31 files changed, 165 insertions, 142 deletions

diff --git a/Mk/bsd.default-versions.mk b/Mk/bsd.default-versions.mk
index dc952cb9b393..592ba2b447e4 100644
--- a/Mk/bsd.default-versions.mk
+++ b/Mk/bsd.default-versions.mk
@@ -41,7 +41,7 @@ FPC_DEFAULT?=		3.0.0
 GCC_DEFAULT?=		4.9
 # Possible values: 7, 8, 9, agpl
 GHOSTSCRIPT_DEFAULT?=	agpl
-.if defined(ARCH) && ${ARCH} == amd64
+.if ${ARCH} == amd64
 # Possible values: c6, c6_64, c7
 LINUX_DEFAULT?=		c6_64
 .else
diff --git a/Mk/bsd.port.mk b/Mk/bsd.port.mk
index 51faba6d8d22..fd958063a0ba 100644
--- a/Mk/bsd.port.mk
+++ b/Mk/bsd.port.mk
@@ -1266,8 +1266,6 @@ GROUPS_BLACKLIST=	_dhcp _pflogd _ypldap audit authpf bin bind daemon dialer ftp
 LDCONFIG_DIR=	libdata/ldconfig
 LDCONFIG32_DIR=	libdata/ldconfig32
 
-.endif
-
 # At least KDE needs TMPDIR for the package building,
 # so we're setting it to the known default value.
 .if defined(PACKAGE_BUILDING)
@@ -1280,8 +1278,12 @@ WITH_DEBUG=	yes
 .endif
 .endif
 
+.include "${PORTSDIR}/Mk/bsd.default-versions.mk"
 .include "${PORTSDIR}/Mk/bsd.options.mk"
 
+.endif
+# End of options section.
+
 # Start of pre-makefile section.
 .if !defined(AFTERPORTMK) && !defined(INOPTIONSMK)
 
@@ -1291,8 +1293,6 @@ WITH_DEBUG=	yes
 
 _PREMKINCLUDED=	yes
 
-.include "${PORTSDIR}/Mk/bsd.default-versions.mk"
-
 .if defined(PORTVERSION)
 .if ${PORTVERSION:M*[-_,]*}x != x
 IGNORE=			PORTVERSION ${PORTVERSION} may not contain '-' '_' or ','
diff --git a/Tools/scripts/chkversion.pl b/Tools/scripts/chkversion.pl
index a855225d4136..a83e0b34f9f2 100755
--- a/Tools/scripts/chkversion.pl
+++ b/Tools/scripts/chkversion.pl
@@ -127,7 +127,6 @@ foreach (qw(ARCH OPSYS OSREL OSVERSION UID)) {
     my @cachedenv = readfrom $portsdir, $make, "-V$_";
     $ENV{$_} = $cachedenv[0];
 }
-$ENV{WITH_OPENSSL_BASE} = 'yes';
 
 my %pkgname;
 my %pkgorigin;
diff --git a/benchmarks/wrk/Makefile b/benchmarks/wrk/Makefile
index 9ba0f1a97b8f..0893b971185e 100644
--- a/benchmarks/wrk/Makefile
+++ b/benchmarks/wrk/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	wrk
 PORTVERSION=	4.0.2
+PORTREVISION=	1
 CATEGORIES=	benchmarks www
 
 MAINTAINER=	osa@FreeBSD.org
@@ -15,11 +16,9 @@ LIB_DEPENDS=	libluajit-5.1.so:lang/luajit
 USE_GITHUB=	yes
 GH_ACCOUNT=	wg
 
-USES=		gmake
-USE_OPENSSL=	yes
-WITH_OPENSSL_PORT=	yes
+USES=		gmake ssl
 CFLAGS+=	-std=c99 -D_DECLARE_C99_LDBL_MATH
-MAKE_ENV+=	WITH_OPENSSL=${LOCALBASE} WITH_LUAJIT=${LOCALBASE} VER=${PORTVERSION}
+MAKE_ENV+=	WITH_OPENSSL=${OPENSSLBASE} WITH_LUAJIT=${LOCALBASE} VER=${PORTVERSION}
 
 PLIST_FILES=	bin/wrk
 
diff --git a/databases/mariadb100-client/files/patch-cmake_ssl.cmake b/databases/mariadb100-client/files/patch-cmake_ssl.cmake
new file mode 100644
index 000000000000..0414d663f59c
--- /dev/null
+++ b/databases/mariadb100-client/files/patch-cmake_ssl.cmake
@@ -0,0 +1,24 @@
+--- cmake/ssl.cmake.orig	2016-08-24 15:07:34 UTC
++++ cmake/ssl.cmake
+@@ -141,11 +141,6 @@ MACRO (MYSQL_CHECK_SSL)
+       MESSAGE(STATUS "OPENSSL_APPLINK_C ${OPENSSL_APPLINK_C}")
+     ENDIF()
+ 
+-    # On mac this list is <.dylib;.so;.a>
+-    # We prefer static libraries, so we revert it here.
+-    IF (WITH_SSL_PATH)
+-      LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
+-    ENDIF()
+     MESSAGE(STATUS "suffixes <${CMAKE_FIND_LIBRARY_SUFFIXES}>")
+     FIND_LIBRARY(OPENSSL_LIBRARIES
+                  NAMES ssl ssleay32 ssleay32MD
+@@ -153,9 +148,6 @@ MACRO (MYSQL_CHECK_SSL)
+     FIND_LIBRARY(CRYPTO_LIBRARY
+                  NAMES crypto libeay32
+                  HINTS ${OPENSSL_ROOT_DIR}/lib)
+-    IF (WITH_SSL_PATH)
+-      LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
+-    ENDIF()
+ 
+     IF(OPENSSL_INCLUDE_DIR AND
+        OPENSSL_LIBRARIES   AND
diff --git a/databases/mariadb100-server/Makefile b/databases/mariadb100-server/Makefile
index 01b60786621f..b60d4fc87d6f 100644
--- a/databases/mariadb100-server/Makefile
+++ b/databases/mariadb100-server/Makefile
@@ -2,6 +2,7 @@
 
