diff --git a/.github/workflows/build-macos.yml b/.github/workflows/build-macos.yml
index ef0b29dc..562cd61c 100644
--- a/.github/workflows/build-macos.yml
+++ b/.github/workflows/build-macos.yml
@@ -25,7 +25,7 @@ jobs:
           mkdir -p ${VCPKG_DEFAULT_BINARY_CACHE}
       - uses: actions/cache@v3
         with:
-          key: "v2339-${{ runner.os }}"
+          key: "v2339-${{ runner.os }}-${{ matrix.triplet }}"
           path: |
             /usr/local/share/vcpkg-downloads
             /usr/local/share/vcpkg-archives
diff --git a/.github/workflows/build-ubuntu.yml b/.github/workflows/build-ubuntu.yml
new file mode 100644
index 00000000..2fc5eb0e
--- /dev/null
+++ b/.github/workflows/build-ubuntu.yml
@@ -0,0 +1,47 @@
+name: "Ubuntu"
+
+on: [push, workflow_dispatch]
+
+env:
+  VCPKG_FEATURE_FLAGS: "registries,binarycaching,manifests,versions"
+
+jobs:
+  ubuntu22:
+    runs-on: "ubuntu-22.04"
+    strategy:
+      fail-fast: false
+      matrix:
+        triplet: [x64-linux]
+    env:
+      VCPKG_OVERLAY_PORTS: "${{ github.workspace }}/ports"
+      VCPKG_OVERLAY_TRIPLETS: ${{ github.workspace }}/triplets
+    steps:
+      - uses: actions/checkout@v3
+      - name: "create cache folders"
+        run: |
+          mkdir -p ${VCPKG_DOWNLOADS}
+          mkdir -p ${VCPKG_DEFAULT_BINARY_CACHE}
+        env:
+          VCPKG_DOWNLOADS: "${{ runner.temp }}/vcpkg-downloads"
+          VCPKG_DEFAULT_BINARY_CACHE: "${{ runner.temp }}/vcpkg-archives"
+      - uses: actions/cache@v3
+        with:
+          key: "v2339-${{ runner.os }}-${{ matrix.triplet }}"
+          path: |
+            ${{ runner.temp }}/vcpkg-downloads
+            ${{ runner.temp }}/vcpkg-archives
+      - uses: ConorMacBride/install-package@v1
+        with:
+          apt: nuget nasm libnuma-dev libopenmpi-dev libx11-dev libxi-dev libxext-dev libx11-xcb-dev
+      - uses: lukka/run-vcpkg@v11
+        with:
+          vcpkgDirectory: "/usr/local/share/vcpkg" # see VCPKG_INSTALLATION_ROOT
+          doNotUpdateVcpkg: true
+          vcpkgGitCommitId: 5a38b5ec0eee3d1a1a6faab5e944617fee2697cf # check https://github.com/actions/runner-images/blob/main/images/linux/Ubuntu2204-Readme.md
+          vcpkgJsonGlob: "test/vcpkg.json"
+          runVcpkgInstall: true
+          runVcpkgFormatString: '[`install`, `--clean-buildtrees-after-build`, `--clean-packages-after-build`, `--triplet`, `$[env.VCPKG_DEFAULT_TRIPLET]`]'
+        env:
+          VCPKG_DEFAULT_TRIPLET: "${{ matrix.triplet }}"
+          VCPKG_DOWNLOADS: "${{ runner.temp }}/vcpkg-downloads"
+          VCPKG_DEFAULT_BINARY_CACHE: "${{ runner.temp }}/vcpkg-archives"
diff --git a/.github/workflows/build-windows.yml b/.github/workflows/build-windows.yml
index 9b9b5e2d..41017803 100644
--- a/.github/workflows/build-windows.yml
+++ b/.github/workflows/build-windows.yml
@@ -24,7 +24,7 @@ jobs:
           New-Item -Type Directory -Force ${env:VCPKG_DEFAULT_BINARY_CACHE}
       - uses: actions/cache@v3
         with:
-          key: "v2339-${{ runner.os }}"
+          key: "v2339-${{ runner.os }}-${{ matrix.triplet }}"
           path: |
             C:/vcpkg/downloads
             C:/vcpkg/archives
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index b4f20139..e5b507ca 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -315,7 +315,7 @@ stages:
               path: $(vcpkg.default.binary.cache)
           - task: run-vcpkg@0
             inputs:
-              vcpkgArguments: "libdispatch fft2d farmhash ruy eigen3 google-jni-bind"
+              vcpkgArguments: "openssl3 libdispatch fft2d farmhash ruy eigen3 google-jni-bind"
               vcpkgGitCommitId: $(vcpkg.commit)
             env:
               VCPKG_OVERLAY_TRIPLETS: $(Build.SourcesDirectory)/triplets
diff --git a/ports/openssl3/portfile.cmake b/ports/openssl3/portfile.cmake
index 2f761df4..33716692 100644
--- a/ports/openssl3/portfile.cmake
+++ b/ports/openssl3/portfile.cmake
@@ -1,12 +1,12 @@
-if(EXISTS ${CURRENT_INSTALLED_DIR}/include/openssl/ssl.h)
+if(EXISTS "${CURRENT_INSTALLED_DIR}/include/openssl/ssl.h")
     message(FATAL_ERROR "Can't build '${PORT}' if another SSL library is installed. Please remove existing one and try install '${PORT}' again if you need it.")
 endif()
 
