diff --git a/packages/google-auth/google/auth/aio/transport/mtls.py b/packages/google-auth/google/auth/aio/transport/mtls.py
index b85d30b53485..121282129c65 100644
--- a/packages/google-auth/google/auth/aio/transport/mtls.py
+++ b/packages/google-auth/google/auth/aio/transport/mtls.py
@@ -17,42 +17,17 @@
 """
 
 import asyncio
-import contextlib
 import logging
-import os
 import ssl
-import tempfile
 from typing import Optional
 
 from google.auth import exceptions
-import google.auth.transport._mtls_helper
+from google.auth.transport._mtls_helper import secure_cert_key_paths
 import google.auth.transport.mtls
 
 _LOGGER = logging.getLogger(__name__)
 
 
-@contextlib.contextmanager
-def _create_temp_file(content: bytes):
-    """Creates a temporary file with the given content.
-
-    Args:
-        content (bytes): The content to write to the file.
-
-    Yields:
-        str: The path to the temporary file.
-    """
-    # Create a temporary file that is readable only by the owner.
-    fd, file_path = tempfile.mkstemp()
-    try:
-        with os.fdopen(fd, "wb") as f:
-            f.write(content)
-        yield file_path
-    finally:
-        # Securely delete the file after use.
-        if os.path.exists(file_path):
-            os.remove(file_path)
-
-
 def make_client_cert_ssl_context(
     cert_bytes: bytes, key_bytes: bytes, passphrase: Optional[bytes] = None
 ) -> ssl.SSLContext:
@@ -71,19 +46,24 @@ def make_client_cert_ssl_context(
     Raises:
         google.auth.exceptions.TransportError: If there is an error loading the certificate.
     """
-    with _create_temp_file(cert_bytes) as cert_path, _create_temp_file(
-        key_bytes
-    ) as key_path:
-        try:
+    try:
+        with secure_cert_key_paths(cert_bytes, key_bytes, passphrase=passphrase) as (
+            cert_path,
+            key_path,
+            passphrase_val,
+        ):
             context = ssl.create_default_context(ssl.Purpose.SERVER_AUTH)
-            context.load_cert_chain(
-                certfile=cert_path, keyfile=key_path, password=passphrase
-            )
+            if cert_path:
+                context.load_cert_chain(
+                    certfile=cert_path,
+                    keyfile=key_path,
+                    password=passphrase_val,
+                )
             return context
-        except (ssl.SSLError, OSError, IOError, ValueError, RuntimeError) as exc:
-            raise exceptions.TransportError(
-                "Failed to load client certificate and key for mTLS."
-            ) from exc
+    except (ssl.SSLError, OSError, IOError, ValueError, RuntimeError) as exc:
+        raise exceptions.TransportError(
+            "Failed to load client certificate and key for mTLS."
+        ) from exc
 
 
 async def _run_in_executor(func, *args):
diff --git a/packages/google-auth/google/auth/compute_engine/_mtls.py b/packages/google-auth/google/auth/compute_engine/_mtls.py
index a427e66a89b3..25925d440548 100644
--- a/packages/google-auth/google/auth/compute_engine/_mtls.py
+++ b/packages/google-auth/google/auth/compute_engine/_mtls.py
@@ -120,8 +120,9 @@ def __init__(
         self.ssl_context = ssl.create_default_context()
         self.ssl_context.load_verify_locations(cafile=mds_mtls_config.ca_cert_path)
         self.ssl_context.load_cert_chain(
-            certfile=mds_mtls_config.client_combined_cert_path
+            certfile=mds_mtls_config.client_combined_cert_path, password=""
         )
+        self._fallback_adapter = HTTPAdapter()
         super(MdsMtlsAdapter, self).__init__(*args, **kwargs)
 
     def init_poolmanager(self, *args, **kwargs):
@@ -146,6 +147,8 @@ def send(self, request, **kwargs):
             ssl.SSLError,
             requests.exceptions.SSLError,
             requests.exceptions.HTTPError,
+            requests.exceptions.ConnectionError,
+            requests.exceptions.Timeout,
         ) as e:
             _LOGGER.warning(
                 "mTLS connection to Compute Engine Metadata server failed. "
@@ -157,6 +160,5 @@ def send(self, request, **kwargs):
             http_fallback_url = urlunparse(parsed_original_url._replace(scheme="http"))
             request.url = http_fallback_url
 
-            # Use a standard HTTPAdapter for the fallback
-            http_adapter = HTTPAdapter()
-            return http_adapter.send(request, **kwargs)
+            # Use the cached standard HTTPAdapter for the fallback
+            return self._fallback_adapter.send(request, **kwargs)
diff --git a/packages/google-auth/google/auth/identity_pool.py b/packages/google-auth/google/auth/identity_pool.py
index 333f7bdf53ea..4b1aa393b2fa 100644
--- a/packages/google-auth/google/auth/identity_pool.py
+++ b/packages/google-auth/google/auth/identity_pool.py
@@ -152,28 +152,34 @@ def __init__(self, trust_chain_path, leaf_cert_callback):
 
     @_helpers.copy_docstring(SubjectTokenSupplier)
     def get_subject_token(self, context, request):
-        # Import OpennSSL inline because it is an extra import only required by customers
-        # using mTLS.
-        from OpenSSL import crypto
+        from cryptography import x509
 
-        leaf_cert = crypto.load_certificate(
-            crypto.FILETYPE_PEM, self._leaf_cert_callback()
-        )
+        try:
+            leaf_cert_data = self._leaf_cert_callback()
+        except Exception as e:
+            raise exceptions.RefreshError("Failed to retrieve leaf certificate.") from e
+
+        try:
+            if isinstance(leaf_cert_data, str):
+                leaf_cert_data = leaf_cert_data.encode("utf-8")
+            leaf_cert = x509.load_pem_x509_certificate(leaf_cert_data)
+        except Exception as e:
+            raise exceptions.RefreshError("Failed to parse leaf certificate.") from e
         trust_chain = self._read_trust_chain()
         cert_chain = []
 
-        cert_chain.append(_X509Supplier._encode_cert(leaf_cert))
+        cert_chain.append(_encode_cert(leaf_cert))
 
         if trust_chain is None or len(trust_chain) == 0:
             return json.dumps(cert_chain)
 
         # Append the first cert if it is not the leaf cert.
-        first_cert = _X509Supplier._encode_cert(trust_chain[0])
+        first_cert = _encode_cert(trust_chain[0])
         if first_cert != cert_chain[0]:
             cert_chain.append(first_cert)
 
         for i in range(1, len(trust_chain)):
-            encoded = _X509Supplier._encode_cert(trust_chain[i])
+            encoded = _encode_cert(trust_chain[i])
             # Check if the current cert is the leaf cert and raise an exception if it is.
             if encoded == cert_chain[0]:
                 raise exceptions.RefreshError(
@@ -184,9 +190,7 @@ def get_subject_token(self, context, request):
         return json.dumps(cert_chain)
 
     def _read_trust_chain(self):
-        # Import OpennSSL inline because it is an extra import only required by customers
-        # using mTLS.
-        from OpenSSL import crypto
+        from cryptography import x509
 
         certificate_trust_chain = []
         # If no trust chain path was provided, return an empty list.
@@ -204,9 +208,7 @@ def _read_trust_chain(self):
                         cert_data = b"-----BEGIN CERTIFICATE-----" + cert_block
                         try:
                             # Load each certificate and add it to the trust chain.
-                            cert = crypto.load_certificate(
-                                crypto.FILETYPE_PEM, cert_data
-                            )
+                            cert = x509.load_pem_x509_certificate(cert_data)
                             certificate_trust_chain.append(cert)
                         except Exception as e:
                             raise exceptions.RefreshError(
@@ -215,19 +217,22 @@ def _read_trust_chain(self):
                                 )
                             ) from e
                 return certificate_trust_chain
-        except FileNotFoundError:
+        except FileNotFoundError as e:
             raise exceptions.RefreshError(
                 "Trust chain file '{}' was not found.".format(self._trust_chain_path)
-            )
+            ) from e
+        except OSError as e:
+            raise exceptions.RefreshError(
+                "Error accessing trust chain file '{}'.".format(self._trust_chain_path)
+            ) from e
+
 
-    def _encode_cert(cert):
-        # Import OpennSSL inline because it is an extra import only required by customers
-        # using mTLS.
-        from OpenSSL import crypto
+def _encode_cert(cert):
+    from cryptography.hazmat.primitives import serialization
 
-        return base64.b64encode(
-            crypto.dump_certificate(crypto.FILETYPE_ASN1, cert)
-        ).decode("utf-8")
+    return base64.b64encode(cert.public_bytes(serialization.Encoding.DER)).decode(
+        "utf-8"
+    )
 
 
 def _parse_token_data(token_content, format_type="text", subject_token_field_name=None):
diff --git a/packages/google-auth/google/auth/transport/_custom_tls_signer.py b/packages/google-auth/google/auth/transport/_custom_tls_signer.py
index 9279158d45c6..2136124d786e 100644
--- a/packages/google-auth/google/auth/transport/_custom_tls_signer.py
+++ b/packages/google-auth/google/auth/transport/_custom_tls_signer.py
@@ -21,9 +21,9 @@
 import json
 import logging
 import os
+import ssl
 import sys
-
-import cffi  # type: ignore
+import sysconfig
 
 from google.auth import exceptions
 
@@ -45,16 +45,26 @@
 )
 
 
-# Cast SSL_CTX* to void*
-def _cast_ssl_ctx_to_void_p_pyopenssl(ssl_ctx):
-    return ctypes.cast(int(cffi.FFI().cast("intptr_t", ssl_ctx)), ctypes.c_void_p)
-
-
 # Cast SSL_CTX* to void*
 def _cast_ssl_ctx_to_void_p_stdlib(context):
-    return ctypes.c_void_p.from_address(
-        id(context) + ctypes.sizeof(ctypes.c_void_p) * 2
-    )
+    if (
+        not isinstance(context, ssl.SSLContext)
+        or type(context).__module__ == "unittest.mock"
+    ):
+        raise TypeError("context must be an instance of ssl.SSLContext, not a mock")
+
+    if (
+        sys.implementation.name != "cpython"
+        or hasattr(sys, "getobjects")
+        or sysconfig.get_config_var("Py_DEBUG")
+        or sysconfig.get_config_var("Py_GIL_DISABLED") == 1
+    ):
+        raise exceptions.MutualTLSChannelError(
+            "Custom TLS signing is only supported on standard release CPython runtimes."
+        )
+
+    offset = sys.getsizeof(object())
+    return ctypes.c_void_p.from_address(id(context) + offset)
 
 
 # Load offload library and set up the function types.
@@ -274,7 +284,7 @@ def attach_to_ssl_context(self, ctx):
             if not self._offload_lib.ConfigureSslContext(
                 self._sign_callback,
                 ctypes.c_char_p(self._cert),
-                _cast_ssl_ctx_to_void_p_pyopenssl(ctx._ctx._context),
+                _cast_ssl_ctx_to_void_p_stdlib(ctx),
             ):
                 raise exceptions.MutualTLSChannelError(
                     "failed to configure ECP Offload SSL context"
diff --git a/packages/google-auth/google/auth/transport/_mtls_helper.py b/packages/google-auth/google/auth/transport/_mtls_helper.py
index 803dd71207f2..3dae82d442ef 100644
--- a/packages/google-auth/google/auth/transport/_mtls_helper.py
+++ b/packages/google-auth/google/auth/transport/_mtls_helper.py
@@ -14,11 +14,16 @@
 
 """Helper functions for getting mTLS cert and key."""
 
