologo -f _ssl.mak ' + defs + " " + make_flags
+    print "Executing:", makeCommand
+    sys.stdout.flush()
+    rc = os.system(makeCommand)
     sys.exit(rc)
 
 if __name__=='__main__':
diff --git a/Tools/msi/msi.py b/Tools/msi/msi.py
index aebab98..8a72eb9 100644
--- a/Tools/msi/msi.py
+++ b/Tools/msi/msi.py
@@ -89,7 +89,8 @@
     '_msi.pyd',
     '_ctypes.pyd',
     '_ctypes_test.pyd',
-    '_sqlite3.pyd'
+    '_sqlite3.pyd',
+    '_hashlib.pyd'
 ]
 
 # Well-known component UUIDs