 vcpkg_from_github(
     OUT_SOURCE_PATH SOURCE_PATH
     REPO openssl/openssl
-    REF openssl-3.1.2
-    SHA512 c48ad86265b0fee18b23863b645a286d131a863a3418c7d2ed6c819eebb822ad0f2985ba3ecbf4def32515442f0eb40aba08f3146d113247e86ec80fbddca1c1
+    REF openssl-3.1.3
+    SHA512 248353b000ef6b9a3434bf808b147eb4672c82f36968b2995c159373680f80208183bb70c02effa36ae4a1705fe5a5e315960075e8899352c4e84069d6c651c2
 )
 
 if(VCPKG_LIBRARY_LINKAGE STREQUAL "dynamic")
@@ -42,35 +42,35 @@ endif()
 include(${CMAKE_CURRENT_LIST_DIR}/detect_platform.cmake)
 
 # Clean & copy source files for working directories
-file(REMOVE_RECURSE ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg
-                    ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel
+file(REMOVE_RECURSE "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg"
+                    "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel"
 )
-get_filename_component(SOURCE_DIR_NAME ${SOURCE_PATH} NAME)
-file(COPY        ${SOURCE_PATH}
-     DESTINATION ${CURRENT_BUILDTREES_DIR})
-file(RENAME      ${CURRENT_BUILDTREES_DIR}/${SOURCE_DIR_NAME}
-                 ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg)
-file(COPY        ${SOURCE_PATH}
-     DESTINATION ${CURRENT_BUILDTREES_DIR})
-file(RENAME      ${CURRENT_BUILDTREES_DIR}/${SOURCE_DIR_NAME}
-                 ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel)
+get_filename_component(SOURCE_DIR_NAME "${SOURCE_PATH}" NAME)
+file(COPY        "${SOURCE_PATH}"
+     DESTINATION "${CURRENT_BUILDTREES_DIR}")
+file(RENAME      "${CURRENT_BUILDTREES_DIR}/${SOURCE_DIR_NAME}"
+                 "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg")
+file(COPY        "${SOURCE_PATH}"
+     DESTINATION "${CURRENT_BUILDTREES_DIR}")
+file(RENAME      "${CURRENT_BUILDTREES_DIR}/${SOURCE_DIR_NAME}"
+                 "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel")
 
