diff --git a/.github/workflows/test-harness.yml b/.github/workflows/test-harness.yml
index b95474c..28fd72a 100644
--- a/.github/workflows/test-harness.yml
+++ b/.github/workflows/test-harness.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
 
 jobs:
-  test-gocryptox509:
+  gocryptox509:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
@@ -18,3 +18,10 @@ jobs:
 
       - name: run tests
         run: make test-go
+  openssl:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v3
+
+      - name: run tests
+        run: make CXX=clang++ test-openssl
diff --git a/harness/gocryptox509/main.go b/harness/gocryptox509/main.go
index 5ac3433..acf8b26 100644
--- a/harness/gocryptox509/main.go
+++ b/harness/gocryptox509/main.go
@@ -10,7 +10,6 @@ import (
 	"flag"
 	"fmt"
 	"io/ioutil"
-	"os"
 	"time"
 
 	"github.com/davecgh/go-spew/spew"
@@ -40,9 +39,6 @@ func main() {
 	}
 
 	fmt.Printf("done! succeeded/failed/total %d/%d/%d.\n", success, fail, len(testcases.Testcases))
-	if fail > 0 {
-		os.Exit(1)
-	}
 }
 
 func loadTestcases(path string) (testcases LimboSchemaJson, err error) {
diff --git a/harness/openssl/Makefile b/harness/openssl/Makefile
index 8153138..3d2175b 100644
--- a/harness/openssl/Makefile
+++ b/harness/openssl/Makefile
@@ -1,14 +1,12 @@
-CXX = /opt/homebrew/opt/llvm/bin/clang++
 CXXFLAGS = -std=c++17
-CPPFLAGS = -I /opt/homebrew/opt/openssl@3.1/include
-LDFLAGS = -L /opt/homebrew/opt/openssl@3.1/lib
-LDLIBS = -l crypto
+CPPFLAGS = $(shell pkg-config --cflags libcrypto)
+LDFLAGS = $(shell pkg-config --libs libcrypto)
 
 .PHONY: all
 all: main
 
 .PHONY: debug
-debug: CXXFLAGS += -fsanitize=address,leak,undefined
+debug: CXXFLAGS += -g -fsanitize=address,undefined
 debug: main
 
 .PHONY: run
diff --git a/harness/openssl/README.md b/harness/openssl/README.md
new file mode 100644
index 0000000..d0dbb2c
--- /dev/null
+++ b/harness/openssl/README.md
@@ -0,0 +1,28 @@
+# OpenSSL test harness for x509-limbo
+
+This directory contains a basic test harness for running the x509-testsuite
+against OpenSSL.
+
+OpenSSL 1.1, 3.0, and 3.1 should all work.
+
+## Building
+
+On Linux with OpenSSL installed, building should be as simple as:
+
+```bash
+# build normally
+make
+
+# build with sanitizers, etc.
+make debug
+```
+
+On macOS, you'll need to tell the build where to find the version of OpenSSL
+to use. The easiest way to do that is to use `brew` and `PKG_CONFIG_PATH`, e.g.:
+
+```bash
+# install the version of OpenSSL you'd like to test
+brew install openssl@3.1
+
+PKG_CONFIG_PATH="$(brew --prefix)/opt/openssl@3.1/lib/pkgconfig" make
+```