35 files changed, 95 insertions, 88 deletions

diff --git a/archivers/py-borgbackup/Makefile b/archivers/py-borgbackup/Makefile
index 47628c09d7d1..1fe961e37962 100644
--- a/archivers/py-borgbackup/Makefile
+++ b/archivers/py-borgbackup/Makefile
@@ -27,17 +27,19 @@ USES=		python:3.4+
 USE_PYTHON=	autoplist distutils
 USE_OPENSSL=	yes
 
-.include <bsd.port.pre.mk>
-
-.if defined(PACKAGE_BUILDING) && ${PYTHON_VER} != ${PYTHON_DEFAULT}
-IGNORE=	you have python ${PYTHON_DEFAULT} set as the default, and this needs ${PYTHON_VER}
-.endif
+.include <bsd.port.options.mk>
 
 # borg requires openssl>=1.0.0
 .if ${OSVERSION} < 1000015
 WITH_OPENSSL_PORT=yes
 .endif
 
+.include <bsd.port.pre.mk>
+
+.if defined(PACKAGE_BUILDING) && ${PYTHON_VER} != ${PYTHON_DEFAULT}
+IGNORE=	you have python ${PYTHON_DEFAULT} set as the default, and this needs ${PYTHON_VER}
+.endif
+
 post-install:
 	${STRIP_CMD} ${STAGEDIR}${PYTHONPREFIX_SITELIBDIR}/borg/*.so
 
diff --git a/databases/mariadb101-server/Makefile b/databases/mariadb101-server/Makefile
index 0f372485ec37..39de1ebf62a8 100644
--- a/databases/mariadb101-server/Makefile
+++ b/databases/mariadb101-server/Makefile
@@ -144,12 +144,12 @@ post-install:
 		${STAGEDIR}/${PREFIX}/share/pkgconfig
 .endif # defined(CLIENT_ONLY)
 
-.if defined(WITH_OPENSSL_PORT)
-GSSAPI_BASE_IGNORE=	BASE_GSSAPI is not compatible with OpenSSL from ports. Use other GSSAPI options or OpenSSL from base system
-.endif
-
 .include <bsd.port.pre.mk>
 
+.if ${SSL_DEFAULT} != base && ${PORT_OPTIONS:MGSSAPI_BASE}
+IGNORE=		BASE_GSSAPI is not compatible with OpenSSL from ports. Use other GSSAPI options or OpenSSL from base system
+.endif
+
 .if ${OPSYS} == DragonFly
 CMAKE_ARGS+=	-DWITHOUT_TOKUDB
 .endif
diff --git a/databases/mysql57-server/Makefile b/databases/mysql57-server/Makefile
index 5d8cf9406fc6..17814ba635fb 100644
--- a/databases/mysql57-server/Makefile
+++ b/databases/mysql57-server/Makefile
@@ -129,7 +129,7 @@ PERFSCHM_SUB_LIST+=	PERFSCHEMRC=""
 PERFSCHM_SUB_LIST_OFF+=	PERFSCHEMRC="--skip-performance-schema"
 .endif
 
-.include <bsd.port.pre.mk>
+.include <bsd.port.options.mk>
 
 ### Just for the sake of FreeBSD 9.X ###
 .if ${OPSYS} == FreeBSD && ${OSVERSION} < 1000000
@@ -137,10 +137,14 @@ PERFSCHM_SUB_LIST_OFF+=	PERFSCHEMRC="--skip-performance-schema"
 EXTRA_PATCHES+=		${PATCHDIR}/rapid_plugin-patch-_x_mysqlxtest__src_mysqlxtest.cc
 .endif
 WITH_OPENSSL_PORT=	yes
+CMAKE_ARGS+=		-DWITH_SSL=${OPENSSLBASE}
+.endif
+
+.include <bsd.port.pre.mk>
 