+import contextlib
 import json
 import logging
+import os
 from os import environ, getenv, path
 import re
 import subprocess
+import sys
+import tempfile
+from typing import cast, Generator, List, Optional, Tuple, Union
 
 from google.auth import _agent_identity_utils
 from google.auth import environment_vars
@@ -71,6 +76,270 @@
 )
 
 
+class _MemfdCreationError(OSError):
+    """Raised when Linux in-memory virtual file creation (memfd) fails."""
+
+    pass
+
+
+def _can_read(path: Optional[str]) -> bool:
+    if path is None:
+        return True
+    try:
+        with open(path, "rb"):
+            pass
+        return True
+    except OSError:
+        return False
+
+
+@contextlib.contextmanager
+def secure_cert_key_paths(
+    cert: Union[bytes, str, None],
+    key: Union[bytes, str, None],
+    passphrase: Optional[bytes] = None,
+) -> Generator[Tuple[Optional[str], Optional[str], Optional[bytes]], None, None]:
+    """Provides secure file paths for certificate and key.
+
+    This function is implemented as a context manager generator to ensure that
+    any temporary resources (such as in-memory virtual files or encrypted physical
+    temp files) are automatically cleaned up and securely wiped when the context exits.
+
+    It supports mixed inputs (e.g. passing one as a string path and the other as bytes).
+    If a parameter is already a string path or None, it is passed through as-is, and
+    only raw bytes are written to temporary storage.
+
+    Args:
+        cert (Union[str, bytes, None]): Certificate path, raw PEM content bytes, or None.
+        key (Union[str, bytes, None]): Private key path, raw PEM content bytes, or None.
+        passphrase (Optional[bytes]): Optional passphrase for the private key.
+
+    Yields:
+        Tuple[str, str, Optional[bytes]]: The certificate path, key path, and
+            the passphrase needed to load the key (either the user's original,
+            or the newly generated one if Tier 3 had to encrypt the key).
+
+    Raises:
+        OSError: If temporary file creation or writing fails during the Tier 3 fallback.
+    """
+    # Normalize PEM strings to bytes so they are written to temporary storage.
+    # We check for "-----BEGIN " to distinguish between file paths and PEM payloads.
+    if isinstance(cert, str) and "-----BEGIN " in cert:
+        cert = cert.encode("utf-8")
+    if isinstance(key, str) and "-----BEGIN " in key:
+        key = key.encode("utf-8")
+
+    # Tier 1: Pass-through (No-op). If the caller already provided file paths,
+    # we yield them directly to avoid any unnecessary file creation.
+    if isinstance(cert, str) and isinstance(key, str):
+        yield cert, key, passphrase
+        return
+
+    # If a value is a string path, it is passed through. If bytes, we will write
+    # it to temporary storage. None values are also passed through as-is.
+    cert_bytes = cert if isinstance(cert, bytes) else None
+    key_bytes = key if isinstance(key, bytes) else None
+
+    # Tier 2: Linux RAM-backed virtual files. If supported by the OS, we write
+    # the bytes to anonymous in-memory files using memfd_create. This yields
+    # /proc/self/fd/... paths, keeping the private key entirely in memory.
+    if sys.platform == "linux" and hasattr(os, "memfd_create"):
+        try:
+            with _memfd_cert_key_paths(cert_bytes, key_bytes) as (cert_path, key_path):
+                # Handle cases where path exists but might be restricted.
+                if (cert_path is None or os.path.exists(cert_path)) and (
+                    key_path is None or os.path.exists(key_path)
+                ):
+                    if _can_read(cert_path) and _can_read(key_path):
+                        yield cast(str, cert_path or cert), cast(
+                            str, key_path or key
+                        ), passphrase
+                        return
+        except _MemfdCreationError:
+            pass  # Fallback to Tier 3 on failure.
+
+    # Tier 3: Fallback Encrypted Temp Files. If in-memory files are not supported
+    # (macOS/Windows), we write to disk. To protect the key, we encrypt plaintext
+    # keys on-the-fly and securely wipe the files with null bytes during cleanup.
+    with _tempfile_cert_key_paths(cert_bytes, key_bytes, passphrase) as (
+        cert_path,
+        key_path,
+        new_passphrase,
+    ):
+        yield cast(str, cert_path or cert), cast(str, key_path or key), new_passphrase
+
+
+def _encrypt_key_if_plaintext(
+    key_bytes: bytes, passphrase: Optional[bytes]
+) -> Tuple[bytes, Optional[bytes]]:
+    """Encrypts a plaintext PEM key if necessary, returning the bytes and passphrase.
+
+    If the key is already encrypted, or if parsing/encryption fails, the key is
+    returned as-is (plaintext) as a fallback. This allows the caller (underlying SSL
+    context) to attempt loading the key directly and handle any failures.
+    """
+    import cryptography
+    from cryptography.hazmat.primitives import serialization
+    import secrets
+
+    try:
+        pkey = serialization.load_pem_private_key(key_bytes, password=None)
+        # It's plaintext, encrypt it.
+        target_passphrase = passphrase
+        if target_passphrase is None:
+            target_passphrase = secrets.token_hex(32).encode("utf-8")
+        elif isinstance(target_passphrase, str):
+            target_passphrase = target_passphrase.encode("utf-8")
+
+        encrypted_content = pkey.private_bytes(
+            encoding=serialization.Encoding.PEM,
+            format=serialization.PrivateFormat.PKCS8,
+            encryption_algorithm=serialization.BestAvailableEncryption(
+                target_passphrase
+            ),
+        )
+        return encrypted_content, target_passphrase
+    except (ValueError, TypeError, cryptography.exceptions.UnsupportedAlgorithm):
+        # Likely already encrypted, invalid, or unsupported algorithm, return as-is.
+        return key_bytes, passphrase
+
+
+def _secure_wipe_and_remove(file_path: str):
+    """Overwrites a file with null bytes before deleting it.
+
+    This is an extra security measure to make file recovery harder. However, on modern
+    solid-state drives (SSDs), the hardware optimizes where data is written, meaning
+    the original private key bytes might still physically remain on the storage chips
+    until the drive cleans them up.
+    """
+    if not os.path.exists(file_path):
+        return
+    try:
+        size = os.path.getsize(file_path)
+        with open(file_path, "r+b") as f:
+            f.write(b"\0" * size)
+            f.flush()
+            os.fsync(f.fileno())
+    except OSError:
+        pass  # Ignore permission/lock errors during cleanup.
+    finally:
+        try:
+            os.remove(file_path)
+        except OSError:
+            pass
+
+
+@contextlib.contextmanager
+def _memfd_cert_key_paths(
+    cert_bytes: Optional[bytes], key_bytes: Optional[bytes]
+) -> Generator[Tuple[Optional[str], Optional[str]], None, None]:
+    """Creates secure, in-memory virtual files on Linux using memfd_create.
+
+    Yields:
+        Tuple[Optional[str], Optional[str]]: In-memory file paths pointing to
+            the active descriptors (e.g., '/proc/self/fd/3').
+    """
+    cleanup_fds = []
+    paths: List[Optional[str]] = []
+
+    try:
+        try:
+            for data, name in [(cert_bytes, "mtls_cert"), (key_bytes, "mtls_key")]:
+                if data is not None:
+                    # MFD_CLOEXEC prevents FD leaks to spawned subprocesses.
+                    fd = os.memfd_create(name, os.MFD_CLOEXEC)  # type: ignore[attr-defined]
+                    cleanup_fds.append(fd)
+                    with os.fdopen(fd, "wb", closefd=False) as f:
+                        f.write(data)
+                    paths.append(f"/proc/self/fd/{fd}")
+                else:
+                    paths.append(None)
+        except (OSError, AttributeError) as exc:
+            raise _MemfdCreationError(
+                "Failed to create in-memory virtual files"
+            ) from exc
+
+        cert_path, key_path = paths
+        yield cert_path, key_path
+    finally:
+        # Closing the descriptors automatically frees the RAM allocation.
+        for fd in cleanup_fds:
+            try:
+                os.close(fd)
+            except OSError:
+                pass
+
+
+@contextlib.contextmanager
+def _tempfile_cert_key_paths(
+    cert_bytes: Optional[bytes],
+    key_bytes: Optional[bytes],
+    passphrase: Optional[bytes],
+) -> Generator[Tuple[Optional[str], Optional[str], Optional[bytes]], None, None]:
+    """Creates secure temporary file paths on disk, encrypting private keys.
+
+    Yields:
+        Tuple[Optional[str], Optional[str], Optional[bytes]]: The temporary file
+            paths and the passphrase needed to load the key.
+    """
+    # Prioritize RAM-backed /dev/shm to avoid writing secrets to physical storage.
+    tmp_dir = (
+        "/dev/shm"
+        if os.path.isdir("/dev/shm") and os.access("/dev/shm", os.W_OK)
+        else None
+    )
+    cleanup_files: List[Optional[str]] = [None, None]
+    new_passphrase = passphrase
+    cert_data = cert_bytes
+    key_data = None
+    if key_bytes is not None:
+        key_data, new_passphrase = _encrypt_key_if_plaintext(key_bytes, passphrase)
+
+    try:
+        for i, data in enumerate([cert_data, key_data]):
+            if data is not None:
+                try:
+                    fd, path = tempfile.mkstemp(dir=tmp_dir)
+                except OSError:
+                    fd, path = tempfile.mkstemp(dir=None)
+                try:
+                    cleanup_files[i] = path
+                    f = None
+                    try:
+                        f = os.fdopen(fd, "wb")
+                        f.write(data)
+                        f.flush()
+                        os.fsync(f.fileno())
+                    finally:
+                        if f is not None:
+                            f.close()
+                        else:
+                            try:
+                                os.close(fd)
+                            except OSError:
+                                pass
+                except BaseException:
+                    raise
+
+        yield cleanup_files[0], cleanup_files[1], new_passphrase
+    finally:
+        cert_cleanup_path = cleanup_files[0]
+        key_cleanup_path = cleanup_files[1]
+
+        try:
+            if key_cleanup_path:
+                _secure_wipe_and_remove(key_cleanup_path)
+        except Exception:
+            pass
+        finally:
+            if cert_cleanup_path:
+                try:
+                    if os.path.exists(cert_cleanup_path):
+                        os.remove(cert_cleanup_path)
+                except OSError:
+                    pass
+
+
 def _check_config_path(config_path):
     """Checks for config file path. If it exists, returns the absolute path with user expansion;
     otherwise returns None.
@@ -414,6 +683,11 @@ def get_client_cert_and_key(client_cert_callback=None):
 
 
 def decrypt_private_key(key, passphrase):
+    if isinstance(key, str):
+        key = key.encode("utf-8")
+    if isinstance(passphrase, str):
+        passphrase = passphrase.encode("utf-8")
+
     """A helper function to decrypt the private key with the given passphrase.
     google-auth library doesn't support passphrase protected private key for
     mutual TLS channel. This helper function can be used to decrypt the
@@ -443,16 +717,19 @@ def client_cert_callback():
         bytes: The decrypted private key in PEM format.
 
