diff --git a/library/ssl_tls.c b/library/ssl_tls.c
index 8d45177..3c1c5cf 100644
--- a/library/ssl_tls.c
+++ b/library/ssl_tls.c
@@ -19,6 +19,7 @@
 #include "ssl_client.h"
 #include "ssl_debug_helpers.h"
 #include "ssl_misc.h"
+#include "ssl_tls13_keys.h"
 
 #include "debug_internal.h"
 #include "mbedtls/error.h"
@@ -10053,4 +10054,98 @@
 }
 #endif /* MBEDTLS_SSL_HANDSHAKE_WITH_CERT_ENABLED */
 
+static int mbedtls_ssl_tls12_export_keying_material(const mbedtls_ssl_context *ssl,
+                                                    const mbedtls_md_type_t hash_alg,
+                                                    uint8_t *out, const size_t key_len,
+                                                    const char *label, const size_t label_len,
+                                                    const unsigned char *context, const size_t context_len,
+                                                    const int use_context)
+{
+    int ret = 0;
+    size_t prf_input_len = use_context ? 64 + 2 + context_len : 64;
+    unsigned char *prf_input = NULL;
+    char *label_str = NULL;
+
+    if (use_context && context_len >= (1 << 16)) {
+        ret = MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+        goto exit;
+    }
+
+    prf_input = mbedtls_calloc(prf_input_len, sizeof(unsigned char));
+    label_str = mbedtls_calloc(label_len + 1, sizeof(char));
+    if (prf_input == NULL || label_str == NULL) {
+        ret = MBEDTLS_ERR_SSL_ALLOC_FAILED;
+        goto exit;
+    }
+
+    memcpy(label_str, label, label_len);
+    label_str[label_len] = '\0';
+
+    /* The input to the PRF is client_random, then server_random.
+     * If a context is provided, this is then followed by the context length
+     * as a 16-bit big-endian integer, and then the context itself. */
+    memcpy(prf_input, ssl->transform->randbytes + 32, 32);
+    memcpy(prf_input + 32, ssl->transform->randbytes, 32);
+    if (use_context) {
+        prf_input[64] = (unsigned char)((context_len >> 8) & 0xff);
+        prf_input[65] = (unsigned char)(context_len & 0xff);
+        memcpy(prf_input + 66, context, context_len);
+    }
+    ret = tls_prf_generic(hash_alg, ssl->session->master, 48, label_str,
+                          prf_input, prf_input_len,
+                          out, key_len);
+
+exit:
+    mbedtls_free(prf_input);
+    mbedtls_free(label_str);
+    return ret;
+}
+
+static int mbedtls_ssl_tls13_export_keying_material(mbedtls_ssl_context *ssl,
+                                                    const mbedtls_md_type_t hash_alg,
+                                                    uint8_t *out, const size_t key_len,
+                                                    const char *label, const size_t label_len,
+                                                    const unsigned char *context, const size_t context_len)
+{
+    const psa_algorithm_t psa_hash_alg = mbedtls_md_psa_alg_from_type(hash_alg);
+    const size_t hash_len = PSA_HASH_LENGTH(hash_alg);
+    const unsigned char *secret = ssl->session->app_secrets.exporter_master_secret;
+
+    if (key_len > 0xff || label_len > 250) {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
+    return mbedtls_ssl_tls13_exporter(psa_hash_alg, secret, hash_len,
+                                      (const unsigned char *)label, label_len,
+                                      context, context_len, out, key_len);
+}
+
+int mbedtls_ssl_export_keying_material(mbedtls_ssl_context *ssl,
+                                        uint8_t *out, const size_t key_len,
+                                        const char *label, const size_t label_len,
+                                        const unsigned char *context, const size_t context_len,
+                                        const int use_context)
+{
+    if (!mbedtls_ssl_is_handshake_over(ssl)) {
+        return MBEDTLS_ERR_SSL_BAD_INPUT_DATA;
+    }
+
+    int ciphersuite_id = mbedtls_ssl_get_ciphersuite_id_from_ssl(ssl);
+    const mbedtls_ssl_ciphersuite_t *ciphersuite = mbedtls_ssl_ciphersuite_from_id(ciphersuite_id);
+    const mbedtls_md_type_t hash_alg = ciphersuite->mac;
+
+    switch (mbedtls_ssl_get_version_number(ssl)) {
+        case MBEDTLS_SSL_VERSION_TLS1_2:
+            return mbedtls_ssl_tls12_export_keying_material(ssl, hash_alg, out, key_len,
+                                                            label, label_len,
+                                                            context, context_len, use_context);
+        case MBEDTLS_SSL_VERSION_TLS1_3:
+            return mbedtls_ssl_tls13_export_keying_material(ssl, hash_alg, out, key_len, label, label_len,
+                                                            use_context ? context : NULL,
+                                                            use_context ? context_len : 0);
+        default:
+            return MBEDTLS_ERR_SSL_BAD_PROTOCOL_VERSION;
+    }
+}
+
 #endif /* MBEDTLS_SSL_TLS_C */