 # see ${SOURCE_PATH}/NOTES-PERL.md
 vcpkg_find_acquire_program(PERL)
-get_filename_component(PERL_EXE_PATH ${PERL} DIRECTORY)
-vcpkg_add_to_path(${PERL_EXE_PATH})
+get_filename_component(PERL_EXE_PATH "${PERL}" DIRECTORY)
+vcpkg_add_to_path("${PERL_EXE_PATH}")
 
 if(NOT VCPKG_HOST_IS_WINDOWS)
     # see ${SOURCE_PATH}/NOTES-UNIX.md
     find_program(MAKE make REQUIRED)
-    get_filename_component(MAKE_EXE_PATH ${MAKE} DIRECTORY)
+    get_filename_component(MAKE_EXE_PATH "${MAKE}" DIRECTORY)
 endif()
 
 if(VCPKG_TARGET_IS_WINDOWS)
     # see ${SOURCE_PATH}/NOTES-WINDOWS.md
     vcpkg_find_acquire_program(NASM)
-    get_filename_component(NASM_EXE_PATH ${NASM} DIRECTORY)
-    vcpkg_add_to_path(PREPEND ${NASM_EXE_PATH})
+    get_filename_component(NASM_EXE_PATH "${NASM}" DIRECTORY)
+    vcpkg_add_to_path(PREPEND "${NASM_EXE_PATH}")
     # note: jom is not for `vcpkg_add_to_path`
     vcpkg_find_acquire_program(JOM)
 
@@ -78,7 +78,7 @@ elseif(VCPKG_TARGET_IS_ANDROID)
     # see ${SOURCE_PATH}/NOTES-ANDROID.md
     if(NOT DEFINED ENV{ANDROID_NDK_ROOT} AND DEFINED ENV{ANDROID_NDK_HOME})
         message(STATUS "ENV{ANDROID_NDK_ROOT} will be set to $ENV{ANDROID_NDK_HOME}")
-        set(ENV{ANDROID_NDK_ROOT} $ENV{ANDROID_NDK_HOME})
+        set(ENV{ANDROID_NDK_ROOT} "$ENV{ANDROID_NDK_HOME}")
     endif()
     if(NOT DEFINED ENV{ANDROID_NDK_ROOT})
         message(FATAL_ERROR "ENV{ANDROID_NDK_ROOT} is required by ${SOURCE_PATH}/Configurations/15-android.conf")
@@ -92,8 +92,8 @@ elseif(VCPKG_TARGET_IS_ANDROID)
     else()
         message(FATAL_ERROR "Unknown NDK host platform")
     endif()
-    get_filename_component(NDK_TOOL_PATH $ENV{ANDROID_NDK_ROOT}/toolchains/llvm/prebuilt/${NDK_HOST_TAG}/bin ABSOLUTE)
-    vcpkg_add_to_path(PREPEND ${NDK_TOOL_PATH})
+    get_filename_component(NDK_TOOL_PATH "$ENV{ANDROID_NDK_ROOT}/toolchains/llvm/prebuilt/${NDK_HOST_TAG}/bin" ABSOLUTE)
+    vcpkg_add_to_path(PREPEND "${NDK_TOOL_PATH}")
 
 endif()
 
@@ -104,7 +104,7 @@ vcpkg_execute_required_process(
     COMMAND ${PERL} Configure ${OPENSSL_SHARED} ${CONFIGURE_OPTIONS} --debug
         ${PLATFORM}
         "--prefix=${CURRENT_PACKAGES_DIR}/debug"
-    WORKING_DIRECTORY ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg
+    WORKING_DIRECTORY "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg"
     LOGNAME "configure-perl-${TARGET_TRIPLET}-dbg"
 )
 message(STATUS "Configuring ${TARGET_TRIPLET}-rel")
@@ -112,7 +112,7 @@ vcpkg_execute_required_process(
     COMMAND ${PERL} Configure ${OPENSSL_SHARED} ${CONFIGURE_OPTIONS}
         ${PLATFORM}
         "--prefix=${CURRENT_PACKAGES_DIR}"
-    WORKING_DIRECTORY ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel
+    WORKING_DIRECTORY "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel"
     LOGNAME "configure-perl-${TARGET_TRIPLET}-rel"
 )
 