 ### FreeBSD Version > 9.X ###
-.else
-.if defined(WITH_OPENSSL_BASE)
+.if ${OPSYS} == FreeBSD && ${OSVERSION} > 1000000
+.if ${SSL_DEFAULT} == base
 CMAKE_ARGS+=		-DWITH_SSL=system
 .else
 CMAKE_ARGS+=		-DWITH_SSL=${OPENSSLBASE}
diff --git a/devel/libgit2/Makefile b/devel/libgit2/Makefile
index 0267e18f331f..89fad80bf2d0 100644
--- a/devel/libgit2/Makefile
+++ b/devel/libgit2/Makefile
@@ -40,7 +40,7 @@ BROKEN_sparc64=	does not install: thread-local storage not supported
 post-patch:
 	@${REINPLACE_CMD} -e "s|/pkgconfig|/../libdata/pkgconfig|; \
 		/LIBGIT2_PC_REQUIRES.*zlib/ d" ${WRKSRC}/CMakeLists.txt
-.if defined(WITH_OPENSSL_BASE)
+.if ${SSL_DEFAULT} == base
 	@${REINPLACE_CMD} -e "/LIBGIT2_PC_REQUIRES.*openssl/ d" \
 		${WRKSRC}/CMakeLists.txt
 .endif
diff --git a/devel/libopkele/Makefile b/devel/libopkele/Makefile
index fd34fbfb5186..938ac8192843 100644
--- a/devel/libopkele/Makefile
+++ b/devel/libopkele/Makefile
@@ -41,7 +41,7 @@ USE_OPENSSL=	yes
 post-patch:
 	@ ${REINPLACE_CMD} -e "s|pkgconfigdir =.*|pkgconfigdir = ${PREFIX}/libdata/pkgconfig|g" \
 	    ${WRKSRC}/Makefile.in
-.if !defined(WITH_OPENSSL_PORT)
+.if ${SSL_DEFAULT} == base
 	@ ${REINPLACE_CMD} -e "s|Requires: openssl|Requires:|" ${WRKSRC}/libopkele.pc.in
 .endif
 
diff --git a/devel/thrift-cpp/Makefile b/devel/thrift-cpp/Makefile
index 921af9910cd4..68e9d49d69f3 100644
--- a/devel/thrift-cpp/Makefile
+++ b/devel/thrift-cpp/Makefile
@@ -47,7 +47,7 @@ CONFIGURE_ARGS+=	\
 
 .include <bsd.port.pre.mk>
 
-.if !defined(WITH_OPENSSL_PORT) && \
+.if ${SSL_DEFAULT} == base && \
 	${OPSYS} == FreeBSD && ${OSVERSION} < 1000015
 # src/thrift/transport/TSSLSocket.cpp:147: error: 'TLSv1_1_method' was not declared in this scope
 # src/thrift/transport/TSSLSocket.cpp:149: error: 'TLSv1_2_method' was not declared in this scope
diff --git a/dns/bind9-devel/Makefile b/dns/bind9-devel/Makefile
index be28746954dc..63a929311127 100644
--- a/dns/bind9-devel/Makefile
+++ b/dns/bind9-devel/Makefile
@@ -207,9 +207,9 @@ PORTDOCS=	*
 
 .include <bsd.port.pre.mk>
 
-.if ( ${PORT_OPTIONS:MGOST} || ${PORT_OPTIONS:MGOST_ASN1} ) && defined(WITH_OPENSSL_BASE)
+.if ( ${PORT_OPTIONS:MGOST} || ${PORT_OPTIONS:MGOST_ASN1} ) && ${SSL_DEFAULT} == base
 BROKEN=	OpenSSL from the base system does not support GOST, add \
-	WITH_OPENSSL_PORT=yes to your /etc/make.conf and rebuild everything \
+	DEFAULT_VERSIONS+=ssl=openssl to your /etc/make.conf and rebuild everything \
 	that needs SSL.
 .endif
 
diff --git a/dns/bind910/Makefile b/dns/bind910/Makefile
index eff02f45ee30..a82981bc08f2 100644
--- a/dns/bind910/Makefile
+++ b/dns/bind910/Makefile
@@ -232,9 +232,9 @@ PORTDOCS=	*
 
 .include <bsd.port.pre.mk>
 
-.if ( ${PORT_OPTIONS:MGOST} || ${PORT_OPTIONS:MGOST_ASN1} ) && defined(WITH_OPENSSL_BASE)
+.if ( ${PORT_OPTIONS:MGOST} || ${PORT_OPTIONS:MGOST_ASN1} ) && ${SSL_DEFAULT} == base
 BROKEN=	OpenSSL from the base system does not support GOST, add \
-	WITH_OPENSSL_PORT=yes to your /etc/make.conf and rebuild everything \
+	DEFAULT_VERSIONS+=ssl=openssl to your /etc/make.conf and rebuild everything \
 	that needs SSL.
 .endif
 
diff --git a/dns/bind99/Makefile b/dns/bind99/Makefile
index ddd3e6129f15..7d4065a69e22 100644
--- a/dns/bind99/Makefile
+++ b/dns/bind99/Makefile
@@ -191,9 +191,9 @@ PORTDOCS=	*
 