 PORTNAME?=	mariadb
 PORTVERSION=	10.0.29
+PORTREVISION=	1
 CATEGORIES=	databases ipv6
 MASTER_SITES=	http://ftp.osuosl.org/pub/${SITESDIR}/ \
 		http://mirrors.supportex.net/${SITESDIR}/ \
@@ -95,8 +96,6 @@ OPTIONS_SUB=	yes
 .endif
 
 FASTMTX_CMAKE_ON=	-DWITH_FAST_MUTEXES=1
-# See PR209419, MariaDB 10.0 fails to build with base SSL libs
-WITH_OPENSSL_PORT=	yes
 
 .if defined(CLIENT_ONLY)
 # MySQL-Client part
diff --git a/databases/mariadb100-server/files/patch-cmake_ssl.cmake b/databases/mariadb100-server/files/patch-cmake_ssl.cmake
new file mode 100644
index 000000000000..0414d663f59c
--- /dev/null
+++ b/databases/mariadb100-server/files/patch-cmake_ssl.cmake
@@ -0,0 +1,24 @@
+--- cmake/ssl.cmake.orig	2016-08-24 15:07:34 UTC
++++ cmake/ssl.cmake
+@@ -141,11 +141,6 @@ MACRO (MYSQL_CHECK_SSL)
+       MESSAGE(STATUS "OPENSSL_APPLINK_C ${OPENSSL_APPLINK_C}")
+     ENDIF()
+ 
+-    # On mac this list is <.dylib;.so;.a>
+-    # We prefer static libraries, so we revert it here.
+-    IF (WITH_SSL_PATH)
+-      LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
+-    ENDIF()
+     MESSAGE(STATUS "suffixes <${CMAKE_FIND_LIBRARY_SUFFIXES}>")
+     FIND_LIBRARY(OPENSSL_LIBRARIES
+                  NAMES ssl ssleay32 ssleay32MD
+@@ -153,9 +148,6 @@ MACRO (MYSQL_CHECK_SSL)
+     FIND_LIBRARY(CRYPTO_LIBRARY
+                  NAMES crypto libeay32
+                  HINTS ${OPENSSL_ROOT_DIR}/lib)
+-    IF (WITH_SSL_PATH)
+-      LIST(REVERSE CMAKE_FIND_LIBRARY_SUFFIXES)
+-    ENDIF()
+ 
+     IF(OPENSSL_INCLUDE_DIR AND
+        OPENSSL_LIBRARIES   AND
diff --git a/deskutils/owncloudclient/Makefile b/deskutils/owncloudclient/Makefile
index 3af8e9e85529..8aff6cad0200 100644
--- a/deskutils/owncloudclient/Makefile
+++ b/deskutils/owncloudclient/Makefile
@@ -38,17 +38,6 @@ DEBUG_CMAKE_ON=		-DCMAKE_BUILD_TYPE:STRING=Debug
 
 PLIST_SUB=	VERSION=${PORTVERSION}
 
-.include <bsd.port.options.mk>
-
-.if ${OPSYS} != FreeBSD
-WITH_OPENSSL_PORT=	yes
-
-# CMake 3.3.x will use $PATH when looking for headers and libraries by default,
-# and OpenSSL from base will end up being used. Make sure ${LOCALBASE} is
-# preferred over $PATH.
-CMAKE_ARGS+=		-DCMAKE_PREFIX_PATH=${LOCALBASE}
-.endif
-
 post-patch:
 	@${REINPLACE_CMD} -e \
 		's|.lst |.lst.sample |' ${WRKSRC}/CMakeLists.txt
diff --git a/devel/efl/Makefile b/devel/efl/Makefile
index 13926b696dbf..aab41276c8e4 100644
--- a/devel/efl/Makefile
+++ b/devel/efl/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	efl
 PORTVERSION=	1.18.4
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	devel enlightenment
 MASTER_SITES=	http://download.enlightenment.org/rel/libs/${PORTNAME}/
 
@@ -129,7 +129,6 @@ PLIST_SUB+=			AUDIO="@comment "
 
