diff --git a/OpenSSL/test/test_rand.py b/OpenSSL/test/test_rand.py
index f86e4bf..3d5c290 100644
--- a/OpenSSL/test/test_rand.py
+++ b/OpenSSL/test/test_rand.py
@@ -205,7 +205,8 @@
         Random data can be saved and loaded to files with paths specified as
         bytes.
         """
-        path = self.mktemp(suffix=NON_ASCII)
+        path = self.mktemp()
+        path += NON_ASCII.encode(sys.getfilesystemencoding())
         self._read_write_test(path)
 
 
@@ -214,7 +215,7 @@
         Random data can be saved and loaded to files with paths specified as
         unicode.
         """
-        path = self.mktemp(suffix=NON_ASCII).decode('utf-8')
+        path = self.mktemp().decode('utf-8') + NON_ASCII
         self._read_write_test(path)
 
 
diff --git a/OpenSSL/test/test_ssl.py b/OpenSSL/test/test_ssl.py
index 808b8a6..38b566f 100644
--- a/OpenSSL/test/test_ssl.py
+++ b/OpenSSL/test/test_ssl.py
@@ -436,7 +436,7 @@
         instance giving the file name to ``Context.use_privatekey_file``.
         """
         self._use_privatekey_file_test(
-            self.mktemp(suffix=NON_ASCII),
+            self.mktemp() + NON_ASCII.encode(getfilesystemencoding()),
             FILETYPE_PEM,
         )
 
@@ -447,7 +447,7 @@
         instance giving the file name to ``Context.use_privatekey_file``.
         """
         self._use_privatekey_file_test(
-            self.mktemp(suffix=NON_ASCII).decode(getfilesystemencoding()),
+            self.mktemp().decode(getfilesystemencoding()) + NON_ASCII,
             FILETYPE_PEM,
         )
 
@@ -545,7 +545,7 @@
         ``bytes`` filename) which will be used to identify connections created
         using the context.
         """
-        filename = self.mktemp(suffix=NON_ASCII)
+        filename = self.mktemp() + NON_ASCII.encode(getfilesystemencoding())
         self._use_certificate_file_test(filename)
 
 
@@ -555,9 +555,7 @@
         ``bytes`` filename) which will be used to identify connections created
         using the context.
         """
-        filename = self.mktemp(
-            suffix=NON_ASCII
-        ).decode(getfilesystemencoding())
+        filename = self.mktemp().decode(getfilesystemencoding()) + NON_ASCII
         self._use_certificate_file_test(filename)
 
 
@@ -992,7 +990,7 @@
         ``bytes`` instance and uses the certificates within for verification
         purposes.
         """
-        cafile = self.mktemp(suffix=NON_ASCII)
+        cafile = self.mktemp() + NON_ASCII.encode(getfilesystemencoding())
         self._load_verify_cafile(cafile)
 
 
@@ -1003,7 +1001,7 @@
         purposes.
         """
         self._load_verify_cafile(
-            self.mktemp(suffix=NON_ASCII).decode(getfilesystemencoding())
+            self.mktemp().decode(getfilesystemencoding()) + NON_ASCII
         )
 
 
@@ -1043,7 +1041,7 @@
         purposes.
         """
         self._load_verify_directory_locations_capath(
-            self.mktemp(suffix=NON_ASCII)
+            self.mktemp() + NON_ASCII.encode(getfilesystemencoding())
         )
 
 
@@ -1054,7 +1052,7 @@
         purposes.
         """
         self._load_verify_directory_locations_capath(
-            self.mktemp(suffix=NON_ASCII)
+            self.mktemp().decode(getfilesystemencoding()) + NON_ASCII
         )
 
 
@@ -1201,11 +1199,11 @@
 
     def test_add_extra_chain_cert(self):
         """
-        :py:obj:`Context.add_extra_chain_cert` accepts an :py:obj:`X509` instance to add to
-        the certificate chain.
+        :py:obj:`Context.add_extra_chain_cert` accepts an :py:obj:`X509`
+        instance to add to the certificate chain.
 
-        See :py:obj:`_create_certificate_chain` for the details of the certificate
-        chain tested.
+        See :py:obj:`_create_certificate_chain` for the details of the
+        certificate chain tested.
 
         The chain is tested by starting a server with scert and connecting
         to it with a client which trusts cacert and requires verification to
@@ -1216,13 +1214,15 @@
 
         # Dump the CA certificate to a file because that's the only way to load
         # it as a trusted CA in the client context.
-        for cert, name in [(cacert, 'ca.pem'), (icert, 'i.pem'), (scert, 's.pem')]:
-            fObj = open(name, 'w')
+        for cert, name in [(cacert, 'ca.pem'),
+                           (icert, 'i.pem'),
+                           (scert, 's.pem')]:
+            fObj = open(join(self.tmpdir, name), 'w')
             fObj.write(dump_certificate(FILETYPE_PEM, cert).decode('ascii'))
             fObj.close()
 
         for key, name in [(cakey, 'ca.key'), (ikey, 'i.key'), (skey, 's.key')]:
-            fObj = open(name, 'w')
+            fObj = open(join(self.tmpdir, name), 'w')
             fObj.write(dump_privatekey(FILETYPE_PEM, key).decode('ascii'))
             fObj.close()
 