 .include <bsd.port.pre.mk>
 
-.if ( ${PORT_OPTIONS:MGOST} ) && defined(WITH_OPENSSL_BASE)
+.if ( ${PORT_OPTIONS:MGOST} ) && ${SSL_DEFAULT} == base
 BROKEN=	OpenSSL from the base system does not support GOST, add \
-	WITH_OPENSSL_PORT=yes to your /etc/make.conf and rebuild everything \
+	DEFAULT_VERSIONS+=ssl=openssl to your /etc/make.conf and rebuild everything \
 	that needs SSL.
 .endif
 
diff --git a/emulators/virtualbox-ose/Makefile b/emulators/virtualbox-ose/Makefile
index 504b6521321b..f7ad1e0d2a8b 100644
--- a/emulators/virtualbox-ose/Makefile
+++ b/emulators/virtualbox-ose/Makefile
@@ -209,7 +209,7 @@ EXTRA_PATCHES+=	${PATCHDIR}/extrapatch-Config.kmk \
 		${PATCHDIR}/extrapatch-src-recompiler-Makefile.kmk
 .endif
 
-.if !defined(WITH_OPENSSL_BASE)
+.if ${SSL_DEFAULT} != base
 CONFIGURE_ARGS+=	--with-openssl-dir="${OPENSSLBASE}"
 .endif
 
diff --git a/ftp/curl/Makefile b/ftp/curl/Makefile
index 890067ac0361..9ce59ff60b76 100644
--- a/ftp/curl/Makefile
+++ b/ftp/curl/Makefile
@@ -32,7 +32,10 @@ THREADED_RESOLVER_DESC=	Threaded DNS resolver
 TLS_SRP_DESC=		TLS-SRP (Secure Remote Password) support
 
 LOCALBASE?=	/usr/local
-.if defined(WITH_OPENSSL_PORT) || (!defined(WITH_OPENSSL_BASE) && exists(${LOCALBASE}/lib/libcrypto.so))
+
+.include <${PORTSDIR}/Mk/bsd.default-versions.mk>
+
+.if ${SSL_DEFAULT} != base
 OPTIONS_DEFAULT+=	GSSAPI_NONE
 .else
 OPTIONS_DEFAULT+=	GSSAPI_BASE
@@ -148,11 +151,11 @@ IGNORE=		only supports TLS-SRP with either OpenSSL or GnuTLS
 IGNORE=		only supports LDAPS with SSL
 .endif
 
-.if ${PORT_OPTIONS:MGSSAPI_BASE} && ${PORT_OPTIONS:MOPENSSL} && (defined(WITH_OPENSSL_PORT) || (!defined(WITH_OPENSSL_BASE) && exists(${LOCALBASE}/lib/libcrypto.so)))
+.if ${PORT_OPTIONS:MGSSAPI_BASE} && ${PORT_OPTIONS:MOPENSSL} && ${SSL_DEFAULT} != base
 IGNORE=		GSSAPI_BASE is not compatible with OpenSSL from ports. Use other GSSAPI options or OpenSSL from base system
 .endif
 
-.if defined(OPENSSL_PORT) && ${OPENSSL_PORT} == "security/libressl"
+.if ${SSL_DEFAULT} == libressl
 .if ${PORT_OPTIONS:MGSSAPI_BASE} && ${PORT_OPTIONS:MOPENSSL}
 IGNORE=		GSSAPI_BASE is not compatible with LibreSSL. Use other GSSAPI options
 .endif
diff --git a/mail/deforaos-mailer/Makefile b/mail/deforaos-mailer/Makefile
index d701b3c45113..b27c89f1dd50 100644
--- a/mail/deforaos-mailer/Makefile
+++ b/mail/deforaos-mailer/Makefile
@@ -36,7 +36,7 @@ DOCS_BUILD_DEPENDS=	xsltproc:textproc/libxslt \
 
 .include <bsd.port.pre.mk>
 
-.if defined(WITH_OPENSSL_BASE)
+.if ${SSL_DEFAULT} == base
 # openssl from base doesn't install a .pc file and pkg-config didn't like it
 CONFIGURE_ENV+=	libssl_CFLAGS="-I${OPENSSLINC}" libssl_LIBS="-L${OPENSSLLIB} -lssl"
 .endif
diff --git a/mail/dk-milter/Makefile b/mail/dk-milter/Makefile
index a717b0c87ad1..b0414675b52e 100644
--- a/mail/dk-milter/Makefile
+++ b/mail/dk-milter/Makefile
@@ -85,7 +85,7 @@ SITE_SUB+=	-e '\|bld_USE_ARLIB|s/^dnl //g'
 SITE_SUB+=	-e '/-DPOPAUTH/s/^dnl //g'
 .endif
 