 .if ${PORT_OPTIONS:MSSL}
 USES+=				ssl
-WITH_OPENSSL_PORT=		yes
 .else
 CONFIGURE_ARGS+=		--with-crypto=none
 .endif
diff --git a/devel/efl/files/extra-patch-configure.ac b/devel/efl/files/extra-patch-configure.ac
deleted file mode 100644
index c97c6822be54..000000000000
--- a/devel/efl/files/extra-patch-configure.ac
+++ /dev/null
@@ -1,11 +0,0 @@
---- configure.ac.orig	2014-12-11 10:36:05.000000000 +0100
-+++ configure.ac	2014-12-28 00:57:35.000000000 +0100
-@@ -351,7 +351,7 @@
-       ;;
- 
-    openssl)
--      EFL_DEPEND_PKG([crypto], [OPENSSL], [openssl])
-+      requirements_libs_crypto="${ECORE_CON_LIBS} ${requirements_libs_crypto}"
-       ;;
- esac
- AM_CONDITIONAL([HAVE_CRYPTO_GNUTLS], [test "${build_crypto}" = "gnutls"])
diff --git a/devel/efl/files/patch-configure.ac b/devel/efl/files/patch-configure.ac
index 74a679beb15f..6b651d1dd89c 100644
--- a/devel/efl/files/patch-configure.ac
+++ b/devel/efl/files/patch-configure.ac
@@ -1,6 +1,16 @@
---- configure.ac.orig	2015-06-12 05:40:48.754367679 -0700
-+++ configure.ac	2015-06-12 05:45:05.521352761 -0700
-@@ -414,12 +414,12 @@
+--- configure.ac.orig	2016-12-07 14:25:43 UTC
++++ configure.ac
+@@ -386,7 +386,8 @@ case "$build_crypto" in
+       ;;
+ 
+    openssl)
+-      EFL_DEPEND_PKG([crypto], [OPENSSL], [openssl])
++      AC_DEFINE([HAVE_OPENSSL], [1], [Have OpenSSL])
++      requirements_libs_crypto="-lssl -lcrypto ${requirements_libs_crypto}"
+       ;;
+ esac
+ AM_CONDITIONAL([HAVE_CRYPTO_GNUTLS], [test "${build_crypto}" = "gnutls"])
+@@ -442,12 +443,12 @@ AC_CHECK_HEADERS([ \
  execinfo.h \
  mcheck.h \
  sys/epoll.h \
@@ -14,7 +24,7 @@
  ])
  
  EFL_CHECK_PATH_MAX
-@@ -3995,6 +3995,7 @@
+@@ -4732,6 +4733,7 @@ EFL_ADD_LIBS([EIO], [-lm])
  ### Checks for linker characteristics
  
  ### Checks for library functions
diff --git a/devel/efl/files/patch-m4_efl.m4 b/devel/efl/files/patch-m4_efl.m4
new file mode 100644
index 000000000000..a847aced767a
--- /dev/null
+++ b/devel/efl/files/patch-m4_efl.m4
@@ -0,0 +1,11 @@
+--- m4/efl.m4.orig	2016-09-13 07:23:52 UTC
++++ m4/efl.m4
+@@ -219,7 +219,7 @@ AC_DEFUN([EFL_CRYPTO_DEPEND],
+ [dnl
+ m4_pushdef([DOWNEFL], m4_translit([$1], [-A-Z], [_a-z]))dnl
+ requirements_pc_[]m4_defn([DOWNEFL])="${requirements_pc_crypto} ${requirements_pc_[][]m4_defn([DOWNEFL])}"
+-requirements_pc_deps_[]m4_defn([DOWNEFL])="${requirements_pc_deps_crypto} ${requirements_pc_deps_[][]m4_defn([DOWNEFL])}"
++requirements_pc_deps_[]m4_defn([DOWNEFL])="${requirements_pc_deps_crypto}${requirements_pc_deps_crypto:+ }${requirements_pc_deps_[][]m4_defn([DOWNEFL])}"
+ requirements_libs_[]m4_defn([DOWNEFL])="${requirements_libs_crypto} ${requirements_libs_[][]m4_defn([DOWNEFL])}"
+ requirements_cflags_[]m4_defn([DOWNEFL])="${requirements_cflags_crypto} ${requirements_cflags_[][]m4_defn([DOWNEFL])}"
+ m4_popdef([DOWNEFL])dnl
diff --git a/dns/knot1/Makefile b/dns/knot1/Makefile
index 83d10f45ffb6..ef6e3cd95be8 100644
--- a/dns/knot1/Makefile
+++ b/dns/knot1/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	knot
 PORTVERSION=	1.6.8
+PORTREVISION=	1
 CATEGORIES=	dns ipv6
 MASTER_SITES=	https://secure.nic.cz/files/knot-dns/ \
 		http://dns-lab.com/downloads/knot-dns/
@@ -18,14 +19,12 @@ LIB_DEPENDS=	liburcu.so:sysutils/liburcu
 
 CONFLICTS=	knot-2.* knot2-.*
 
-USES=		alias bison libtool pkgconfig tar:xz
+USES=		alias bison libtool pkgconfig ssl tar:xz
 GNU_CONFIGURE=	yes
 CONFIGURE_ARGS=	--with-storage=/var/db/knot \
 		--with-rundir=/var/run/knot \
 		--with-openssl=${OPENSSLBASE}
 USE_LDCONFIG=	yes
-USE_OPENSSL=	yes
-WITH_OPENSSL_PORT=	yes
 
 INSTALL_TARGET=	install-strip
 
diff --git a/dns/validns/Makefile b/dns/validns/Makefile
index 8873cb930d4e..1b5160ccf508 100644
--- a/dns/validns/Makefile
+++ b/dns/validns/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	validns
 PORTVERSION=	0.8
+PORTREVISION=	1
 CATEGORIES=	dns security
 MASTER_SITES=	http://www.validns.net/download/
 
