diff --git a/CMakeLists.txt b/CMakeLists.txt
index b9157ec0ab..42b683d005 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -2243,6 +2243,10 @@ add_option("WOLFSSL_CRYPTOCB_NO_SW_TEST"
     "Disable crypto callback SW testing (default: disabled)"
     "no" "yes;no")
 
+add_option("WOLFSSL_CRYPTOCB_RSA_PAD"
+    "Enable RSA padding aware crypto callbacks (default: disabled)"
+    "no" "yes;no")
+
 add_option("WOLFSSL_PKCALLBACKS"
     "Enable public key callbacks (default: disabled)"
     "no" "yes;no")
@@ -2475,6 +2479,13 @@ if(WOLFSSL_CRYPTOCB_NO_SW_TEST)
     list(APPEND WOLFSSL_DEFINITIONS "-DWC_TEST_NO_CRYPTOCB_SW_TEST")
 endif()
 
+if(WOLFSSL_CRYPTOCB_RSA_PAD)
+    if(NOT WOLFSSL_CRYPTOCB)
+        message(FATAL_ERROR "WOLFSSL_CRYPTOCB_RSA_PAD requires WOLFSSL_CRYPTOCB")
+    endif()
+    list(APPEND WOLFSSL_DEFINITIONS "-DWOLF_CRYPTO_CB_RSA_PAD")
+endif()
+
 # Public Key Callbacks
 if(WOLFSSL_PKCALLBACKS)
     list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_PK_CALLBACKS")
diff --git a/cmake/options.h.in b/cmake/options.h.in
index 1fe054b276..fd6f0bee30 100644
--- a/cmake/options.h.in
+++ b/cmake/options.h.in
@@ -258,6 +258,8 @@ extern "C" {
 #cmakedefine WC_RSA_PSS
 #undef WOLF_CRYPTO_CB
 #cmakedefine WOLF_CRYPTO_CB
+#undef WOLF_CRYPTO_CB_RSA_PAD
+#cmakedefine WOLF_CRYPTO_CB_RSA_PAD
 #undef WOLFSSL_AARCH64_BUILD
 #cmakedefine WOLFSSL_AARCH64_BUILD
 #undef WOLFSSL_AES_CFB
diff --git a/configure.ac b/configure.ac
index 88208ce605..f1e68f635c 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10647,6 +10647,24 @@ if test "$ENABLED_CRYPTOCB_UTILS" != "no"; then
     fi
 fi
 
+# Crypto callback RSA padding support
+# When enabled, the RSA crypto callback args struct exposes the RsaPadding
+# parameters so the callback can perform RSA padding/unpadding itself or
+# offload it together with the modular exponentiation.
+AC_ARG_ENABLE([cryptocb-rsa-pad],
+    [AS_HELP_STRING([--enable-cryptocb-rsa-pad],[Enable RSA padding aware crypto callbacks (default: disabled). Requires --enable-cryptocb])],
+    [ ENABLED_CRYPTOCB_RSA_PAD=$enableval ],
+    [ ENABLED_CRYPTOCB_RSA_PAD=no ]
+    )
+
+if test "$ENABLED_CRYPTOCB_RSA_PAD" = "yes"
+then
+    if test "x$ENABLED_CRYPTOCB" = "xno"; then
+        AC_MSG_ERROR([--enable-cryptocb-rsa-pad requires --enable-cryptocb])
+    fi
+    AM_CFLAGS="$AM_CFLAGS -DWOLF_CRYPTO_CB_RSA_PAD"
+fi
+
 
 # Asynchronous Crypto
 AC_ARG_ENABLE([asynccrypt],