     Raises:
-        ImportError: If pyOpenSSL is not installed.
-        OpenSSL.crypto.Error: If there is any problem decrypting the private key.
+        ValueError: If there is any problem decrypting the private key.
     """
-    from OpenSSL import crypto
+    from cryptography.hazmat.primitives import serialization
 
     # First convert encrypted_key_bytes to PKey object
-    pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, key, passphrase=passphrase)
+    pkey = serialization.load_pem_private_key(key, password=passphrase)
 
     # Then dump the decrypted key bytes
-    return crypto.dump_privatekey(crypto.FILETYPE_PEM, pkey)
+    return pkey.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    )
 
 
 def _check_use_client_cert_env():
diff --git a/packages/google-auth/google/auth/transport/requests.py b/packages/google-auth/google/auth/transport/requests.py
index b9c308903213..fff1191123cf 100644
--- a/packages/google-auth/google/auth/transport/requests.py
+++ b/packages/google-auth/google/auth/transport/requests.py
@@ -204,30 +204,42 @@ class _MutualTlsAdapter(requests.adapters.HTTPAdapter):
         key (bytes): client private key in PEM format
 
     Raises:
-        ImportError: if certifi or pyOpenSSL is not installed
-        OpenSSL.crypto.Error: if client cert or key is invalid
+        ImportError: if certifi is not installed
+        google.auth.exceptions.MutualTLSChannelError: If the cert or key is invalid.
     """
 
     def __init__(self, cert, key):
         import certifi
-        from OpenSSL import crypto
-        import urllib3.contrib.pyopenssl  # type: ignore
-
-        urllib3.contrib.pyopenssl.inject_into_urllib3()
-
-        pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, key)
-        x509 = crypto.load_certificate(crypto.FILETYPE_PEM, cert)
+        import ssl
 
         ctx_poolmanager = create_urllib3_context()
         ctx_poolmanager.load_verify_locations(cafile=certifi.where())
-        ctx_poolmanager._ctx.use_certificate(x509)
-        ctx_poolmanager._ctx.use_privatekey(pkey)
-        self._ctx_poolmanager = ctx_poolmanager
 
         ctx_proxymanager = create_urllib3_context()
         ctx_proxymanager.load_verify_locations(cafile=certifi.where())
-        ctx_proxymanager._ctx.use_certificate(x509)
-        ctx_proxymanager._ctx.use_privatekey(pkey)
+
+        try:
+            with _mtls_helper.secure_cert_key_paths(cert, key) as (
+                cert_path,
+                key_path,
+                passphrase,
+            ):
+                ctx_poolmanager.load_cert_chain(
+                    certfile=cert_path,
+                    keyfile=key_path,
+                    password=passphrase,
+                )
+                ctx_proxymanager.load_cert_chain(
+                    certfile=cert_path,
+                    keyfile=key_path,
+                    password=passphrase,
+                )
+        except (ssl.SSLError, OSError, IOError, ValueError, RuntimeError) as exc:
+            raise exceptions.MutualTLSChannelError(
+                "Failed to configure client certificate and key for mTLS."
+            ) from exc
+
+        self._ctx_poolmanager = ctx_poolmanager
         self._ctx_proxymanager = ctx_proxymanager
 
         super(_MutualTlsAdapter, self).__init__()
@@ -258,7 +270,7 @@ class _MutualTlsOffloadAdapter(requests.adapters.HTTPAdapter):
                 }
 
     Raises:
-        ImportError: if certifi or pyOpenSSL is not installed
+        ImportError: if certifi is not installed
         google.auth.exceptions.MutualTLSChannelError: If mutual TLS channel
             creation failed for any reason.
     """
@@ -270,10 +282,6 @@ def __init__(self, enterprise_cert_file_path):
         self.signer = _custom_tls_signer.CustomTlsSigner(enterprise_cert_file_path)
         self.signer.load_libraries()
 
-        import urllib3.contrib.pyopenssl
-
-        urllib3.contrib.pyopenssl.inject_into_urllib3()
-
         poolmanager = create_urllib3_context()
         poolmanager.load_verify_locations(cafile=certifi.where())
         self.signer.attach_to_ssl_context(poolmanager)
@@ -450,12 +458,6 @@ def configure_mtls_channel(self, client_cert_callback=None):
         if not use_client_cert:
             return
 
-        try:
-            import OpenSSL
-        except ImportError as caught_exc:
-            new_exc = exceptions.MutualTLSChannelError(caught_exc)
-            raise new_exc from caught_exc
-
         try:
             (
                 is_mtls,
@@ -473,7 +475,7 @@ def configure_mtls_channel(self, client_cert_callback=None):
             exceptions.ClientCertError,
             ImportError,
             OSError,
-            OpenSSL.crypto.Error,
+            ValueError,
         ) as caught_exc:
             new_exc = exceptions.MutualTLSChannelError(caught_exc)
             raise new_exc from caught_exc
diff --git a/packages/google-auth/google/auth/transport/urllib3.py b/packages/google-auth/google/auth/transport/urllib3.py
index 0a1de5f86f7c..34e72810ccf2 100644
--- a/packages/google-auth/google/auth/transport/urllib3.py
+++ b/packages/google-auth/google/auth/transport/urllib3.py
@@ -174,22 +174,29 @@ def _make_mutual_tls_http(cert, key):
         urllib3.PoolManager: Mutual TLS HTTP connection.
 
     Raises:
-        ImportError: If certifi or pyOpenSSL is not installed.
-        OpenSSL.crypto.Error: If the cert or key is invalid.
+        google.auth.exceptions.MutualTLSChannelError: If the cert or key is invalid.
     """
     import certifi
-    from OpenSSL import crypto
-    import urllib3.contrib.pyopenssl  # type: ignore
+    import ssl
 
-    urllib3.contrib.pyopenssl.inject_into_urllib3()
     ctx = urllib3.util.ssl_.create_urllib3_context()
     ctx.load_verify_locations(cafile=certifi.where())
 
-    pkey = crypto.load_privatekey(crypto.FILETYPE_PEM, key)
-    x509 = crypto.load_certificate(crypto.FILETYPE_PEM, cert)
-
-    ctx._ctx.use_certificate(x509)
-    ctx._ctx.use_privatekey(pkey)
+    try:
+        with _mtls_helper.secure_cert_key_paths(cert, key) as (
+            cert_path,
+            key_path,
+            passphrase,
+        ):
+            ctx.load_cert_chain(
+                certfile=cert_path,
+                keyfile=key_path,
+                password=passphrase,
+            )
+    except (ssl.SSLError, OSError, IOError, ValueError, RuntimeError) as exc:
+        raise exceptions.MutualTLSChannelError(
+            "Failed to configure client certificate and key for mTLS."
+        ) from exc
 
     http = urllib3.PoolManager(ssl_context=ctx)
     return http
@@ -339,12 +346,6 @@ def configure_mtls_channel(self, client_cert_callback=None):
         if not use_client_cert:
             return False
 
-        try:
-            import OpenSSL
-        except ImportError as caught_exc:
-            new_exc = exceptions.MutualTLSChannelError(caught_exc)
-            raise new_exc from caught_exc
-
         try:
             found_cert_key, cert, key = transport._mtls_helper.get_client_cert_and_key(
                 client_cert_callback
@@ -360,7 +361,7 @@ def configure_mtls_channel(self, client_cert_callback=None):
             exceptions.ClientCertError,
             ImportError,
             OSError,
-            OpenSSL.crypto.Error,
+            ValueError,
         ) as caught_exc:
             new_exc = exceptions.MutualTLSChannelError(caught_exc)
             raise new_exc from caught_exc
diff --git a/packages/google-auth/noxfile.py b/packages/google-auth/noxfile.py
index 5962f96bf094..19cc47a02a03 100644
--- a/packages/google-auth/noxfile.py
+++ b/packages/google-auth/noxfile.py
@@ -150,7 +150,6 @@ def mypy(session):
         "mypy",
         "types-certifi",
         "types-freezegun",
-        "types-pyOpenSSL",
         "types-requests",
         "types-setuptools",
         "types-mock",
@@ -290,7 +289,6 @@ def prerelease_deps(session, protobuf_implementation):
         "grpcio",
         "pyasn1-modules",
         "pyjwt",
-        "pyopenssl",
         "requests",
         "rsa",
         "urllib3",
diff --git a/packages/google-auth/setup.py b/packages/google-auth/setup.py
index cf3148130d6e..c9976a301cb5 100644
--- a/packages/google-auth/setup.py
+++ b/packages/google-auth/setup.py
@@ -24,7 +24,7 @@
 
 DEPENDENCIES = (
     "pyasn1-modules>=0.2.1",
-    cryptography_base_require,
+    *cryptography_base_require,
 )
 
 requests_extra_require = ["requests >= 2.20.0, < 3.0.0"]
@@ -35,10 +35,7 @@
 
 reauth_extra_require = ["pyu2f>=0.1.5"]
 
-# TODO(https://github.com/googleapis/google-auth-library-python/issues/1738): Add bounds for pyopenssl dependency.
-enterprise_cert_extra_require = ["pyopenssl"]
-
-pyopenssl_extra_require = ["pyopenssl>=20.0.0"]
+enterprise_cert_extra_require = cryptography_base_require
 
 # TODO(https://github.com/googleapis/google-auth-library-python/issues/1739): Add bounds for urllib3 and packaging dependencies.
 urllib3_extra_require = ["urllib3", "packaging"]
@@ -55,7 +52,6 @@
     "pytest",
     "pytest-cov",
     "pytest-localserver",
-    *pyopenssl_extra_require,
     *reauth_extra_require,
     "responses",
     *urllib3_extra_require,
@@ -63,10 +59,6 @@
     *aiohttp_extra_require,
     "aioresponses",
     "pytest-asyncio",
-    # TODO(https://github.com/googleapis/google-auth-library-python/issues/1665): Remove the pinned version of pyopenssl
-    # once `TestDecryptPrivateKey::test_success` is updated to remove the deprecated `OpenSSL.crypto.sign` and
-    # `OpenSSL.crypto.verify` methods. See: https://www.pyopenssl.org/en/latest/changelog.html#id3.
-    "pyopenssl < 24.3.0",
     # TODO(https://github.com/googleapis/google-auth-library-python/issues/1722): `test_aiohttp_requests` depend on
     # aiohttp < 3.10.0 which is a bug. Investigate and remove the pinned aiohttp version.
     "aiohttp < 3.10.0",
@@ -75,9 +67,10 @@
 extras = {
     # Note: cryptography was made into a required dependency. Extra is kept for backwards compatibility
     "cryptography": cryptography_base_require,
+    # pyopenssl is deprecated, kept for backwards compatibility
+    "pyopenssl": cryptography_base_require,
     "aiohttp": aiohttp_extra_require,
     "enterprise_cert": enterprise_cert_extra_require,
-    "pyopenssl": pyopenssl_extra_require,
     "pyjwt": pyjwt_extra_require,
     "reauth": reauth_extra_require,
     "requests": requests_extra_require,
diff --git a/packages/google-auth/system_tests/noxfile.py b/packages/google-auth/system_tests/noxfile.py
index 2cc4d122cf02..825ef0aab509 100644
--- a/packages/google-auth/system_tests/noxfile.py
+++ b/packages/google-auth/system_tests/noxfile.py
@@ -322,7 +322,7 @@ def urllib3(session):
 @nox.session(python=PYTHON_VERSIONS_SYNC)
 def mtls_http(session):
     session.install(LIBRARY_DIR)
-    session.install(*TEST_DEPENDENCIES_SYNC, "pyopenssl")
+    session.install(*TEST_DEPENDENCIES_SYNC)
     session.env[EXPLICIT_CREDENTIALS_ENV] = SERVICE_ACCOUNT_FILE
     default(
         session,
diff --git a/packages/google-auth/tests/compute_engine/test__mtls.py b/packages/google-auth/tests/compute_engine/test__mtls.py
index 2effa29bbdc2..dcb46b5dddea 100644
--- a/packages/google-auth/tests/compute_engine/test__mtls.py
+++ b/packages/google-auth/tests/compute_engine/test__mtls.py
@@ -123,7 +123,7 @@ def test_mds_mtls_adapter_init(mock_ssl_context, mock_mds_mtls_config):
         cafile=mock_mds_mtls_config.ca_cert_path
     )
     adapter.ssl_context.load_cert_chain.assert_called_once_with(
-        certfile=mock_mds_mtls_config.client_combined_cert_path
+        certfile=mock_mds_mtls_config.client_combined_cert_path, password=""
     )
 