@@ -120,13 +120,13 @@ if(VCPKG_TARGET_IS_UWP OR VCPKG_TARGET_IS_WINDOWS)
     message(STATUS "Building ${TARGET_TRIPLET}-dbg")
     vcpkg_execute_required_process(
         COMMAND ${JOM} /K /J ${VCPKG_CONCURRENCY} /F makefile install_dev
-        WORKING_DIRECTORY ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg
+        WORKING_DIRECTORY "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg"
         LOGNAME "install-${TARGET_TRIPLET}-dbg"
     )
     message(STATUS "Building ${TARGET_TRIPLET}-rel")
     vcpkg_execute_required_process(
         COMMAND ${JOM} /K /J ${VCPKG_CONCURRENCY} /F makefile install_dev
-        WORKING_DIRECTORY ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel
+        WORKING_DIRECTORY "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel"
         LOGNAME "install-${TARGET_TRIPLET}-rel"
     )
     vcpkg_copy_pdbs()
@@ -135,57 +135,53 @@ else()
     message(STATUS "Building ${TARGET_TRIPLET}-dbg")
     vcpkg_execute_required_process(
         COMMAND ${MAKE} -j ${VCPKG_CONCURRENCY} install_dev
-        WORKING_DIRECTORY ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg
+        WORKING_DIRECTORY "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg"
         LOGNAME "install-${TARGET_TRIPLET}-dbg"
     )
     message(STATUS "Building ${TARGET_TRIPLET}-rel")
     vcpkg_execute_required_process(
         COMMAND ${MAKE} -j ${VCPKG_CONCURRENCY} install_dev
-        WORKING_DIRECTORY ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel
+        WORKING_DIRECTORY "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel"
         LOGNAME "install-${TARGET_TRIPLET}-rel"
     )
     if(VCPKG_TARGET_IS_ANDROID AND VCPKG_LIBRARY_LINKAGE STREQUAL "dynamic")
         # install_dev copies symbolic link. overwrite them with the actual shared objects
-        file(INSTALL ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg/libcrypto.so
-                     ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg/libssl.so
-             DESTINATION ${CURRENT_PACKAGES_DIR}/debug/lib
+        file(INSTALL "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg/libcrypto.so"
+                     "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-dbg/libssl.so"
+             DESTINATION "${CURRENT_PACKAGES_DIR}/debug/lib"
         )
-        file(INSTALL ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel/libcrypto.so
-                     ${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel/libssl.so
-             DESTINATION ${CURRENT_PACKAGES_DIR}/lib
+        file(INSTALL "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel/libcrypto.so"
+                     "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel/libssl.so"
+             DESTINATION "${CURRENT_PACKAGES_DIR}/lib"
         )
     endif()
     # rename lib64 to lib for lib/pkgconfig
-    if(EXISTS ${CURRENT_PACKAGES_DIR}/debug/lib64)
-        file(RENAME ${CURRENT_PACKAGES_DIR}/debug/lib64
-                    ${CURRENT_PACKAGES_DIR}/debug/lib)
+    if(EXISTS "${CURRENT_PACKAGES_DIR}/debug/lib64")
+        file(RENAME "${CURRENT_PACKAGES_DIR}/debug/lib64" "${CURRENT_PACKAGES_DIR}/debug/lib")
     endif()
-    if(EXISTS ${CURRENT_PACKAGES_DIR}/lib64)
-        file(RENAME ${CURRENT_PACKAGES_DIR}/lib64
-                    ${CURRENT_PACKAGES_DIR}/lib)
+    if(EXISTS "${CURRENT_PACKAGES_DIR}/lib64")
+        file(RENAME "${CURRENT_PACKAGES_DIR}/lib64" "${CURRENT_PACKAGES_DIR}/lib")
     endif()
     vcpkg_fixup_pkgconfig()
 