-.if defined(WITH_OPENSSL_BASE)
+.if ${SSL_DEFAULT} == base
 SITE_SUB+=	-e 's|%%OPENSSL%%|dnl |g'
 .else
 SITE_SUB+=	-e 's|%%OPENSSL%%||g' \
diff --git a/mail/sendmail/Makefile b/mail/sendmail/Makefile
index bdaed988d0d6..608babd8edb2 100644
--- a/mail/sendmail/Makefile
+++ b/mail/sendmail/Makefile
@@ -310,7 +310,7 @@ help:
 .include <bsd.port.pre.mk>
 
 .if ${PORT_OPTIONS:MTLS}
-.if !defined(WITH_OPENSSL_BASE)
+.if ${SSL_DEFAULT} != base
 SITE+=	${FILESDIR}/site.config.m4.ssl
 .endif
 SITE+=	${FILESDIR}/site.config.m4.tls
diff --git a/net-im/telepathy-gabble/Makefile b/net-im/telepathy-gabble/Makefile
index 1b8e448ba771..db27193595cf 100644
--- a/net-im/telepathy-gabble/Makefile
+++ b/net-im/telepathy-gabble/Makefile
@@ -33,7 +33,9 @@ INSTALL_TARGET=	install-strip
 
 PLIST_SUB=	PVERSION=${PORTVERSION}
 
-.if defined(WITH_OPENSSL_BASE)
+.include <bsd.port.pre.mk>
+
+.if ${SSL_DEFAULT} == base
 CONFIGURE_ENV+=	OPENSSL_LIBS="-L/usr/lib -ssl -crypto" OPENSSL_CFLAGS="-I/usr/include"
 .endif
 
@@ -41,4 +43,4 @@ post-patch:
 	@${REINPLACE_CMD} -e 's|-Werror||g' \
 		${WRKSRC}/lib/ext/wocky/configure
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/net-im/telepathy-idle/Makefile b/net-im/telepathy-idle/Makefile
index b20a1ee5dc02..48c2d878757b 100644
--- a/net-im/telepathy-idle/Makefile
+++ b/net-im/telepathy-idle/Makefile
@@ -23,7 +23,7 @@ INSTALL_TARGET=	install-strip
 
 .include <bsd.port.pre.mk>
 
-.if defined(WITH_OPENSSL_BASE)
+.if ${SSL_DEFAULT} == base
 CONFIGURE_ENV+=	OPENSSL_LIBS="-L/usr/lib -lssl -lcrypto" OPENSSL_CFLAGS="-I/usr/include"
 .endif
 
diff --git a/net-mgmt/net-snmp/Makefile b/net-mgmt/net-snmp/Makefile
index e8070f9af1d4..0011145aeaa3 100644
--- a/net-mgmt/net-snmp/Makefile
+++ b/net-mgmt/net-snmp/Makefile
@@ -215,7 +215,7 @@ CONFLICTS=	ucd-snmp-4.* net-snmp-5.3.*
 
 .include <bsd.port.pre.mk>
 
-.if defined(WITH_OPENSSL_PORT) || defined(OPENSSL_PORT)
+.if ${SSL_DEFAULT} != base
 LCRYPTO=	-lcrypto
 .else
 LCRYPTO=
diff --git a/net-mgmt/zabbix3-server/Makefile b/net-mgmt/zabbix3-server/Makefile
index d87e0d67a561..1b1a2425de5a 100644
--- a/net-mgmt/zabbix3-server/Makefile
+++ b/net-mgmt/zabbix3-server/Makefile
@@ -150,10 +150,10 @@ GNUTLS_LIB_DEPENDS=     libgnutls.so:security/gnutls
 POLARSSL_CONFIGURE_WITH=mbedtls
 POLARSSL_LIB_DEPENDS=	libmbedtls.so:security/polarssl13
 