 
@@ -250,6 +250,50 @@ def test_mds_mtls_adapter_send_fallback_http_error(
     assert fallback_request.url == "http://fake-mds.com/"
 
 
+@mock.patch("google.auth.compute_engine._mtls._parse_mds_mode")
+@mock.patch("ssl.create_default_context")
+def test_mds_mtls_adapter_send_fallback_connection_error(
+    mock_ssl_context, mock_parse_mds_mode, mock_mds_mtls_config
+):
+    mock_parse_mds_mode.return_value = _mtls.MdsMtlsMode.DEFAULT
+    adapter = _mtls.MdsMtlsAdapter(mock_mds_mtls_config)
+
+    mock_mtls_response = mock.Mock(spec=requests.Response)
+    mock_mtls_response.status_code = 200
+
+    with mock.patch(
+        "requests.adapters.HTTPAdapter.send",
+        side_effect=[requests.exceptions.ConnectionError, mock_mtls_response],
+    ):
+        request = requests.Request(method="GET", url="https://fake-mds.com").prepare()
+        response = adapter.send(request)
+
+    assert response == mock_mtls_response
+    assert request.url == "http://fake-mds.com/"
+
+
+@mock.patch("google.auth.compute_engine._mtls._parse_mds_mode")
+@mock.patch("ssl.create_default_context")
+def test_mds_mtls_adapter_send_fallback_timeout(
+    mock_ssl_context, mock_parse_mds_mode, mock_mds_mtls_config
+):
+    mock_parse_mds_mode.return_value = _mtls.MdsMtlsMode.DEFAULT
+    adapter = _mtls.MdsMtlsAdapter(mock_mds_mtls_config)
+
+    mock_mtls_response = mock.Mock(spec=requests.Response)
+    mock_mtls_response.status_code = 200
+
+    with mock.patch(
+        "requests.adapters.HTTPAdapter.send",
+        side_effect=[requests.exceptions.Timeout, mock_mtls_response],
+    ):
+        request = requests.Request(method="GET", url="https://fake-mds.com").prepare()
+        response = adapter.send(request)
+
+    assert response == mock_mtls_response
+    assert request.url == "http://fake-mds.com/"
+
+
 @mock.patch("requests.adapters.HTTPAdapter.send")
 @mock.patch("google.auth.compute_engine._mtls._parse_mds_mode")
 @mock.patch("ssl.create_default_context")
@@ -259,13 +303,12 @@ def test_mds_mtls_adapter_send_no_fallback_other_exception(
     mock_parse_mds_mode.return_value = _mtls.MdsMtlsMode.DEFAULT
     adapter = _mtls.MdsMtlsAdapter(mock_mds_mtls_config)
 
-    # Simulate HTTP exception
     with mock.patch(
         "requests.adapters.HTTPAdapter.send",
-        side_effect=requests.exceptions.ConnectionError,
+        side_effect=ValueError("Unhandled exception"),
     ):
         request = requests.Request(method="GET", url="https://fake-mds.com").prepare()
-        with pytest.raises(requests.exceptions.ConnectionError):
+        with pytest.raises(ValueError, match="Unhandled exception"):
             adapter.send(request)
 
     mock_http_adapter_send.assert_not_called()
diff --git a/packages/google-auth/tests/test_identity_pool.py b/packages/google-auth/tests/test_identity_pool.py
index 4b3349028b54..92659bd90b38 100644
--- a/packages/google-auth/tests/test_identity_pool.py
+++ b/packages/google-auth/tests/test_identity_pool.py
@@ -20,7 +20,8 @@
 from unittest import mock
 import urllib
 
-from OpenSSL import crypto
+from cryptography import x509
+from cryptography.hazmat.primitives import serialization
 import pytest  # type: ignore
 
 from google.auth import _helpers, external_account
@@ -69,17 +70,15 @@
     JSON_FILE_SUBJECT_TOKEN = JSON_FILE_CONTENT.get(SUBJECT_TOKEN_FIELD_NAME)
 
 with open(CERT_FILE, "rb") as f:
+    cert = x509.load_pem_x509_certificate(f.read())
     CERT_FILE_CONTENT = base64.b64encode(
-        crypto.dump_certificate(
-            crypto.FILETYPE_ASN1, crypto.load_certificate(crypto.FILETYPE_PEM, f.read())
-        )
+        cert.public_bytes(serialization.Encoding.DER)
     ).decode("utf-8")
 
 with open(OTHER_CERT_FILE, "rb") as f:
+    cert = x509.load_pem_x509_certificate(f.read())
     OTHER_CERT_FILE_CONTENT = base64.b64encode(
-        crypto.dump_certificate(
-            crypto.FILETYPE_ASN1, crypto.load_certificate(crypto.FILETYPE_PEM, f.read())
-        )
+        cert.public_bytes(serialization.Encoding.DER)
     ).decode("utf-8")
 
 TOKEN_URL = "https://sts.googleapis.com/v1/token"
diff --git a/packages/google-auth/tests/transport/test__custom_tls_signer.py b/packages/google-auth/tests/transport/test__custom_tls_signer.py
index 3ecb29a60516..1e24f1da6f43 100644
--- a/packages/google-auth/tests/transport/test__custom_tls_signer.py
+++ b/packages/google-auth/tests/transport/test__custom_tls_signer.py
@@ -14,6 +14,8 @@
 import base64
 import ctypes
 import os
+import ssl
+import sys
 from unittest import mock
 
 import pytest  # type: ignore
@@ -22,12 +24,6 @@
 from google.auth import exceptions
 from google.auth.transport import _custom_tls_signer
 
-urllib3_pyopenssl = pytest.importorskip(
-    "urllib3.contrib.pyopenssl",
-    reason="urllib3.contrib.pyopenssl not available in this environment",
-)
-
-urllib3_pyopenssl.inject_into_urllib3()
 
 FAKE_ENTERPRISE_CERT_FILE_PATH = "/path/to/enterprise/cert/file"
 ENTERPRISE_CERT_FILE = os.path.join(
@@ -219,7 +215,7 @@ def test_custom_tls_signer_provider():
             ENTERPRISE_CERT_FILE_PROVIDER
         )
         signer_object.load_libraries()
-        signer_object.attach_to_ssl_context(mock.MagicMock())
+        signer_object.attach_to_ssl_context(ssl.SSLContext())
 
     assert signer_object.should_use_provider()
     assert signer_object._enterprise_cert_file_path == ENTERPRISE_CERT_FILE_PROVIDER
@@ -242,7 +238,7 @@ def test_custom_tls_signer_failed_to_attach():
         signer_object._sign_callback = mock.MagicMock()
         signer_object._cert = b"mock cert"
         signer_object._offload_lib.ConfigureSslContext.return_value = False
-        signer_object.attach_to_ssl_context(mock.MagicMock())
+        signer_object.attach_to_ssl_context(ssl.SSLContext())
     assert excinfo.match("failed to configure ECP Offload SSL context")
 
 
@@ -253,7 +249,7 @@ def test_custom_tls_signer_failed_to_attach_provider():
         )
         signer_object._provider_lib = mock.MagicMock()
         signer_object._provider_lib.ECP_attach_to_ctx.return_value = False
-        signer_object.attach_to_ssl_context(mock.MagicMock())
+        signer_object.attach_to_ssl_context(ssl.SSLContext())
     assert excinfo.match("failed to configure ECP Provider SSL context")
 
 
@@ -262,5 +258,97 @@ def test_custom_tls_signer_failed_to_attach_no_libs():
         signer_object = _custom_tls_signer.CustomTlsSigner(ENTERPRISE_CERT_FILE)
         signer_object._offload_lib = None
         signer_object._signer_lib = None
-        signer_object.attach_to_ssl_context(mock.MagicMock())
+        signer_object.attach_to_ssl_context(ssl.SSLContext())
     assert excinfo.match("Invalid ECP configuration.")
+
+
+def test_cast_ssl_ctx_to_void_p_stdlib_success():
+    context = ssl.SSLContext()
+    with mock.patch.object(sys.implementation, "name", "cpython"):
+        with mock.patch("sysconfig.get_config_var", return_value=0):
+            if hasattr(sys, "getobjects"):
+                with mock.patch.delattr(sys, "getobjects"):
+                    res = _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib(context)
+                    assert isinstance(res, ctypes.c_void_p)
+            else:
+                res = _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib(context)
+                assert isinstance(res, ctypes.c_void_p)
+
+
+def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_pypy():
+    context = ssl.SSLContext()
+
+    with mock.patch.object(sys.implementation, "name", "pypy"):
+        with pytest.raises(
+            exceptions.MutualTLSChannelError,
+            match="Custom TLS signing is only supported",
+        ):
+            _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib(context)
+
+
+def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_trace_refs():
+    context = ssl.SSLContext()
+
+    with mock.patch.object(sys.implementation, "name", "cpython"), mock.patch(
+        "sys.getobjects", create=True
+    ):
+        with pytest.raises(
+            exceptions.MutualTLSChannelError,
+            match="Custom TLS signing is only supported",
+        ):
+            _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib(context)
+
+
+def test_cast_ssl_ctx_to_void_p_stdlib_type_error():
+    with pytest.raises(
+        TypeError, match="context must be an instance of ssl.SSLContext"
+    ):
+        _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib("not an SSLContext")
+
+
+def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_debug_flag():
+    context = ssl.SSLContext()
+    with mock.patch.object(sys.implementation, "name", "cpython"), mock.patch(
+        "sysconfig.get_config_var", return_value=1
+    ):
+        with pytest.raises(
+            exceptions.MutualTLSChannelError,
+            match="Custom TLS signing is only supported",
+        ):
+            _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib(context)
+
+
+def test_cast_ssl_ctx_to_void_p_stdlib_unsupported_runtime_free_threaded():
+    context = ssl.SSLContext()
+
+    def mock_get_config_var(var):
+        if var == "Py_GIL_DISABLED":
+            return 1
+        return None
+
+    with mock.patch.object(sys.implementation, "name", "cpython"), mock.patch(
+        "sysconfig.get_config_var", side_effect=mock_get_config_var
+    ):
+        with pytest.raises(
+            exceptions.MutualTLSChannelError,
+            match="Custom TLS signing is only supported",
+        ):
+            _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib(context)
+
+
+def test_cast_ssl_ctx_to_void_p_stdlib_dynamic_offset():
+    context = ssl.SSLContext()
+    with mock.patch("sys.getsizeof", return_value=40) as mock_sizeof:
+        with mock.patch("ctypes.c_void_p.from_address") as mock_from_address:
+            _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib(context)
+            mock_sizeof.assert_called_once()
+            expected_address = id(context) + 40
+            mock_from_address.assert_called_once_with(expected_address)
+
+
+def test_cast_ssl_ctx_to_void_p_stdlib_mock_error():
+    context = mock.MagicMock(spec=ssl.SSLContext)
+    with pytest.raises(
+        TypeError, match="context must be an instance of ssl.SSLContext, not a mock"
+    ):
+        _custom_tls_signer._cast_ssl_ctx_to_void_p_stdlib(context)
diff --git a/packages/google-auth/tests/transport/test__mtls_helper.py b/packages/google-auth/tests/transport/test__mtls_helper.py
index 0fe5067352a1..281bd4111662 100644
--- a/packages/google-auth/tests/transport/test__mtls_helper.py
+++ b/packages/google-auth/tests/transport/test__mtls_helper.py
@@ -14,28 +14,35 @@
 