@@ -14,7 +15,6 @@ LICENSE=	BSD2CLAUSE
 LIB_DEPENDS=	libJudy.so:devel/judy
 
 USE_OPENSSL=	yes
-WITH_OPENSSL_PORT=yes
 
 ALL_TARGET=
 
@@ -31,16 +31,14 @@ OPTIONS_DEFINE=	DOCS
 
 .include <bsd.port.options.mk>
 
+.if ${SSL_DEFAULT:Mopenssl-devel}
+BROKEN=		Does not build with openssl-devel
+.endif
+
 do-install:
 	${INSTALL_PROGRAM} ${WRKSRC}/${PORTNAME} ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_DATA} ${WRKSRC}/*.1 ${STAGEDIR}${MAN1PREFIX}/man/man1/
 	@${MKDIR} ${STAGEDIR}${DOCSDIR}
 	@${INSTALL_DATA} ${PORTDOCS:S,^,${WRKSRC}/,} ${STAGEDIR}${DOCSDIR}/
 
-.include <bsd.port.pre.mk>
-
-.if ${SSL_DEFAULT:Mopenssl-devel}
-BROKEN=		Does not build with openssl-devel
-.endif
-
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/ftp/curl/Makefile b/ftp/curl/Makefile
index 6bdeec6c8bc0..86948c45f849 100644
--- a/ftp/curl/Makefile
+++ b/ftp/curl/Makefile
@@ -21,6 +21,7 @@ OPTIONS_RADIO_RESOLV=	CARES THREADED_RESOLVER
 OPTIONS_RADIO_SSL=	GNUTLS NSS OPENSSL POLARSSL WOLFSSL
 OPTIONS_SINGLE_GSSAPI=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE
 OPTIONS_DEFAULT=	CA_BUNDLE COOKIES HTTP2 OPENSSL PROXY RESOLV THREADED_RESOLVER TLS_SRP
+OPTIONS_DEFAULT+=	GSSAPI_${"${SSL_DEFAULT}" == "base":?BASE:NONE}
 CA_BUNDLE_DESC=		Install CA bundle for OpenSSL
 CA_BUNDLE_IMPLIES=	OPENSSL
 COOKIES_DESC=		Cookies support
@@ -33,14 +34,6 @@ SMB_DESC=		SMB/CIFS support
 THREADED_RESOLVER_DESC=	Threaded DNS resolver
 TLS_SRP_DESC=		TLS-SRP (Secure Remote Password) support
 
-.include <${.CURDIR}/../../Mk/bsd.default-versions.mk>
-
-.if ${SSL_DEFAULT} != base
-OPTIONS_DEFAULT+=	GSSAPI_NONE
-.else
-OPTIONS_DEFAULT+=	GSSAPI_BASE
-.endif
-
 CONFIGURE_ARGS=	--disable-werror \
 		--enable-imap --enable-pop3 --enable-rtsp --enable-smtp \
 		--with-zsh-functions-dir=${LOCALBASE}/share/zsh/site-functions \
diff --git a/irc/irssi-fish/Makefile b/irc/irssi-fish/Makefile
index dc529c122529..f2c65f979672 100644
--- a/irc/irssi-fish/Makefile
+++ b/irc/irssi-fish/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	irssi-fish
 DISTVERSION=	1.4.20160122
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	irc security
 
 MAINTAINER=	ashish@FreeBSD.org
@@ -18,15 +18,15 @@ GH_PROJECT=	FiSH-irssi
 GH_ACCOUNT=	falsovsky
 GH_TAGNAME=	2b0c1c09
 
-USES=		cmake pkgconfig
+USES=		cmake pkgconfig ssl
+CMAKE_ARGS=	-D__pkg_config_checked_OPENSSL=1 -DOPENSSL_FOUND=1 \
+		-DOPENSSL_INCLUDE_DIRS=${OPENSSLINC} \
+		-DOPENSSL_LIBRARY_DIRS=${OPENSSLLIB}
 USE_LDCONFIG=	yes
 
 PLIST_FILES=	lib/irssi/modules/libfish.so
 PORTDOCS=	README.md FiSH-irssi.txt
 
-USE_OPENSSL=	yes
-WITH_OPENSSL_PORT=	yes
-
 post-patch:
 	${REINPLACE_CMD} -e "s,/usr/local,${LOCALBASE},g" \
 			 -e "s,share/doc/FiSH-irssi,${DOCSDIR_REL},g" ${WRKSRC}/CMakeLists.txt
diff --git a/net-im/jabberd/Makefile b/net-im/jabberd/Makefile
index 5b44697cc4b4..82fe3335f5b7 100644
--- a/net-im/jabberd/Makefile
+++ b/net-im/jabberd/Makefile
@@ -101,10 +101,6 @@ EXPERIMENTAL_DESC=	Enable experimental features (TLS-Everywhere)
 