-.include <bsd.port.options.mk>
+.include <bsd.port.pre.mk>
 
-.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1000000 && !defined(WITH_OPENSSL_PORT)
-IGNORE=   OpenSSL from the base system is too old, add WITH_OPENSSL_PORT to your /etc/make.conf and rebuild everything that needs SSL.
+.if ${OPSYS} == FreeBSD && ${OSVERSION} < 1000000 && ${SSL_DEFAULT} == base
+IGNORE=   OpenSSL from the base system is too old, add DEFAULT_VERSIONS+=ssl=openssl to your /etc/make.conf and rebuild everything that needs SSL.
 .endif
 
 post-patch:
@@ -192,6 +192,8 @@ post-install:
 		${COPYTREE_SHARE} "ibm_db2 mysql oracle postgresql sqlite3" \
 		${STAGEDIR}${DATADIR}/${ZABBIX_BUILD:Q}/database/)
 .endif
+.else # frontend
+.include <bsd.port.pre.mk>
 .endif
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/net/hostapd/Makefile b/net/hostapd/Makefile
index b12ea5276374..f7fa07011982 100644
--- a/net/hostapd/Makefile
+++ b/net/hostapd/Makefile
@@ -24,16 +24,16 @@ OPTIONS_DEFINE=	PORTS_SSL
 
 PORTS_SSL_DESC= Build with OpenSSL from ports (instead of base system)
 
-.include <bsd.port.options.mk>
+.include <bsd.port.pre.mk>
 
 .if ${PORT_OPTIONS:MPORTS_SSL}
-.if !defined(WITH_OPENSSL_PORT)
-IGNORE=		the PORTS_SSL option not allowed when WITH_OPENSSL_PORT is not set
+.if ${SSL_DEFAULT} == base
+IGNORE=		the PORTS_SSL option not allowed when using SSL from base
 .endif
 CONFIGURE_ARGS+= --with-ssl-dir=${PREFIX}
 .else
-.if defined(WITH_OPENSSL_PORT)
-IGNORE=		the PORTS_SSL option is required when WITH_OPENSSL_PORT is set
+.if ${SSL_DEFAULT} != base
+IGNORE=		the PORTS_SSL option is required when using SSL from ports
 .endif
 .endif
 
@@ -52,4 +52,4 @@ do-install:
 	${INSTALL_MAN} ${WRKSRC}/hostapd/hostapd.8 \
 		${STAGEDIR}${MANPREFIX}/man/man8
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/net/openldap24-server/Makefile b/net/openldap24-server/Makefile
index efb6e65e5d9c..253aebe3b589 100644
--- a/net/openldap24-server/Makefile
+++ b/net/openldap24-server/Makefile
@@ -189,14 +189,6 @@ CONFIGURE_ARGS=		--with-threads=posix \
 # XXX FreeBSD does not implement O_DSYNC and fdatasync at this time.
 CFLAGS+=		-DMDB_DSYNC=O_SYNC -Dfdatasync=fsync
 
-.if !${PORT_OPTIONS:MFETCH}
-CONFIGURE_ARGS+=	--without-fetch
-.else
-. if defined(OPENSSL_INSTALLED) && ${OPENSSL_INSTALLED} != "" || defined(WITH_OPENSSL_PORT)
-BROKEN=	using OpenSSL from ports and OPTION FETCH together is not supported
-. endif
-.endif
-
 .if ${PORT_OPTIONS:MSASL}
 LIB_DEPENDS+=		libsasl2.so:security/cyrus-sasl2
 CONFIGURE_ARGS+=	--with-cyrus-sasl
@@ -512,6 +504,16 @@ PLIST_SUB+=		SHLIB_MAJOR=${OPENLDAP_SHLIB_MAJOR}
 PLIST_SUB+=		SHLIB_MINOR=${OPENLDAP_SHLIB_MINOR}
 PLIST_SUB+=		OPENLDAP_MAJOR=${OPENLDAP_MAJOR}
 
+.include <bsd.port.pre.mk>
+
+.if !${PORT_OPTIONS:MFETCH}
+CONFIGURE_ARGS+=	--without-fetch
+.else
+. if defined(OPENSSL_INSTALLED) && ${OPENSSL_INSTALLED} != "" || ${SSL_DEFAULT} != base
+BROKEN=	using OpenSSL from ports and OPTION FETCH together is not supported
+. endif
+.endif
+
 post-patch:
 	@${REINPLACE_CMD} -e 's|%LOCALSTATEDIR%/run/|${LDAP_RUN_DIR}/|g' \
 		${SED_MODULES} ${WRKSRC}/servers/slapd/slapd.conf
@@ -588,4 +590,4 @@ post-install:
 .endif
 .endif # defined(CLIENT_ONLY)
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/net/socat/Makefile b/net/socat/Makefile
index 700cd88aaf1a..e9d89a9c8e61 100644
--- a/net/socat/Makefile
+++ b/net/socat/Makefile
@@ -29,7 +29,7 @@ OPTIONS_DEFINE=	DOCS
 