 import os
 import re
+import sys
+import tempfile
 from unittest import mock
 
-from OpenSSL import crypto
+from cryptography.hazmat.primitives import hashes, serialization
+from cryptography.hazmat.primitives.asymmetric import ec
 import pytest  # type: ignore
 
 from google.auth import environment_vars, exceptions
 from google.auth.transport import _mtls_helper
 
+if not hasattr(os, "MFD_CLOEXEC"):
+    setattr(os, "MFD_CLOEXEC", 1)
+
 CERT_MOCK_VAL = b"cert"
 KEY_MOCK_VAL = b"key"
 CONTEXT_AWARE_METADATA = {"cert_provider_command": ["some command"]}
 ENCRYPTED_EC_PRIVATE_KEY = b"""-----BEGIN ENCRYPTED PRIVATE KEY-----
-MIHkME8GCSqGSIb3DQEFDTBCMCkGCSqGSIb3DQEFDDAcBAgl2/yVgs1h3QICCAAw
-DAYIKoZIhvcNAgkFADAVBgkrBgEEAZdVAQIECJk2GRrvxOaJBIGQXIBnMU4wmciT
-uA6yD8q0FxuIzjG7E2S6tc5VRgSbhRB00eBO3jWmO2pBybeQW+zVioDcn50zp2ts
-wYErWC+LCm1Zg3r+EGnT1E1GgNoODbVQ3AEHlKh1CGCYhEovxtn3G+Fjh7xOBrNB
-saVVeDb4tHD4tMkiVVUBrUcTZPndP73CtgyGHYEphasYPzEz3+AU
+MIH0MF8GCSqGSIb3DQEFDTBSMDEGCSqGSIb3DQEFDDAkBBClWcQyUELNC9Hjr+Sp
+WK85AgIIADAMBggqhkiG9w0CCQUAMB0GCWCGSAFlAwQBKgQQ6uJeoqE7P9HtxAgS
+n6rBFgSBkMRDYXLucNp7ew7LbQmkZCmjnRhgyw6b0dD3eK8f3jisj8UiR8aj9a2S
+1FZiNHKLmI7hkZHH+d2DPWYhe/tf5SS4iLzpZogBehMv4UDNnNaj0dvQZgpnpciK
+1H+0u/i+crc1WAGlemLAi7dktCCBTzeX19cRMGHie68rx1C82LHLZmefr7AEIVxp
+uUoJ+sLhBw==
 -----END ENCRYPTED PRIVATE KEY-----"""
 
 EC_PUBLIC_KEY = b"""-----BEGIN PUBLIC KEY-----
-MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEvCNi1NoDY1oMqPHIgXI8RBbTYGi/
-brEjbre1nSiQW11xRTJbVeETdsuP0EAu2tG3PcRhhwDfeJ8zXREgTBurNw==
+MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEwdsHzL05VUmqYJat2yGdbSHQAg49
+Wc+fhwLH3b+SCC/2/TqPNDy9yMdMxMtEfZfKal2EaeE2erJrtu7WNfjD0Q==
 -----END PUBLIC KEY-----"""
 
 PASSPHRASE = b"""-----BEGIN PASSPHRASE-----
@@ -655,7 +662,13 @@ def test_override_does_not_exist(self):
         returned_path = _mtls_helper._get_cert_config_path(config_path)
         assert returned_path is None
 
-    @mock.patch.dict(os.environ, {"GOOGLE_API_CERTIFICATE_CONFIG": ""})
+    @mock.patch.dict(
+        os.environ,
+        {
+            "GOOGLE_API_CERTIFICATE_CONFIG": "",
+            "CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH": "",
+        },
+    )
     @mock.patch("os.path.exists", autospec=True)
     def test_default(self, mock_path_exists):
         mock_path_exists.return_value = True
@@ -755,17 +768,22 @@ def test_success(self):
         decrypted_key = _mtls_helper.decrypt_private_key(
             ENCRYPTED_EC_PRIVATE_KEY, PASSPHRASE_VALUE
         )
-        private_key = crypto.load_privatekey(crypto.FILETYPE_PEM, decrypted_key)
-        public_key = crypto.load_publickey(crypto.FILETYPE_PEM, EC_PUBLIC_KEY)
-        x509 = crypto.X509()
-        x509.set_pubkey(public_key)
+        private_key = serialization.load_pem_private_key(decrypted_key, password=None)
+        public_key = serialization.load_pem_public_key(EC_PUBLIC_KEY)
 
         # Test the decrypted key works by signing and verification.
-        signature = crypto.sign(private_key, b"data", "sha256")
-        crypto.verify(x509, signature, b"data", "sha256")
+        signature = private_key.sign(b"data", ec.ECDSA(hashes.SHA256()))
+        public_key.verify(signature, b"data", ec.ECDSA(hashes.SHA256()))
+
+    def test_success_string_inputs(self):
+        decrypted_key = _mtls_helper.decrypt_private_key(
+            ENCRYPTED_EC_PRIVATE_KEY.decode("utf-8"), PASSPHRASE_VALUE.decode("utf-8")
+        )
+        private_key = serialization.load_pem_private_key(decrypted_key, password=None)
+        assert private_key
 