 .include <bsd.port.options.mk>
 
-.if ${OPSYS} != FreeBSD
-WITH_OPENSSL_PORT=	yes
-.endif
-
 .if ${PORT_OPTIONS:MPGSQL}
 _REQUIRE+=		postgresql
 .endif
diff --git a/net-mgmt/virt-viewer/Makefile b/net-mgmt/virt-viewer/Makefile
index 3958c406a00e..8c3b0e46d328 100644
--- a/net-mgmt/virt-viewer/Makefile
+++ b/net-mgmt/virt-viewer/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	virt-viewer
 PORTVERSION=	4.0
+PORTREVISION=	1
 CATEGORIES=	net-mgmt
 MASTER_SITES=	http://virt-manager.org/download/sources/${PORTNAME}/
 
@@ -19,9 +20,6 @@ LIB_DEPENDS=	libvirt.so:devel/libvirt \
 		libgtk-vnc-2.0.so:net/gtk-vnc \
 		libspice-client-glib-2.0.so:deskutils/spice-gtk
 
-USE_OPENSSL=yes
-WITH_OPENSSL_PORT=yes
-
 OPTIONS_DEFINE=	NLS
 OPTIONS_SUB=	yes
 
diff --git a/net/freeradius2/Makefile b/net/freeradius2/Makefile
index bbf31d56769f..a53789f61828 100644
--- a/net/freeradius2/Makefile
+++ b/net/freeradius2/Makefile
@@ -29,9 +29,8 @@ CONFLICTS_INSTALL=	gnu-radius-[0-9].* openradius-[0-9].* radiusd-cistron-[0-9].*
 USE_RC_SUBR=	radiusd
 
 GNU_CONFIGURE=	yes
-USES=		autoreconf gmake libtool shebangfix tar:bzip2
+USES=		autoreconf gmake libtool shebangfix ssl tar:bzip2
 SHEBANG_FILES=	scripts/radsqlrelay src/modules/rlm_counter/rad_counter
-USE_OPENSSL=	yes
 CPPFLAGS+=	-I${LOCALBASE}/include
 CFLAGS+=	${CPPFLAGS}
 LIBS+=		-L${LOCALBASE}/lib
@@ -82,7 +81,7 @@ _REQUIRE=	NETWORKING SERVERS
 
 OPTIONS_DEFINE=	USER KERBEROS HEIMDAL HEIMDAL_PORT LDAP MYSQL \
 		PGSQL UNIXODBC FIREBIRD PERL PYTHON OCI8 RUBY DHCP \
-		EXPERIMENTAL UDPFROMTO DEVELOPER EDIR SSL_PORT DOCS
+		EXPERIMENTAL UDPFROMTO DEVELOPER EDIR DOCS
 OPTIONS_DEFAULT=USER PERL PYTHON
 
 DHCP_DESC=		With DHCP support (EXPERIMENTAL)
@@ -96,7 +95,6 @@ EXPERIMENTAL_DESC=	Build experimental modules
 UDPFROMTO_DESC=		Compile in UDPFROMTO support
 DEVELOPER_DESC=		Enable developer options
 EDIR_DESC=		Enable eDirectory support (implies LDAP)
-SSL_PORT_DESC=		Use OpenSSL from the ports collection
 
 .include <bsd.port.options.mk>
 
@@ -285,10 +283,6 @@ CFLAGS!=	${ECHO} ${CFLAGS} | ${SED} -Ee 's:-O[0-9]?[[:space:]]*::g'
 CONFIGURE_ARGS+=--with-udpfromto
 .endif
 
-.if ${PORT_OPTIONS:MSSL_PORT}
-WITH_OPENSSL_PORT=yes
-.endif
-
 .if empty(PORT_OPTIONS:MDOCS)
 CONFIGURE_ARGS+=--without-docdir
 PLIST_SUB+=	PORTDOCS="@comment "
diff --git a/net/freeradius3/Makefile b/net/freeradius3/Makefile
index e8c0d2d88f3e..86f4cf6ab2dd 100644
--- a/net/freeradius3/Makefile
+++ b/net/freeradius3/Makefile
@@ -43,7 +43,7 @@ OPTIONS_SUB=	yes
 OPTIONS_DEFINE=	USER KERBEROS HEIMDAL HEIMDAL_PORT LDAP MYSQL \
 		PGSQL UNIXODBC FIREBIRD REDIS PYTHON RUBY \
 		EXPERIMENTAL UDPFROMTO DEVELOPER EDIR PERL REST \
-		FREETDS IDN SSL_PORT DOCS SQLITE3
+		FREETDS IDN DOCS SQLITE3
 OPTIONS_DEFAULT=USER PERL
 
 USER_DESC=		Run as user freeradius, group freeradius
@@ -56,7 +56,6 @@ UDPFROMTO_DESC=		Compile in UDPFROMTO support
 DEVELOPER_DESC=		Enable developer options
 EDIR_DESC=		Enable eDirectory support (implies LDAP)
 REST_DESC=		Enable RESTful API support
-SSL_PORT_DESC=		Use OpenSSL from the ports collection
 
 SQLITE3_CONFIGURE_WITH=rlm_sql_sqlite
 SQLITE3_LIB_DEPENDS=	libsqlite3.so:databases/sqlite3
@@ -282,10 +281,6 @@ CONFIGURE_ARGS+=--quiet
 CONFIGURE_ARGS+=--with-udpfromto
 .endif
 
-.if ${PORT_OPTIONS:MSSL_PORT}
-WITH_OPENSSL_PORT=yes
-.endif
-
 .include <bsd.port.pre.mk>
 