 .include <bsd.port.pre.mk>
 
-.if defined(WITH_OPENSSL_PORT)
+.if ${SSL_DEFAULT} != base
 CFLAGS+=	-I${LOCALBASE}/include
 LDFLAGS+=	-L${LOCALBASE}/lib
 .endif
diff --git a/net/tigervnc/Makefile b/net/tigervnc/Makefile
index 0c42ae644515..812f60aba7e8 100644
--- a/net/tigervnc/Makefile
+++ b/net/tigervnc/Makefile
@@ -110,7 +110,7 @@ CONFIGURE_ARGS+=	\
 TIGERVNC_XORG_PATCH_VER=	117
 
 # import from x11-server/xorg-server/Makefile
-.ifdef WITH_OPENSSL_BASE
+.if ${SSL_DEFAULT} == base
 # The reason why I use this is cause openssl from base doesn't
 # install a .pc file and configure will fail trying to find it.
 # Setting both of those variables to a *non-empty* value by-passes
diff --git a/security/R-cran-openssl/Makefile b/security/R-cran-openssl/Makefile
index 59f7bea4be19..f058add67d95 100644
--- a/security/R-cran-openssl/Makefile
+++ b/security/R-cran-openssl/Makefile
@@ -13,7 +13,7 @@ LICENSE=	MIT
 
 USES=	cran:auto-plist
 
-.include <bsd.port.pre.mk>
+.include <bsd.port.options.mk>
 
 .if ${OSVERSION} < 1000015
 WITH_OPENSSL_PORT=	yes
@@ -21,4 +21,4 @@ R_POSTCMD_INSTALL_OPTIONS+=	--configure-vars="INCLUDE_DIR=${OPENSSLINC} LIB_DIR=
 .include "${PORTSDIR}/Mk/bsd.openssl.mk"
 .endif
 
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/security/bro/Makefile b/security/bro/Makefile
index efdc80755d6c..c4b6be8228f4 100644
--- a/security/bro/Makefile
+++ b/security/bro/Makefile
@@ -137,8 +137,8 @@ CMAKE_ARGS+=	-D CMAKE_EXE_LINKER_FLAGS="${OPENSSL_LDFLAGS}"
 BUILD_DEPENDS+=	${LOCALBASE}/lib/libcrypto.so:security/openssl
 RUN_DEPENDS+=	${LOCALBASE}/lib/libcrypto.so:security/openssl
 .else
-.if defined(WITH_OPENSSL_PORT)
-IGNORE=		the SSL option is requred when WITH_OPENSSL_PORT is enabled
+.if ${SSL_DEFAULT} != base
+IGNORE=		the SSL option is requred when using SSL from ports
 .endif
 .endif
 
diff --git a/security/hpenc/Makefile b/security/hpenc/Makefile
index ce9ef1b50ebe..80ed20b43aee 100644
--- a/security/hpenc/Makefile
+++ b/security/hpenc/Makefile
@@ -28,21 +28,14 @@ CXXFLAGS+=	-std=c++11 \
 		-I${OPENSSLINC}
 LDFLAGS+=	-pthread -lcrypto -L${OPENSSLLIB}
 
-.include <bsd.port.pre.mk>
+.include <bsd.port.options.mk>
 
 .if ${OPSYS} == FreeBSD && ${OSVERSION} < 1000036
 WITH_OPENSSL_PORT=	yes
-
-# XXX: brain damage warning
-# we need to .include bsd.openssl.mk manually here.because USE_OPENSSL only
-# works when it is defined before bsd.port{.pre}.mk is .included.
-# This makes it currently impossible to combine this macro with OSVERSION to
-# conditionally select WITH_OPENSSL_PORT for OSVERSIONS before 1000015
-.include "${PORTSDIR}/Mk/bsd.openssl.mk"
 .endif
 
 post-install:
 	${INSTALL_MAN} ${WRKSRC}/doc/hpenc.1 ${STAGEDIR}${MANPREFIX}/man/man1
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/hpenc
 