     def test_crypto_error(self):
-        with pytest.raises(crypto.Error):
+        with pytest.raises(ValueError):
             _mtls_helper.decrypt_private_key(
                 ENCRYPTED_EC_PRIVATE_KEY, b"wrong_password"
             )
@@ -825,7 +843,9 @@ def test_env_var_explicit_garbage(self):
         os.environ,
         {
             "GOOGLE_API_USE_CLIENT_CERTIFICATE": "",
+            "CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE": "",
             "GOOGLE_API_CERTIFICATE_CONFIG": "/path/to/config",
+            "CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH": "",
         },
     )
     def test_config_file_success(self, mock_file):
@@ -840,7 +860,9 @@ def test_config_file_success(self, mock_file):
         os.environ,
         {
             "GOOGLE_API_USE_CLIENT_CERTIFICATE": "",
+            "CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE": "",
             "GOOGLE_API_CERTIFICATE_CONFIG": "/path/to/config",
+            "CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH": "",
         },
     )
     def test_config_file_missing_keys(self, mock_file):
@@ -852,7 +874,9 @@ def test_config_file_missing_keys(self, mock_file):
         os.environ,
         {
             "GOOGLE_API_USE_CLIENT_CERTIFICATE": "",
+            "CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE": "",
             "GOOGLE_API_CERTIFICATE_CONFIG": "/path/to/config",
+            "CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH": "",
         },
     )
     def test_config_file_bad_json(self, mock_file):
@@ -864,7 +888,9 @@ def test_config_file_bad_json(self, mock_file):
         os.environ,
         {
             "GOOGLE_API_USE_CLIENT_CERTIFICATE": "",
+            "CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE": "",
             "GOOGLE_API_CERTIFICATE_CONFIG": "/path/does/not/exist",
+            "CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH": "",
         },
     )
     def test_config_file_not_found(self, mock_file):
@@ -1022,3 +1048,540 @@ def test_call_client_cert_callback(self, mock_get_client_ssl_credentials):
         mock_get_client_ssl_credentials.assert_called_once_with(
             generate_encrypted_key=True
         )
+
+
+class TestSecureCertKeyPaths(object):
+    def test_tier1_pass_through(self):
+        with _mtls_helper.secure_cert_key_paths(
+            "/path/to/cert", "/path/to/key", b"passphrase"
+        ) as (cert_path, key_path, passphrase):
+            assert cert_path == "/path/to/cert"
+            assert key_path == "/path/to/key"
+            assert passphrase == b"passphrase"
+
+    @mock.patch.object(_mtls_helper, "_tempfile_cert_key_paths", autospec=True)
+    def test_string_pem_payloads_converted_to_bytes(self, mock_tempfile_cm):
+        mock_tempfile_ctx = mock.MagicMock()
+        mock_tempfile_ctx.__enter__.return_value = (
+            "/tmp/cert",
+            "/tmp/key",
+            b"new_pass",
+        )
+        mock_tempfile_cm.return_value = mock_tempfile_ctx
+
+        cert_str = "-----BEGIN CERTIFICATE-----\n..."
+        key_str = "-----BEGIN PRIVATE KEY-----\n..."
+
+        # Temporarily mock sys.platform to something other than linux so memfd is skipped
+        with mock.patch.object(sys, "platform", "win32"):
+            with _mtls_helper.secure_cert_key_paths(
+                cert_str, key_str, b"passphrase"
+            ) as (cert_path, key_path, passphrase):
+                assert cert_path == "/tmp/cert"
+                assert key_path == "/tmp/key"
+                assert passphrase == b"new_pass"
+
+        mock_tempfile_cm.assert_called_once_with(
+            cert_str.encode("utf-8"), key_str.encode("utf-8"), b"passphrase"
+        )
+
+    @mock.patch.object(sys, "platform", "linux")
+    @mock.patch.object(os, "memfd_create", create=True)
+    @mock.patch.object(_mtls_helper, "_memfd_cert_key_paths", autospec=True)
+    def test_memfd_success(self, mock_memfd_cm, mock_memfd_create):
+        mock_memfd_ctx = mock.MagicMock()
+        mock_memfd_ctx.__enter__.return_value = (
+            "/proc/self/fd/3",
+            "/proc/self/fd/4",
+        )
+        mock_memfd_cm.return_value = mock_memfd_ctx
+
+        with mock.patch.object(os.path, "exists", return_value=True), mock.patch(
+            "builtins.open", mock.mock_open()
+        ):
+            with _mtls_helper.secure_cert_key_paths(
+                pytest.public_cert_bytes,
+                pytest.private_key_bytes,
+                b"passphrase",
+            ) as (cert_path, key_path, passphrase):
+                assert cert_path == "/proc/self/fd/3"
+                assert key_path == "/proc/self/fd/4"
+                assert passphrase == b"passphrase"
+            assert mock_memfd_ctx.__exit__.called
+
+    @mock.patch.object(sys, "platform", "linux")
+    @mock.patch.object(os, "memfd_create", create=True)
+    @mock.patch.object(_mtls_helper, "_memfd_cert_key_paths", autospec=True)
+    @mock.patch.object(_mtls_helper, "_tempfile_cert_key_paths", autospec=True)
+    def test_falls_back_to_tempfile_when_filesystem_restricted(
+        self, mock_tempfile_cm, mock_memfd_cm, mock_memfd_create
+    ):
+        mock_memfd_ctx = mock.MagicMock()
+        mock_memfd_ctx.__enter__.return_value = (
+            "/proc/self/fd/3",
+            "/proc/self/fd/4",
+        )
+        mock_memfd_cm.return_value = mock_memfd_ctx
+
+        mock_tempfile_ctx = mock.MagicMock()
+        mock_tempfile_ctx.__enter__.return_value = (
+            "/tmp/cert",
+            "/tmp/key",
+            b"new_pass",
+        )
+        mock_tempfile_cm.return_value = mock_tempfile_ctx
+
+        with mock.patch.object(os.path, "exists", return_value=False):
+            with _mtls_helper.secure_cert_key_paths(
+                pytest.public_cert_bytes, pytest.private_key_bytes, b"passphrase"
+            ) as (cert_path, key_path, passphrase):
+                assert cert_path == "/tmp/cert"
+                assert key_path == "/tmp/key"
+                assert passphrase == b"new_pass"
+            mock_memfd_ctx.__exit__.assert_called_once_with(None, None, None)
+
+    @mock.patch.object(sys, "platform", "linux")
+    @mock.patch.object(os, "memfd_create", create=True)
+    @mock.patch.object(_mtls_helper, "_memfd_cert_key_paths", autospec=True)
+    @mock.patch.object(_mtls_helper, "_tempfile_cert_key_paths", autospec=True)
+    def test_falls_back_to_tempfile_when_filesystem_unreadable(
+        self, mock_tempfile_cm, mock_memfd_cm, mock_memfd_create
+    ):
+        mock_memfd_ctx = mock.MagicMock()
+        mock_memfd_ctx.__enter__.return_value = (
+            "/proc/self/fd/3",
+            "/proc/self/fd/4",
+        )
+        mock_memfd_cm.return_value = mock_memfd_ctx
+
+        mock_tempfile_ctx = mock.MagicMock()
+        mock_tempfile_ctx.__enter__.return_value = (
+            "/tmp/cert",
+            "/tmp/key",
+            b"new_pass",
+        )
+        mock_tempfile_cm.return_value = mock_tempfile_ctx
+
+        with mock.patch.object(os.path, "exists", return_value=True), mock.patch(
+            "builtins.open", mock.mock_open()
+        ) as mock_open:
+            mock_open.side_effect = PermissionError("Permission denied")
+
+            with _mtls_helper.secure_cert_key_paths(
+                pytest.public_cert_bytes, pytest.private_key_bytes, b"passphrase"
+            ) as (cert_path, key_path, passphrase):
+                assert cert_path == "/tmp/cert"
+                assert key_path == "/tmp/key"
+                assert passphrase == b"new_pass"
+
+            mock_memfd_ctx.__exit__.assert_called_once_with(None, None, None)
+
+    @mock.patch.object(sys, "platform", "linux")
+    @mock.patch.object(os, "memfd_create", create=True)
+    @mock.patch.object(_mtls_helper, "_memfd_cert_key_paths", autospec=True)
+    @mock.patch.object(_mtls_helper, "_tempfile_cert_key_paths", autospec=True)
+    def test_falls_back_to_tempfile_when_memfd_fails(
+        self, mock_tempfile_cm, mock_memfd_cm, mock_memfd_create
+    ):
+        mock_memfd_ctx = mock.MagicMock()
+        mock_memfd_ctx.__enter__.side_effect = _mtls_helper._MemfdCreationError(
+            "memfd failed"
+        )
+        mock_memfd_cm.return_value = mock_memfd_ctx
+
+        mock_tempfile_ctx = mock.MagicMock()
+        mock_tempfile_ctx.__enter__.return_value = (
+            "/tmp/cert",
+            "/tmp/key",
+            b"new_pass",
+        )
+        mock_tempfile_cm.return_value = mock_tempfile_ctx
+
+        with _mtls_helper.secure_cert_key_paths(
+            pytest.public_cert_bytes, pytest.private_key_bytes, b"passphrase"
+        ) as (cert_path, key_path, passphrase):
+            assert cert_path == "/tmp/cert"
+            assert key_path == "/tmp/key"
+            assert passphrase == b"new_pass"
+
+    @mock.patch.object(sys, "platform", "darwin")
+    @mock.patch.object(_mtls_helper, "_tempfile_cert_key_paths", autospec=True)
+    def test_uses_tempfile_directly_on_unsupported_os(self, mock_tempfile_cm):
+        mock_tempfile_ctx = mock.MagicMock()
+        mock_tempfile_ctx.__enter__.return_value = (
+            "/tmp/cert",
+            "/tmp/key",
+            b"new_pass",
+        )
+        mock_tempfile_cm.return_value = mock_tempfile_ctx
+
+        with _mtls_helper.secure_cert_key_paths(
+            pytest.public_cert_bytes, pytest.private_key_bytes, b"passphrase"
+        ) as (cert_path, key_path, passphrase):
+            assert cert_path == "/tmp/cert"
+            assert key_path == "/tmp/key"
+            assert passphrase == b"new_pass"
+
+    @mock.patch.object(sys, "platform", "darwin")
+    @mock.patch.object(_mtls_helper, "_tempfile_cert_key_paths", autospec=True)
+    def test_hybrid_inputs(self, mock_tempfile_cm):
+        mock_tempfile_ctx = mock.MagicMock()
+        mock_tempfile_ctx.__enter__.return_value = (
+            None,
+            "/tmp/key",
+            b"new_pass",
+        )
+        mock_tempfile_cm.return_value = mock_tempfile_ctx
+
+        with _mtls_helper.secure_cert_key_paths(
+            "/pass/through/cert.pem", pytest.private_key_bytes, b"passphrase"
+        ) as (cert_path, key_path, passphrase):
+            assert cert_path == "/pass/through/cert.pem"
+            assert key_path == "/tmp/key"
+            assert passphrase == b"new_pass"
+
+
+class TestMemfdCertKeyPaths(object):
+    @mock.patch.object(os, "memfd_create", create=True)
+    @mock.patch.object(os, "fdopen")
+    @mock.patch.object(os, "close")
+    def test_success_both_bytes(self, mock_close, mock_fdopen, mock_memfd_create):
+        mock_memfd_create.side_effect = [10, 11]
+        mock_file_cert = mock.mock_open().return_value
+        mock_file_key = mock.mock_open().return_value
+        mock_fdopen.side_effect = [mock_file_cert, mock_file_key]
+        with _mtls_helper._memfd_cert_key_paths(b"cert", b"key") as (
+            cert_path,
+            key_path,
+        ):
+            assert cert_path == "/proc/self/fd/10"
+            assert key_path == "/proc/self/fd/11"
+        mock_fdopen.assert_has_calls(
+            [mock.call(10, "wb", closefd=False), mock.call(11, "wb", closefd=False)]
+        )
+        mock_file_cert.write.assert_called_once_with(b"cert")
+        mock_file_key.write.assert_called_once_with(b"key")
+        assert mock_close.call_count == 2
+
+    @mock.patch.object(os, "memfd_create", create=True)
+    @mock.patch.object(os, "fdopen")
+    @mock.patch.object(os, "close")
+    def test_close_ignores_oserror(self, mock_close, mock_fdopen, mock_memfd_create):
+        mock_memfd_create.return_value = 12
+        mock_close.side_effect = OSError("close error")
+        mock_file = mock.mock_open().return_value
+        mock_fdopen.return_value = mock_file
+        with _mtls_helper._memfd_cert_key_paths(b"cert", None) as (cert_path, key_path):
+            assert cert_path == "/proc/self/fd/12"
+            assert key_path is None
+        mock_fdopen.assert_called_once_with(12, "wb", closefd=False)
+        mock_file.write.assert_called_once_with(b"cert")
+        mock_close.assert_called_once_with(12)
+
+    @mock.patch.object(os, "memfd_create", create=True)
+    @mock.patch.object(os, "fdopen")
+    @mock.patch.object(os, "close")
+    def test_write_oserror_prevents_fd_leak(
+        self, mock_close, mock_fdopen, mock_memfd_create
+    ):
+        mock_memfd_create.return_value = 15