@@ -1237,7 +1237,7 @@
         clientContext = Context(TLSv1_METHOD)
         clientContext.set_verify(
             VERIFY_PEER | VERIFY_FAIL_IF_NO_PEER_CERT, verify_cb)
-        clientContext.load_verify_locations(b"ca.pem")
+        clientContext.load_verify_locations(join(self.tmpdir, "ca.pem"))
 
         # Try it out.
         self._handshake_test(serverContext, clientContext)
@@ -1289,7 +1289,7 @@
         construct and verify a trust chain.
         """
         self._use_certificate_chain_file_test(
-            self.mktemp(suffix=NON_ASCII)
+            self.mktemp() + NON_ASCII.encode(getfilesystemencoding())
         )
 
 
@@ -1300,7 +1300,7 @@
         to construct and verify a trust chain.
         """
         self._use_certificate_chain_file_test(
-            self.mktemp(suffix=NON_ASCII)
+            self.mktemp().decode(getfilesystemencoding()) + NON_ASCII
         )
 
 
@@ -1397,7 +1397,7 @@
         specified file (given as ``bytes``).
         """
         self._load_tmp_dh_test(
-            self.mktemp(suffix=NON_ASCII)
+            self.mktemp() + NON_ASCII.encode(getfilesystemencoding()),
         )
 
 
@@ -1407,7 +1407,7 @@
         specified file (given as ``unicode``).
         """
         self._load_tmp_dh_test(
-            self.mktemp(suffix=NON_ASCII).decode(getfilesystemencoding())
+            self.mktemp().decode(getfilesystemencoding()) + NON_ASCII,
         )
 
 
diff --git a/OpenSSL/test/util.py b/OpenSSL/test/util.py
index c26a57a..78b4a3f 100644
--- a/OpenSSL/test/util.py
+++ b/OpenSSL/test/util.py
@@ -7,18 +7,20 @@
 U{Twisted<http://twistedmatrix.com/>}.
 """
 
+import os
 import shutil
-import traceback
-import os, os.path
-from tempfile import mktemp
-from unittest import TestCase
 import sys
+import traceback
+
+from tempfile import mktemp, mkdtemp
+from unittest import TestCase
 
 from six import PY3
 
 from OpenSSL._util import exception_from_error_queue
 from OpenSSL.crypto import Error
 
+
 try:
     import memdbg
 except Exception:
@@ -28,14 +30,16 @@
 from OpenSSL._util import ffi, lib, byte_string as b
 
 
+
 # This is the UTF-8 encoding of the SNOWMAN unicode code point.
 NON_ASCII = b("\xe2\x98\x83").decode("utf-8")
 
 
+
 class TestCase(TestCase):
     """
-    :py:class:`TestCase` adds useful testing functionality beyond what is available
-    from the standard library :py:class:`unittest.TestCase`.
+    :py:class:`TestCase` adds useful testing functionality beyond what is
+    available from the standard library :py:class:`unittest.TestCase`.
     """
     def run(self, result):
         run = super(TestCase, self).run
@@ -157,24 +161,38 @@
                     (None, Exception(stack % (allocs_report,)), None))
 
 
+    _tmpdir = None
+
+
+    @property
+    def tmpdir(self):
+        """
+        On demand create a temporary directory.
+        """
+        if self._tmpdir is not None:
+            return self._tmpdir
+
+        self._tmpdir = mkdtemp(dir=".")
+        return self._tmpdir
+
+
     def tearDown(self):
         """
-        Clean up any files or directories created using :py:meth:`TestCase.mktemp`.
-        Subclasses must invoke this method if they override it or the
-        cleanup will not occur.
+        Clean up any files or directories created using
+        :py:meth:`TestCase.mktemp`.  Subclasses must invoke this method if they
+        override it or the cleanup will not occur.
         """
-        if self._temporaryFiles is not None:
-            for temp in self._temporaryFiles:
-                if os.path.isdir(temp):
-                    shutil.rmtree(temp)
-                elif os.path.exists(temp):
-                    os.unlink(temp)
+        if self._tmpdir is not None:
+            shutil.rmtree(self._tmpdir)
+
         try:
             exception_from_error_queue(Error)
         except Error:
             e = sys.exc_info()[1]
             if e.args != ([],):
-                self.fail("Left over errors in OpenSSL error queue: " + repr(e))
+                self.fail(
+                    "Left over errors in OpenSSL error queue: " + repr(e)
+                )
 
 
     def assertIsInstance(self, instance, classOrTuple, message=None):
@@ -295,16 +313,13 @@
     assertRaises = failUnlessRaises
 
 
-    _temporaryFiles = None
-    def mktemp(self, suffix=""):
+    def mktemp(self):
         """
-        Pathetic substitute for twisted.trial.unittest.TestCase.mktemp.
+        Return UTF-8-encoded bytes of a path to a tmp file.
+
+        The file will be cleaned up after the test run.
         """
-        if self._temporaryFiles is None:
-            self._temporaryFiles = []
-        temp = mktemp(suffix=suffix, dir=".").encode("utf-8")
-        self._temporaryFiles.append(temp)
-        return temp
+        return mktemp(dir=self.tmpdir).encode("utf-8")
 
 
     # Other stuff