diff --git a/openssl-sys/src/lib.rs b/openssl-sys/src/lib.rs
index 0a7d47c0..887359ae 100644
--- a/openssl-sys/src/lib.rs
+++ b/openssl-sys/src/lib.rs
@@ -2334,6 +2334,7 @@ extern "C" {
 
     pub fn RSA_new() -> *mut RSA;
     pub fn RSA_free(rsa: *mut RSA);
+    pub fn RSA_up_ref(rsa: *mut RSA) -> c_int;
     pub fn RSA_generate_key_ex(
         rsa: *mut RSA,
         bits: c_int,
diff --git a/openssl/src/rsa.rs b/openssl/src/rsa.rs
index ec1de35f..0ad55b96 100644
--- a/openssl/src/rsa.rs
+++ b/openssl/src/rsa.rs
@@ -77,6 +77,23 @@ generic_foreign_type_and_impl_send_sync! {
     pub struct RsaRef<T>;
 }
 
+impl<T> Clone for Rsa<T> {
+    fn clone(&self) -> Rsa<T> {
+        (**self).to_owned()
+    }
+}
+
+impl<T> ToOwned for RsaRef<T> {
+    type Owned = Rsa<T>;
+
+    fn to_owned(&self) -> Rsa<T> {
+        unsafe {
+            ffi::RSA_up_ref(self.as_ptr());
+            Rsa::from_ptr(self.as_ptr())
+        }
+    }
+}
+
 impl<T> RsaRef<T>
 where
     T: HasPrivate,
@@ -845,7 +862,7 @@ mod test {
 
     #[test]
     fn test_pem_pkcs1_padding() {
-        let keypair = super::Rsa::generate(512).unwrap();
+        let keypair = super::Rsa::generate(2048).unwrap();
         let pubkey_pem = keypair.public_key_to_pem_pkcs1().unwrap();
         let pubkey = super::Rsa::public_key_from_pem_pkcs1(&pubkey_pem).unwrap();
         let msg = "foo".as_bytes();
@@ -862,4 +879,10 @@ mod test {
         assert_eq!(len1, len2);
         assert_ne!(encrypted1, encrypted2);
     }
+
+    #[test]
+    fn clone() {
+        let key = Rsa::generate(2048).unwrap();
+        key.clone();
+    }
 }