+        mock_file = mock.mock_open().return_value
+        mock_file.write.side_effect = OSError("write fault")
+        mock_fdopen.return_value = mock_file
+        with pytest.raises(OSError):
+            with _mtls_helper._memfd_cert_key_paths(b"cert", None):
+                pass
+        mock_fdopen.assert_called_once_with(15, "wb", closefd=False)
+        mock_file.write.assert_called_once_with(b"cert")
+        mock_close.assert_called_once_with(15)
+
+    @mock.patch.object(os, "memfd_create", create=True)
+    def test_memfd_attribute_error(self, mock_memfd_create):
+        # MFD_CLOEXEC missing on the system
+        with mock.patch("os.MFD_CLOEXEC", create=True):
+            del os.MFD_CLOEXEC
+            with pytest.raises(_mtls_helper._MemfdCreationError):
+                with _mtls_helper._memfd_cert_key_paths(b"cert", None):
+                    pass
+
+
+class TestTempfileCertKeyPaths(object):
+    @mock.patch.object(os, "access", return_value=True)
+    @mock.patch.object(os.path, "isdir", return_value=True)
+    @mock.patch.object(_mtls_helper, "_encrypt_key_if_plaintext", autospec=True)
+    def test_success_shm(
+        self,
+        mock_encrypt,
+        mock_isdir,
+        mock_access,
+        tmpdir,
+    ):
+        original_mkstemp = tempfile.mkstemp
+
+        def _redirect_mkstemp(dir=None):
+            return original_mkstemp(dir=str(tmpdir))
+
+        with mock.patch.object(
+            tempfile, "mkstemp", side_effect=_redirect_mkstemp
+        ) as mock_mkstemp:
+            mock_encrypt.return_value = (b"encrypted_key", b"new_pass")
+
+            with _mtls_helper._tempfile_cert_key_paths(b"cert", b"key", b"pass") as (
+                cert_path,
+                key_path,
+                passphrase,
+            ):
+                assert cert_path.startswith(str(tmpdir))
+                assert os.path.exists(cert_path)
+                assert passphrase == b"new_pass"
+
+                with open(cert_path, "rb") as f:
+                    assert f.read() == b"cert"
+
+                with open(key_path, "rb") as f:
+                    assert f.read() == b"encrypted_key"
+
+            # Organically verify secure cleanup occurred
+            assert not os.path.exists(cert_path)
+            assert not os.path.exists(key_path)
+
+            mock_mkstemp.assert_has_calls(
+                [mock.call(dir="/dev/shm"), mock.call(dir="/dev/shm")]
+            )
+
+    @mock.patch.object(os, "access", return_value=True)
+    @mock.patch.object(os.path, "isdir", return_value=True)
+    @mock.patch.object(_mtls_helper, "_encrypt_key_if_plaintext", autospec=True)
+    def test_cleanup_on_keyboard_interrupt(
+        self, mock_encrypt, mock_isdir, mock_access, tmpdir
+    ):
+        original_mkstemp = tempfile.mkstemp
+
+        def _redirect_mkstemp(dir=None):
+            return original_mkstemp(dir=str(tmpdir))
+
+        with mock.patch.object(tempfile, "mkstemp", side_effect=_redirect_mkstemp):
+            mock_encrypt.return_value = (b"encrypted_key", b"new_pass")
+
+            with pytest.raises(KeyboardInterrupt):
+                with mock.patch.object(
+                    _mtls_helper,
+                    "_secure_wipe_and_remove",
+                    side_effect=KeyboardInterrupt("ctrl-c"),
+                ):
+                    with _mtls_helper._tempfile_cert_key_paths(
+                        b"cert", b"key", b"pass"
+                    ) as (cert_path, key_path, pwd):
+                        # exiting the context manager triggers cleanup and raises KeyboardInterrupt
+                        pass
+
+            # Verify cert file is still cleaned up even if key cleanup raised KeyboardInterrupt
+            assert not os.path.exists(cert_path)
+
+    @mock.patch.object(os, "access", return_value=True)
+    @mock.patch.object(os.path, "isdir", return_value=True)
+    @mock.patch.object(_mtls_helper, "_encrypt_key_if_plaintext", autospec=True)
+    def test_mkstemp_shm_oserror_fallback(
+        self,
+        mock_encrypt,
+        mock_isdir,
+        mock_access,
+        tmpdir,
+    ):
+        original_mkstemp = tempfile.mkstemp
+        call_count = [0]
+
+        def _redirect_mkstemp(dir=None):
+            call_count[0] += 1
+            if call_count[0] % 2 != 0:
+                raise OSError("No space left on device")
+            return original_mkstemp(dir=str(tmpdir))
+
+        with mock.patch.object(
+            tempfile, "mkstemp", side_effect=_redirect_mkstemp
+        ) as mock_mkstemp:
+            mock_encrypt.return_value = (b"encrypted_key", b"new_pass")
+
+            with _mtls_helper._tempfile_cert_key_paths(b"cert", b"key", b"pass") as (
+                cert_path,
+                key_path,
+                passphrase,
+            ):
+                assert cert_path.startswith(str(tmpdir))
+                assert os.path.exists(cert_path)
+                assert passphrase == b"new_pass"
+
+            mock_mkstemp.assert_has_calls(
+                [
+                    mock.call(dir="/dev/shm"),
+                    mock.call(dir=None),
+                    mock.call(dir="/dev/shm"),
+                    mock.call(dir=None),
+                ]
+            )
+
+            assert not os.path.exists(cert_path)
+            assert not os.path.exists(key_path)
+
+    @mock.patch.object(os, "access", return_value=True)
+    @mock.patch.object(os.path, "isdir", return_value=True)
+    @mock.patch.object(_mtls_helper, "_encrypt_key_if_plaintext", autospec=True)
+    @mock.patch.object(_mtls_helper, "_secure_wipe_and_remove", autospec=True)
+    def test_permission_error_loop_resilience(
+        self,
+        mock_wipe,
+        mock_encrypt,
+        mock_isdir,
+        mock_access,
+        tmpdir,
+    ):
+        original_mkstemp = tempfile.mkstemp
+
+        def _redirect_mkstemp(dir=None):
+            return original_mkstemp(dir=str(tmpdir))
+
+        with mock.patch.object(tempfile, "mkstemp", side_effect=_redirect_mkstemp):
+            mock_encrypt.return_value = (b"encrypted_key", b"new_pass")
+
+            # Mock the secure wipe to fail with PermissionError to test resilience
+            mock_wipe.side_effect = PermissionError("lock error")
+
+            with _mtls_helper._tempfile_cert_key_paths(b"cert", b"key", b"pass") as (
+                cert_path,
+                key_path,
+                passphrase,
+            ):
+                assert os.path.exists(cert_path)
+                assert os.path.exists(key_path)
+
+            # Organically verify cert_path was cleaned up despite PermissionError on key
+            assert not os.path.exists(cert_path)
+
+
+class TestEncryptKeyIfPlaintext(object):
+    def test_encrypts_plaintext_key(self):
+        encrypted_bytes, passphrase = _mtls_helper._encrypt_key_if_plaintext(
+            pytest.private_key_bytes, b"my_passphrase"
+        )
+        assert passphrase == b"my_passphrase"
+        assert encrypted_bytes != pytest.private_key_bytes
+        assert b"ENCRYPTED PRIVATE KEY" in encrypted_bytes
+
+        decrypted = serialization.load_pem_private_key(
+            encrypted_bytes, password=b"my_passphrase"
+        )
+        assert decrypted
+
+    @mock.patch("secrets.token_hex", return_value="0123456789abcdef0123456789abcdef")
+    def test_default_passphrase_generation(self, mock_secrets):
+        encrypted_bytes, passphrase = _mtls_helper._encrypt_key_if_plaintext(
+            pytest.private_key_bytes, None
+        )
+        assert passphrase == b"0123456789abcdef0123456789abcdef"
+        assert b"ENCRYPTED PRIVATE KEY" in encrypted_bytes
+
+    def test_returns_encrypted_key_asis(self):
+        encrypted_bytes, passphrase = _mtls_helper._encrypt_key_if_plaintext(
+            ENCRYPTED_EC_PRIVATE_KEY, b"passphrase"
+        )
+        assert encrypted_bytes == ENCRYPTED_EC_PRIVATE_KEY
+        assert passphrase == b"passphrase"
+
+    def test_encrypts_plaintext_key_string_passphrase(self):
+        encrypted_bytes, passphrase = _mtls_helper._encrypt_key_if_plaintext(
+            pytest.private_key_bytes, "my_passphrase_str"
+        )
+        assert passphrase == b"my_passphrase_str"
+        assert encrypted_bytes != pytest.private_key_bytes
+        assert b"ENCRYPTED PRIVATE KEY" in encrypted_bytes
+
+    def test_returns_unsupported_algorithm_asis(self):
+        import cryptography.exceptions
+
+        invalid_bytes = b"not a valid key"
+        with mock.patch(
+            "cryptography.hazmat.primitives.serialization.load_pem_private_key"
+        ) as load_mock:
+            load_mock.side_effect = cryptography.exceptions.UnsupportedAlgorithm(
+                "unsupported"
+            )
+            encrypted_bytes, passphrase = _mtls_helper._encrypt_key_if_plaintext(
+                invalid_bytes, b"passphrase"
+            )
+            assert encrypted_bytes == invalid_bytes
+            assert passphrase == b"passphrase"
+
+    def test_returns_invalid_key_asis(self):
+        invalid_bytes = b"not a valid key"
+        encrypted_bytes, passphrase = _mtls_helper._encrypt_key_if_plaintext(
+            invalid_bytes, b"passphrase"
+        )
+        assert encrypted_bytes == invalid_bytes
+        assert passphrase == b"passphrase"
+
+
+class TestSecureWipeAndRemove(object):
+    @mock.patch.object(os.path, "exists", return_value=True)
+    @mock.patch.object(os.path, "getsize", return_value=10)
+    @mock.patch("builtins.open", autospec=True)
+    @mock.patch.object(os, "fsync")
+    @mock.patch.object(os, "remove")
+    def test_success(
+        self, mock_remove, mock_fsync, mock_open, mock_getsize, mock_exists
+    ):
+        mock_fh = mock.MagicMock()
+        mock_fh.fileno.return_value = 1
+        mock_open.return_value.__enter__.return_value = mock_fh
+
+        _mtls_helper._secure_wipe_and_remove("/path/to/secret")
+
+        mock_open.assert_called_once_with("/path/to/secret", "r+b")
+        mock_fh.write.assert_called_once_with(b"\0" * 10)
+        mock_fsync.assert_called_once()
+        mock_remove.assert_called_once_with("/path/to/secret")
+
+    @mock.patch.object(os.path, "exists", return_value=False)
+    @mock.patch.object(os, "remove")
+    def test_file_not_found(self, mock_remove, mock_exists):
+        _mtls_helper._secure_wipe_and_remove("/path/to/nonexistent")
+
+        mock_exists.assert_called_once_with("/path/to/nonexistent")
+        mock_remove.assert_not_called()
+
+    @mock.patch.object(os.path, "exists", return_value=True)
+    @mock.patch.object(os.path, "getsize", return_value=10)
+    @mock.patch("builtins.open", autospec=True)
+    @mock.patch.object(os, "fsync")
+    @mock.patch.object(os, "remove")
+    def test_write_oserror_ignored(
+        self, mock_remove, mock_fsync, mock_open, mock_getsize, mock_exists
+    ):
+        mock_fh = mock.MagicMock()
+        mock_fh.fileno.return_value = 1
+        mock_fh.write.side_effect = OSError("write fault")
+        mock_open.return_value.__enter__.return_value = mock_fh
+
+        _mtls_helper._secure_wipe_and_remove("/path/to/secret")
+
+        mock_open.assert_called_once_with("/path/to/secret", "r+b")
+        mock_fsync.assert_not_called()
+        mock_remove.assert_called_once_with("/path/to/secret")
+
+    @mock.patch.object(os.path, "exists", return_value=True)
+    @mock.patch.object(os.path, "getsize", return_value=10)
+    @mock.patch("builtins.open", autospec=True)
+    @mock.patch.object(os, "fsync")
+    @mock.patch.object(os, "remove")
+    def test_remove_oserror_ignored(
+        self, mock_remove, mock_fsync, mock_open, mock_getsize, mock_exists
+    ):
+        mock_fh = mock.MagicMock()
+        mock_fh.fileno.return_value = 1
+        mock_open.return_value.__enter__.return_value = mock_fh
+        mock_remove.side_effect = OSError("remove fault")
+
+        _mtls_helper._secure_wipe_and_remove("/path/to/secret")
+
+        mock_open.assert_called_once_with("/path/to/secret", "r+b")
+        mock_fsync.assert_called_once()
+        mock_remove.assert_called_once_with("/path/to/secret")
diff --git a/packages/google-auth/tests/transport/test_aio_mtls_helper.py b/packages/google-auth/tests/transport/test_aio_mtls_helper.py
index bc9cde7d793b..0900225cada0 100644
--- a/packages/google-auth/tests/transport/test_aio_mtls_helper.py
+++ b/packages/google-auth/tests/transport/test_aio_mtls_helper.py
@@ -26,24 +26,6 @@
 