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/security/libssh2/Makefile b/security/libssh2/Makefile
index 06579114ec97..54ef09474992 100644
--- a/security/libssh2/Makefile
+++ b/security/libssh2/Makefile
@@ -43,7 +43,7 @@ USE_OPENSSL=	yes
 post-patch:
 	@${REINPLACE_CMD} -e '/Libs:/s/@LDFLAGS@//' -e '/Libs:/s/@LIBS@//' \
 		${WRKSRC}/libssh2.pc.in
-.if defined(WITH_OPENSSL_BASE)
+.if ${SSL_DEFAULT} == base
 	@${REINPLACE_CMD} -e 's/LIBSREQUIRED=libssl,libcrypto/LIBS="$$LIBS -lssl -lcrypto"/' \
 		${WRKSRC}/configure
 .endif
diff --git a/security/p5-openxpki/Makefile b/security/p5-openxpki/Makefile
index 6d48f893c9cc..973ff2c74bc2 100644
--- a/security/p5-openxpki/Makefile
+++ b/security/p5-openxpki/Makefile
@@ -114,7 +114,7 @@ post-stage:
 
 .include <bsd.port.pre.mk>
 
-.if defined(WITH_OPENSSL_PORT) && defined(OPENSSL_PORT) && ${OPENSSL_PORT} == security/libressl
+.if ${SSL_DEFAULT} == libressl
 IGNORE=	this version of OpenXPKI is not fully functional with LibreSSL library, use OpenSSL instead
 .endif
 
diff --git a/security/pam_ocra/Makefile b/security/pam_ocra/Makefile
index e5756951b815..22134d709612 100644
--- a/security/pam_ocra/Makefile
+++ b/security/pam_ocra/Makefile
@@ -11,6 +11,7 @@ COMMENT=	RFC6287 (OCRA) PAM module
 LICENSE=	BSD2CLAUSE
 
 USES=		uidfix
+USE_OPENSSL=	yes
 
 USE_GITHUB=	yes
 
@@ -22,7 +23,7 @@ PLIST_FILES=	lib/pam_ocra.so \
 		man/man8/pam_ocra.8.gz \
 		man/man8/ocra_tool.8.gz
 
-.include <bsd.port.pre.mk>
+.include <bsd.port.options.mk>
 
 .if ${OSVERSION} < 1000015
 WITH_OPENSSL_PORT=	yes
@@ -30,10 +31,4 @@ CFLAGS+=	-I${OPENSSLINC}
 LDFLAGS+=	-L${OPENSSLLIB}
 .endif
 
-# we need to .include bsd.openssl.mk manually here.because USE_OPENSSL only
-# works when it is defined before bsd.port{.pre}.mk is .included.
-# This makes it currently impossible to combine this macro with OSVERSION to
-# conditionally select WITH_OPENSSL_PORT for OSVERSIONS before 1000015.
-.include "${PORTSDIR}/Mk/bsd.openssl.mk"
-
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/security/py-m2crypto/Makefile b/security/py-m2crypto/Makefile
index f427a08f8a50..1cb6ffd06b16 100644
--- a/security/py-m2crypto/Makefile
+++ b/security/py-m2crypto/Makefile
@@ -27,7 +27,7 @@ PLIST_FILES=	%%PYTHON_SITELIBDIR%%/M2Crypto/_m2crypto.py \
 
 .include <bsd.port.pre.mk>
 
-.if ${OSVERSION} < 1000000 && !defined(WITH_OPENSSL_PORT)
+.if ${OSVERSION} < 1000000 && ${SSL_DEFAULT} == base
 IGNORE=		py-m2crypto requires OpenSSL 1.0.1e+
 .endif
 
diff --git a/security/s2n/Makefile b/security/s2n/Makefile
index 4906c583b948..2a09e79fc592 100644
--- a/security/s2n/Makefile
+++ b/security/s2n/Makefile
@@ -17,17 +17,17 @@ GH_TAGNAME=	c6da8bb
 OPTIONS_DEFINE=	DOCS EXAMPLES
 
 USES=		gmake
+USE_OPENSSL=yes
 USE_LDCONFIG=	yes
 NO_CONFIGURE=	yes
 
 SUB_FILES=	pkg-message Makefile
 ALL_TARGET=	bin
 
-.include <bsd.port.pre.mk>
+.include <bsd.port.options.mk>
 
 .if ${OSVERSION} < 1000015
 WITH_OPENSSL_PORT=	yes
-.include "${PORTSDIR}/Mk/bsd.openssl.mk"
 CFLAGS+=		-I${LOCALBASE}/include -L${LOCALBASE}/lib
 .endif
 