 # if we're installing, place sample configs into ${EXAMPLESDIR}
diff --git a/security/opencryptoki/Makefile b/security/opencryptoki/Makefile
index d22569cd8264..822b278a3121 100644
--- a/security/opencryptoki/Makefile
+++ b/security/opencryptoki/Makefile
@@ -18,9 +18,6 @@ LIB_DEPENDS=	libtspi.so:security/trousers
 
 USES=		alias autoreconf gmake libtool ssl tar:tgz
 USE_LDCONFIG=	${PREFIX}/lib/opencryptoki
-.if exists(/usr/include/openssl/md2.h)
-WITH_OPENSSL_PORT=yes
-.endif
 WRKSRC=		${WRKDIR}/${PORTNAME}
 INSTALL_TARGET=	install-strip
 GNU_CONFIGURE=	yes
diff --git a/security/softhsm2/Makefile b/security/softhsm2/Makefile
index c756becb1367..63426f3985d0 100644
--- a/security/softhsm2/Makefile
+++ b/security/softhsm2/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	softhsm
 PORTVERSION=	2.2.0
+PORTREVISION=	1
 CATEGORIES=	security
 MASTER_SITES=	http://dist.opendnssec.org/source/ \
 		http://dist.opendnssec.org/source/testing/
@@ -35,13 +36,12 @@ OPTIONS_DEFAULT=	CRYP_OPEN
 CRYP_BOTAN_CONFIGURE_ON=	--with-crypto-backend=botan
 CRYP_BOTAN_LIB_DEPENDS=	libbotan-1.10.so:security/botan110
 CRYP_OPEN_USE=		openssl=yes
-CRYP_OPEN_VARS=		WITH_OPENSSL_PORT=yes
 CRYP_OPEN_CONFIGURE_ON=	--with-crypto-backend=openssl
 
-.include <bsd.port.pre.mk>
+.include <bsd.port.options.mk>
 
 .if ${SSL_DEFAULT:Mlibressl*}
 CONFIGURE_ARGS+=	--disable-gost
 .endif
 
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/sysutils/ori/Makefile b/sysutils/ori/Makefile
index a7ef75164db9..42d678a956bf 100644
--- a/sysutils/ori/Makefile
+++ b/sysutils/ori/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	ori
 PORTVERSION=	0.8.1
-PORTREVISION=	5
+PORTREVISION=	6
 CATEGORIES=	sysutils net
 MASTER_SITES=	http://cdn.bitbucket.org/orifs/ori/downloads/
 
@@ -13,9 +13,10 @@ COMMENT=	Ori distributed file system
 LIB_DEPENDS=	libevent.so:devel/libevent2 \
 		libboost_date_time.so:devel/boost-libs
 
-USES=		execinfo fuse pkgconfig scons tar:xz
-USE_OPENSSL=	yes
-WITH_OPENSSL_PORT=	yes
+USES=		execinfo fuse pkgconfig scons ssl tar:xz
+CPPFLAGS+=	-I${OPENSSLINC}
+LDFLAGS+=	-L${OPENSSLLIB} -lcrypto
+MAKE_ARGS=	VERBOSE=1
 
 PLIST_FILES=	bin/ori \
 		bin/oridbg \
diff --git a/sysutils/ori/files/patch-SConstruct b/sysutils/ori/files/patch-SConstruct
new file mode 100644
index 000000000000..20224d3e8d08
--- /dev/null
+++ b/sysutils/ori/files/patch-SConstruct
@@ -0,0 +1,18 @@
+--- SConstruct.orig	2014-01-17 06:40:03 UTC
++++ SConstruct
+@@ -302,15 +302,6 @@ if (env["WITH_MDNS"]) and (sys.platform 
+ 	print 'Please install libdns_sd'
+ 	Exit(1)
+ 
+-if env["HAS_PKGCONFIG"]:
+-    if not conf.CheckPkg("openssl"):
+-        print 'openssl is not registered in pkg-config'
+-        Exit(1)
+-    if not conf.CheckPkgMinVersion("openssl", "1.0.0"):
+-        print 'openssl version 1.0.0 or above required'
+-        Exit(1)
+-    env.ParseConfig('pkg-config --libs --cflags openssl')
+-
+ conf.Finish()
+ 
+ Export('env')
diff --git a/sysutils/syslog-ng36/Makefile b/sysutils/syslog-ng36/Makefile
index ec0d62985d27..25cb40b14b52 100644
--- a/sysutils/syslog-ng36/Makefile
+++ b/sysutils/syslog-ng36/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	syslog-ng
 PORTVERSION=	3.6.4
+PORTREVISION=	1
 .if !defined(MASTERDIR)
 PKGNAMESUFFIX=	36
 .endif
@@ -52,8 +53,7 @@ CONFIGURE_ARGS=	--sysconfdir=${LOCALBASE}/etc --localstatedir=/var/db \
 .include <bsd.port.options.mk>
 
 .if ${PORT_OPTIONS:MOPENSSL}
-USE_OPENSSL=		yes
-WITH_OPENSSL_PORT=	yes
+USES+=			ssl
 CONFIGURE_ARGS+=	--enable-ssl
 CONFIGURE_ENV+=		OPENSSL_CFLAGS="-I${OPENSSLINC}" \
 			OPENSSL_LIBS="-L${OPENSSLLIB} -lcrypto -lssl"
diff --git a/www/mod_tsa/Makefile b/www/mod_tsa/Makefile
index 15d507399925..05e32bf6de97 100644
--- a/www/mod_tsa/Makefile
+++ b/www/mod_tsa/Makefile
@@ -3,7 +3,7 @@
 