 endif()
 
 if(VCPKG_LIBRARY_LINKAGE STREQUAL "dynamic")
-    file(REMOVE ${CURRENT_PACKAGES_DIR}/debug/lib/libcrypto.a
-                ${CURRENT_PACKAGES_DIR}/debug/lib/libssl.a
-                ${CURRENT_PACKAGES_DIR}/lib/libcrypto.a
-                ${CURRENT_PACKAGES_DIR}/lib/libssl.a
+    file(REMOVE "${CURRENT_PACKAGES_DIR}/debug/lib/libcrypto.a"
+                "${CURRENT_PACKAGES_DIR}/debug/lib/libssl.a"
+                "${CURRENT_PACKAGES_DIR}/lib/libcrypto.a"
+                "${CURRENT_PACKAGES_DIR}/lib/libssl.a"
     )
 else()
-    file(REMOVE_RECURSE ${CURRENT_PACKAGES_DIR}/debug/bin
-                        ${CURRENT_PACKAGES_DIR}/bin
+    file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/bin"
+                        "${CURRENT_PACKAGES_DIR}/bin"
     )
     if(VCPKG_TARGET_IS_WINDOWS)
-        file(REMOVE ${CURRENT_PACKAGES_DIR}/debug/lib/ossl_static.pdb
-                    ${CURRENT_PACKAGES_DIR}/lib/ossl_static.pdb
+        file(REMOVE "${CURRENT_PACKAGES_DIR}/debug/lib/ossl_static.pdb"
+                    "${CURRENT_PACKAGES_DIR}/lib/ossl_static.pdb"
         )
     endif()
 endif()
-file(REMOVE_RECURSE ${CURRENT_PACKAGES_DIR}/debug/include)
+file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/include")
 
-file(INSTALL     ${SOURCE_PATH}/LICENSE.txt
-     DESTINATION ${CURRENT_PACKAGES_DIR}/share/${PORT} RENAME copyright
-)
+file(INSTALL "${SOURCE_PATH}/LICENSE.txt" DESTINATION "${CURRENT_PACKAGES_DIR}/share/${PORT}" RENAME copyright)
diff --git a/ports/openssl3/vcpkg.json b/ports/openssl3/vcpkg.json
index 6cca144d..1c1a32c2 100644
--- a/ports/openssl3/vcpkg.json
+++ b/ports/openssl3/vcpkg.json
@@ -1,6 +1,6 @@
 {
   "name": "openssl3",
-  "version-semver": "3.1.2",
+  "version-semver": "3.1.3",
   "description": "TLS/SSL and crypto library",
   "homepage": "https://www.openssl.org/",
   "license": "Apache-2.0"
diff --git a/versions/baseline.json b/versions/baseline.json
index 729a991f..dc958947 100644
--- a/versions/baseline.json
+++ b/versions/baseline.json
@@ -81,7 +81,7 @@
       "port-version": 0
     },
     "openssl3": {
-      "baseline": "3.1.2",
+      "baseline": "3.1.3",
       "port-version": 0
     },
     "pthreadpool": {
diff --git a/versions/o-/openssl3.json b/versions/o-/openssl3.json
index 5a9ed848..e7517f20 100644
--- a/versions/o-/openssl3.json
+++ b/versions/o-/openssl3.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "12873821eee945e8a5e59d43b13d29c6973109cf",
+      "version-semver": "3.1.3",
+      "port-version": 0
+    },
     {
       "git-tree": "069eb2441000b0dc121316929b979a7cbe18e979",
       "version-semver": "3.1.2",