 
 class TestMTLS:
-    @pytest.mark.asyncio
-    async def test__create_temp_file(self):
-        """Tests that _create_temp_file creates a file with correct content and deletes it."""
-        content = b"test cert data"
-
-        # Test file creation and content
-        with mtls._create_temp_file(content) as file_path:
-            assert os.path.exists(file_path)
-            # Verify file is not readable by others (mkstemp default)
-            if os.name == "posix":
-                assert (os.stat(file_path).st_mode & 0o777) == 0o600
-
-            with open(file_path, "rb") as f:
-                assert f.read() == content
-
-        # Test file deletion after context exit
-        assert not os.path.exists(file_path)
-
     @pytest.mark.asyncio
     async def test_make_client_cert_ssl_context_success(self):
         """Tests successful creation of an SSLContext with client certificates."""
@@ -73,6 +55,26 @@ async def test_make_client_cert_ssl_context_success(self):
             assert not os.path.exists(kwargs["certfile"])
             assert not os.path.exists(kwargs["keyfile"])
 
+    @pytest.mark.asyncio
+    async def test_make_client_cert_ssl_context_success_no_passphrase(self):
+        """Tests successful creation of an SSLContext with no passphrase."""
+        cert_bytes = b"cert_data"
+        key_bytes = b"key_data"
+
+        mock_context = mock.Mock(spec=ssl.SSLContext)
+
+        with mock.patch(
+            "ssl.create_default_context", return_value=mock_context
+        ) as mock_create:
+            context = mtls.make_client_cert_ssl_context(
+                cert_bytes, key_bytes, passphrase=None
+            )
+
+            assert context == mock_context
+            mock_create.assert_called_once_with(ssl.Purpose.SERVER_AUTH)
+            kwargs = mock_context.load_cert_chain.call_args.kwargs
+            assert kwargs["password"] is None
+
     @pytest.mark.asyncio
     async def test_make_client_cert_ssl_context_error(self):
         """Verifies that TransportError is raised when SSL loading fails."""
@@ -200,3 +202,18 @@ async def test_get_client_ssl_credentials_error(self, mock_workload):
 
         with pytest.raises(exceptions.ClientCertError, match="Failed to read metadata"):
             await mtls.get_client_ssl_credentials()
+
+    @pytest.mark.asyncio
+    @mock.patch("google.auth.aio.transport.mtls.secure_cert_key_paths")
+    async def test_make_client_cert_ssl_context_setup_error(self, mock_secure_paths):
+        """Verifies that TransportError is raised when temp file creation fails."""
+        cert_bytes = b"cert_data"
+        key_bytes = b"key_data"
+
+        mock_secure_paths.side_effect = OSError("Temp file error")
+
+        with pytest.raises(exceptions.TransportError) as exc_info:
+            mtls.make_client_cert_ssl_context(cert_bytes, key_bytes)
+
+        assert "Failed to load client certificate" in str(exc_info.value)
+        assert isinstance(exc_info.value.__cause__, OSError)
diff --git a/packages/google-auth/tests/transport/test_requests.py b/packages/google-auth/tests/transport/test_requests.py
index d13f0fac2f20..e761a12a6bca 100644
--- a/packages/google-auth/tests/transport/test_requests.py
+++ b/packages/google-auth/tests/transport/test_requests.py
@@ -16,11 +16,9 @@
 import functools
 import http.client as http_client
 import os
-import sys
 from unittest import mock
 
 import freezegun
-import OpenSSL
 import pytest  # type: ignore
 import requests
 import requests.adapters
@@ -192,17 +190,18 @@ def test_success(self, mock_proxy_manager_for, mock_init_poolmanager):
         mock_proxy_manager_for.assert_called_with(ssl_context=adapter._ctx_proxymanager)
 
     def test_invalid_cert_or_key(self):
-        with pytest.raises(OpenSSL.crypto.Error):
+        with pytest.raises(exceptions.MutualTLSChannelError):
             google.auth.transport.requests._MutualTlsAdapter(
                 b"invalid cert", b"invalid key"
             )
 
-    @mock.patch.dict("sys.modules", {"OpenSSL.crypto": None})
-    def test_import_error(self):
-        with pytest.raises(ImportError):
-            google.auth.transport.requests._MutualTlsAdapter(
-                pytest.public_cert_bytes, pytest.private_key_bytes
-            )
+    @mock.patch("google.auth.transport.requests._mtls_helper.secure_cert_key_paths")
+    def test_setup_error_raises_mutual_tls_channel_error(self, mock_secure_paths):
+        mock_secure_paths.side_effect = OSError("Disk full")
+        with pytest.raises(exceptions.MutualTLSChannelError) as exc_info:
+            google.auth.transport.requests._MutualTlsAdapter(b"cert", b"key")
+        assert "Failed to configure client certificate" in str(exc_info.value)
+        assert isinstance(exc_info.value.__cause__, OSError)
 
 
 def make_response(status=http_client.OK, data=None):
@@ -496,9 +495,29 @@ def test_configure_mtls_channel_exceptions(self, mock_get_client_cert_and_key):
                 auth_session.configure_mtls_channel()
         assert auth_session._is_mtls is False
 
-        mock_get_client_cert_and_key.return_value = (False, None, None)
-        with mock.patch.dict("sys.modules"):
-            sys.modules["OpenSSL"] = None
+    @mock.patch(
+        "google.auth.transport._mtls_helper.get_client_cert_and_key", autospec=True
+    )
+    @mock.patch("google.auth.transport.requests.create_urllib3_context", autospec=True)
+    def test_configure_mtls_channel_cert_loading_exceptions(
+        self, mock_create_urllib3_context, mock_get_client_cert_and_key
+    ):
+        import ssl
+
+        mock_get_client_cert_and_key.return_value = (
+            True,
+            pytest.public_cert_bytes,
+            pytest.private_key_bytes,
+        )
+
+        for exception_type in [ValueError("error"), ssl.SSLError("error")]:
+            mock_ctx = mock.Mock()
+            mock_ctx.load_cert_chain.side_effect = exception_type
+            mock_create_urllib3_context.return_value = mock_ctx
+
+            auth_session = google.auth.transport.requests.AuthorizedSession(
+                credentials=mock.Mock()
+            )
             with pytest.raises(exceptions.MutualTLSChannelError):
                 with mock.patch.dict(
                     os.environ,
@@ -507,9 +526,20 @@ def test_configure_mtls_channel_exceptions(self, mock_get_client_cert_and_key):
                     auth_session.configure_mtls_channel()
             assert auth_session._is_mtls is False
 
+            assert not auth_session.is_mtls
+
     @mock.patch(
         "google.auth.transport._mtls_helper.get_client_cert_and_key", autospec=True
     )
+    @mock.patch.dict(
+        os.environ,
+        {
+            "GOOGLE_API_USE_CLIENT_CERTIFICATE": "false",
+            "CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE": "false",
+            "GOOGLE_API_CERTIFICATE_CONFIG": "",
+            "CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH": "",
+        },
+    )
     def test_configure_mtls_channel_without_client_cert_env(
         self, get_client_cert_and_key
     ):
diff --git a/packages/google-auth/tests/transport/test_urllib3.py b/packages/google-auth/tests/transport/test_urllib3.py
index 04ace52a2350..33674030aa8d 100644
--- a/packages/google-auth/tests/transport/test_urllib3.py
+++ b/packages/google-auth/tests/transport/test_urllib3.py
@@ -14,10 +14,8 @@
 
 import http.client as http_client
 import os
-import sys
 from unittest import mock
 
-import OpenSSL
 import pytest  # type: ignore
 import urllib3  # type: ignore
 
@@ -103,17 +101,18 @@ def test_success(self):
         assert isinstance(http, urllib3.PoolManager)
 
     def test_crypto_error(self):
-        with pytest.raises(OpenSSL.crypto.Error):
+        with pytest.raises(exceptions.MutualTLSChannelError):
             google.auth.transport.urllib3._make_mutual_tls_http(
                 b"invalid cert", b"invalid key"
             )
 
-    @mock.patch.dict("sys.modules", {"OpenSSL.crypto": None})
-    def test_import_error(self):
-        with pytest.raises(ImportError):
-            google.auth.transport.urllib3._make_mutual_tls_http(
-                pytest.public_cert_bytes, pytest.private_key_bytes
-            )
+    @mock.patch("google.auth.transport.urllib3._mtls_helper.secure_cert_key_paths")
+    def test_setup_error_raises_mutual_tls_channel_error(self, mock_secure_paths):
+        mock_secure_paths.side_effect = OSError("Disk full")
+        with pytest.raises(exceptions.MutualTLSChannelError) as exc_info:
+            google.auth.transport.urllib3._make_mutual_tls_http(b"cert", b"key")
+        assert "Failed to configure client certificate" in str(exc_info.value)
+        assert isinstance(exc_info.value.__cause__, OSError)
 
 
 class TestAuthorizedHttp(object):
@@ -292,9 +291,33 @@ def test_configure_mtls_channel_exceptions(self, mock_get_client_cert_and_key):
                 authed_http.configure_mtls_channel()
         assert authed_http._is_mtls is False
 
-        mock_get_client_cert_and_key.return_value = (False, None, None)
-        with mock.patch.dict("sys.modules"):
-            sys.modules["OpenSSL"] = None
+    @mock.patch(
+        "google.auth.transport._mtls_helper.get_client_cert_and_key", autospec=True
+    )
+    @mock.patch(
+        "google.auth.transport.urllib3.urllib3.util.ssl_.create_urllib3_context",
+        autospec=True,
+    )
+    def test_configure_mtls_channel_cert_loading_exceptions(
+        self, mock_create_urllib3_context, mock_get_client_cert_and_key
+    ):
+        import ssl
+
+        authed_http = google.auth.transport.urllib3.AuthorizedHttp(
+            credentials=mock.Mock()
+        )
+
+        mock_get_client_cert_and_key.return_value = (
+            True,
+            pytest.public_cert_bytes,
+            pytest.private_key_bytes,
+        )
+
+        for exception_type in [ValueError("error"), ssl.SSLError("error")]:
+            mock_ctx = mock.Mock()
+            mock_ctx.load_cert_chain.side_effect = exception_type
+            mock_create_urllib3_context.return_value = mock_ctx
+
             with pytest.raises(exceptions.MutualTLSChannelError):
                 with mock.patch.dict(
                     os.environ,
@@ -303,9 +326,20 @@ def test_configure_mtls_channel_exceptions(self, mock_get_client_cert_and_key):
                     authed_http.configure_mtls_channel()
             assert authed_http._is_mtls is False
 
+            assert not authed_http._is_mtls
+
     @mock.patch(
         "google.auth.transport._mtls_helper.get_client_cert_and_key", autospec=True
     )
+    @mock.patch.dict(
+        os.environ,
+        {
+            "GOOGLE_API_USE_CLIENT_CERTIFICATE": "false",
+            "CLOUDSDK_CONTEXT_AWARE_USE_CLIENT_CERTIFICATE": "false",
+            "GOOGLE_API_CERTIFICATE_CONFIG": "",
+            "CLOUDSDK_CONTEXT_AWARE_CERTIFICATE_CONFIG_FILE_PATH": "",
+        },
+    )
     def test_configure_mtls_channel_without_client_cert_env(
         self, get_client_cert_and_key
     ):