 PORTNAME=	mod_tsa
 PORTVERSION=	1.0
-PORTREVISION=	3
+PORTREVISION=	4
 CATEGORIES=	www
 MASTER_SITES=	http://am.nesiac.org/static/ \
 		http://ubique.spb.ru/src/
@@ -21,8 +21,7 @@ CONFIGURE_ARGS=	--with-openssl-incdir=${OPENSSLINC} \
 				--with-apxs=${APXS}
 MAKE_ARGS+=	APXS=${APXS}
 
-USE_OPENSSL=	yes
-WITH_OPENSSL_PORT=	yes
+USES=		ssl
 USE_APACHE=	22+
 AP_EXTRAS+=	-DMOD_TSA_VERSION=\\\"mod_tsa/${PORTVERSION}\\\"
 AP_FAST_BUILD=	yes
@@ -51,7 +50,7 @@ AP_LIB+=	-lpq
 .endif
 
 .if ${PORT_OPTIONS:MFIREBIRD}
-USE+=			firebird
+USES+=			firebird
 CONFIGURE_ARGS+=	--enable-firebird=yes
 SRC_FILE+=	db_firebird.c
 AP_LIB+=	-lgds
diff --git a/www/nginx-devel/Makefile b/www/nginx-devel/Makefile
index a539babe4c17..58dd494f03ec 100644
--- a/www/nginx-devel/Makefile
+++ b/www/nginx-devel/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	nginx
 PORTVERSION=	1.11.9
+PORTREVISION=	1
 CATEGORIES=	www
 MASTER_SITES=	http://nginx.org/download/
 MASTER_SITES+=	LOCAL/osa
@@ -450,6 +451,9 @@ CONFIGURE_ARGS+=--add-module=${WRKSRC_ct}
 .endif
 NGINX_OPENSSL=	yes
 USE_HTTP_SSL=	yes
+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1100085 && ${SSL_DEFAULT} == base
+IGNORE=		CT option requires OpenSSL 1.0.2, add DEFAULT_VERSIONS+=ssl=openssl to /etc/make.conf
+.endif
 .endif
 
 .if ${PORT_OPTIONS:MECHO}
@@ -1173,10 +1177,7 @@ USERS?=	${WWWOWN}
 GROUPS?=${WWWGRP}
 
 .if defined(NGINX_OPENSSL)
-USE_OPENSSL=	yes
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1100000
-WITH_OPENSSL_PORT=yes
-.endif
+USES+=		ssl
 .endif
 
 pre-everything::
diff --git a/www/nginx/Makefile b/www/nginx/Makefile
index 870ac3350c94..28e5ffe0d451 100644
--- a/www/nginx/Makefile
+++ b/www/nginx/Makefile
@@ -3,6 +3,7 @@
 
 PORTNAME=	nginx
 PORTVERSION=	1.10.3
+PORTREVISION=	1
 PORTEPOCH=	2
 CATEGORIES=	www
 MASTER_SITES=	http://nginx.org/download/
@@ -445,6 +446,9 @@ CONFIGURE_ARGS+=--add-module=${WRKSRC_ct}
 .endif
 NGINX_OPENSSL=	yes
 USE_HTTP_SSL=	yes
+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1100085 && ${SSL_DEFAULT} == base
+IGNORE=		CT option requires OpenSSL 1.0.2, add DEFAULT_VERSIONS+=ssl=openssl to /etc/make.conf
+.endif
 .endif
 
 .if ${PORT_OPTIONS:MECHO}
@@ -1157,9 +1161,9 @@ USERS?=	${WWWOWN}
 GROUPS?=${WWWGRP}
 
 .if defined(NGINX_OPENSSL)
-USE_OPENSSL=	yes
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1100000
-WITH_OPENSSL_PORT=yes
+USES+=		ssl
+.if ${SSL_DEFAULT:Mopenssl-devel}
+BROKEN=		Does not build with openssl-devel
 .endif
 .endif
 
@@ -1365,10 +1369,4 @@ post-install:
 	${CAT} ${WRKSRC}/conf/nginx.conf \
 		>>${STAGEDIR}${ETCDIR}/nginx.conf-dist
 
-.include <bsd.port.pre.mk>
-
-.if defined(NGINX_OPENSSL) && ${SSL_DEFAULT:Mopenssl-devel}
-BROKEN=		Does not build with openssl-devel
-.endif
-
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/www/node/Makefile b/www/node/Makefile
index fb9b9ba3e496..5cd175fb769c 100644
--- a/www/node/Makefile
+++ b/www/node/Makefile
@@ -3,6 +3,7 @@
 PORTNAME=	node
 PORTVERSION=	7.5.0
 DISTVERSIONPREFIX=	v
+PORTREVISION=	1
 CATEGORIES=	www
 MASTER_SITES=	http://nodejs.org/dist/v${PORTVERSION}/
 
@@ -13,7 +14,7 @@ LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 OPTIONS_DEFINE=	BUNDLED_SSL DOCS NLS DTRACE
-OPTIONS_DEFAULT=	DTRACE
+OPTIONS_DEFAULT=BUNDLED_SSL DTRACE
 OPTIONS_SUB=	yes
 