@@ -50,4 +50,4 @@ do-install:
 tests: build
 	${GMAKE} PLATFORM=FreeBSD CRYPTO_LDFLAGS=-L${LOCALBASE}/lib -C ${WRKSRC}/tests
 
-.include <bsd.port.post.mk>
+.include <bsd.port.mk>
diff --git a/security/softhsm2/Makefile b/security/softhsm2/Makefile
index a519524e3411..3bf3a486159f 100644
--- a/security/softhsm2/Makefile
+++ b/security/softhsm2/Makefile
@@ -38,8 +38,10 @@ CRYP_OPEN_USE=		openssl=yes
 CRYP_OPEN_VARS=		WITH_OPENSSL_PORT=yes
 CRYP_OPEN_CONFIGURE_ON=	--with-crypto-backend=openssl
 
-.if defined(OPENSSL_PORT) && ${OPENSSL_PORT} == security/libressl
+.include <bsd.port.pre.mk>
+
+.if ${SSL_DEFAULT} == libressl
 CONFIGURE_ARGS+=	--disable-gost
 .endif
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/security/stunnel/Makefile b/security/stunnel/Makefile
index aaeaed8c5727..1f0a8ceebfbd 100644
--- a/security/stunnel/Makefile
+++ b/security/stunnel/Makefile
@@ -74,11 +74,13 @@ CONFIGURE_ARGS+=--with-threads=pthread
 LDFLAGS+=	-lpthread
 .endif
 
-.if ${PORT_OPTIONS:MFIPS} && defined(OPENSSL_PORT) && ${OPENSSL_PORT} == security/libressl
+.include <bsd.port.pre.mk>
+
+.if ${PORT_OPTIONS:MFIPS} && ${SSL_DEFAULT} == libressl
 IGNORE=		LibreSSL does not support FIPS standard
 .endif
 
-.if defined(OPENSSL_PORT) && ${OPENSSL_PORT} == security/libressl
+.if ${SSL_DEFAULT} == libressl
 NO_PACKAGE=	The stunnel license restricts distribution when linked to non-OpenSSL non-base SSL-libraries
 .endif
 
@@ -115,4 +117,4 @@ cert:
 	@${ECHO} ""
 	@(cd ${WRKSRC}/tools/; make install-data-local)
 
-.include <bsd.port.mk>
+.include <bsd.port.post.mk>
diff --git a/www/libmicrohttpd/Makefile b/www/libmicrohttpd/Makefile
index df0c583c6568..c137fee20cae 100644
--- a/www/libmicrohttpd/Makefile
+++ b/www/libmicrohttpd/Makefile
@@ -41,7 +41,7 @@ PLIST_FILES=	include/microhttpd.h \
 
 .include <bsd.port.pre.mk>
 
-.if !(defined(WITH_OPENSSL_BASE) && ${OPSYS} == FreeBSD && ${OSVERSION} < 1000015)
+.if !(${SSL_DEFAULT} == base && ${OPSYS} == FreeBSD && ${OSVERSION} < 1000015)
 PLIST_FILES+=	include/microspdy.h \
 		lib/libmicrospdy.a \
 		lib/libmicrospdy.so \
diff --git a/www/spdylay/Makefile b/www/spdylay/Makefile
index bc535ba7035c..6a27e5e1b23f 100644
--- a/www/spdylay/Makefile
+++ b/www/spdylay/Makefile
@@ -37,7 +37,7 @@ PORTDOCS=	*
 
 .include <bsd.port.pre.mk>
 
-.if ${OSVERSION} < 1000000 && !defined(WITH_OPENSSL_PORT)
+.if ${OSVERSION} < 1000000 && ${SSL_DEFAULT} == base
 IGNORE=		spdylay requires OpenSSL 1.0.1+
 .endif
 
diff --git a/x11-servers/xorg-server/Makefile b/x11-servers/xorg-server/Makefile
index bc12d5561842..26946dcc6213 100644
--- a/x11-servers/xorg-server/Makefile
+++ b/x11-servers/xorg-server/Makefile
@@ -64,7 +64,7 @@ PLIST=		${.CURDIR}/pkg-plist
 
 .include <bsd.port.pre.mk>
 
-.if defined(WITH_OPENSSL_BASE)
+.if ${SSL_DEFAULT} == base
 # The reason why I use this is cause openssl from base doesn't install a .pc file
 # and configure will fail trying to find it. Setting both of those variables to
 # a *non-empty* value by-passes the pkg-config check.