 .if !exists(/usr/sbin/dtrace)
@@ -57,21 +58,18 @@ LIB_DEPENDS+=	libcares.so:dns/c-ares\
 
 .if empty(PORT_OPTIONS:MBUNDLED_SSL)
 
-.if ${OSVERSION} < 1100085
-# node.js requires openssl 1.0.2, use the port since base isn't new enough
-WITH_OPENSSL_PORT=	yes
+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1100085 && ${SSL_DEFAULT} == base
+IGNORE=		node.js requires openssl 1.0.2, add DEFAULT_VERSIONS+=ssl=openssl to /etc/make.conf or enable BUNDLED_SSL option
 .endif
 
-.endif
-
-.include <bsd.port.pre.mk>
-
-.if empty(PORT_OPTIONS:MBUNDLED_SSL)
 .if !empty(SSL_DEFAULT:Mlibressl*)
 IGNORE=		cannot build node.js with LibreSSL. You must enable BUNDLED_SSL
 .endif
+
 .endif
 
+.include <bsd.port.pre.mk>
+
 .if ${ARCH} == "armv6"
 CONFIGURE_ARGS+=--openssl-no-asm
 .endif
diff --git a/www/node4/Makefile b/www/node4/Makefile
index 5cd7c20aef2d..6aa16c0c2c03 100644
--- a/www/node4/Makefile
+++ b/www/node4/Makefile
@@ -4,6 +4,7 @@
 PORTNAME=	node
 PORTVERSION=	4.7.3
 DISTVERSIONPREFIX=	v
+PORTREVISION=	1
 CATEGORIES=	www
 MASTER_SITES=	http://nodejs.org/dist/v${PORTVERSION}/
 PKGNAMESUFFIX=	4
@@ -15,6 +16,7 @@ LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 OPTIONS_DEFINE=	BUNDLED_SSL DOCS NLS
+OPTIONS_DEFAULT=BUNDLED_SSL
 OPTIONS_SUB=	yes
 
 BUNDLED_SSL_DESC=		Use node.js's bundled OpenSSL implementation #'
@@ -45,19 +47,14 @@ LIB_DEPENDS+=	libuv.so:devel/libuv
 
 .if empty(PORT_OPTIONS:MBUNDLED_SSL)
 
-.if ${OSVERSION} < 1100085
-# node.js requires openssl 1.0.2, use the port since base isn't new enough
-WITH_OPENSSL_PORT=yes
+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1100085 && ${SSL_DEFAULT} == base
+IGNORE=		node.js requires openssl 1.0.2, add DEFAULT_VERSIONS+=ssl=openssl to /etc/make.conf or enable BUNDLED_SSL option
 .endif
 
-.endif
-
-.include <bsd.port.pre.mk>
-
-.if empty(PORT_OPTIONS:MBUNDLED_SSL)
 .if !empty(SSL_DEFAULT:Mlibressl*)
 IGNORE=		cannot build node.js with LibreSSL. You must enable BUNDLED_SSL
 .endif
+
 .endif
 
 post-patch:
@@ -89,4 +86,4 @@ post-configure:
 post-install:
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/node
 
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/www/node6/Makefile b/www/node6/Makefile
index 5b0b9d13365a..b16436ed1977 100644
--- a/www/node6/Makefile
+++ b/www/node6/Makefile
@@ -3,6 +3,7 @@
 PORTNAME=	node
 PORTVERSION=	6.9.5
 DISTVERSIONPREFIX=	v
+PORTREVISION=	1
 CATEGORIES=	www
 MASTER_SITES=	http://nodejs.org/dist/v${PORTVERSION}/
 PKGNAMESUFFIX=	6
@@ -14,7 +15,7 @@ LICENSE=	MIT
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 OPTIONS_DEFINE=	BUNDLED_SSL DOCS NLS DTRACE
-OPTIONS_DEFAULT=	DTRACE
+OPTIONS_DEFAULT=BUNDLED_SSL DTRACE
 OPTIONS_SUB=	yes
 
 .if !exists(/usr/sbin/dtrace)
@@ -58,21 +59,18 @@ LIB_DEPENDS+=	libcares.so:dns/c-ares\
 
 .if empty(PORT_OPTIONS:MBUNDLED_SSL)
 
-.if ${OSVERSION} < 1100085
-# node.js requires openssl 1.0.2, use the port since base isn't new enough
-WITH_OPENSSL_PORT=	yes
+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1100085 && ${SSL_DEFAULT} == base
+IGNORE=		node.js requires openssl 1.0.2, add DEFAULT_VERSIONS+=ssl=openssl to /etc/make.conf or enable BUNDLED_SSL option
 .endif
 
-.endif
-
-.include <bsd.port.pre.mk>
-
-.if empty(PORT_OPTIONS:MBUNDLED_SSL)
 .if !empty(SSL_DEFAULT:Mlibressl*)
 IGNORE=		cannot build node.js with LibreSSL. You must enable BUNDLED_SSL
 .endif
+
 .endif
 
+.include <bsd.port.pre.mk>
+
 .if ${ARCH} == "armv6"
 CONFIGURE_ARGS+=--openssl-no-asm
 .endif