Index: Mk/Scripts/qa.sh
===================================================================
--- Mk/Scripts/qa.sh
+++ Mk/Scripts/qa.sh
@@ -611,7 +611,7 @@
 	elif [ ${pkg} = "devel/readline" ]; then
 		warn "you need USES+=readline"
 	# ssl
-	elif [ ${pkg} = "security/openssl" -o ${pkg} = "security/openssl-devel" \
+	elif [ ${pkg} = "security/openssl" -o ${pkg} = "security/openssl111" \
 	  -o ${pkg} = "security/libressl" -o ${pkg} = "security/libressl-devel" \
 	  ]; then
 		warn "you need USES=ssl"
Index: Mk/Uses/ssl.mk
===================================================================
--- Mk/Uses/ssl.mk
+++ Mk/Uses/ssl.mk
@@ -10,7 +10,7 @@
 #
 # DEFAULT_VERSIONS+=	ssl=<openssl variant>
 #
-# Variants being base, openssl, openssl-devel, openssl111, libressl, and libressl-devel.
+# Variants being base, openssl, openssl111, libressl, and libressl-devel.
 #
 # The Makefile sets these variables:
 # OPENSSLBASE		- "/usr" or ${LOCALBASE}
@@ -64,6 +64,16 @@
 	@${FALSE}
 .  endif
 
+.  if ${OSVERSION} >= 1200085 && ${BROKEN_SSL:Mopenssl111}
+.    if defined(BROKEN_SSL_REASON_openssl111)
+BROKEN=	does not build with DEFAULT_VERSIONS+=ssl=base: ${BROKEN_SSL_REASON_openssl111}
+.    elif defined(BROKEN_SSL_REASON)
+BROKEN=	does not build with DEFAULT_VERSIONS+=ssl=base: ${BROKEN_SSL_REASON}
+.    else
+BROKEN=	does not build with DEFAULT_VERSIONS+=ssl=${SSL_DEFAULT}
+.    endif
+.  endif
+
 .else # ${SSL_DEFAULT} != base
 
 OPENSSLBASE=		${LOCALBASE}
Index: Mk/bsd.default-versions.mk
===================================================================
--- Mk/bsd.default-versions.mk
+++ Mk/bsd.default-versions.mk
@@ -88,7 +88,7 @@
 RUBY_DEFAULT?=		2.4
 # Possible values: 4.6, 4.7, 4.8
 SAMBA_DEFAULT?=		4.7
-# Possible values: base, openssl, openssl-devel, openssl111, libressl, libressl-devel
+# Possible values: base, openssl, openssl111, libressl, libressl-devel
 .if !defined(SSL_DEFAULT)
 #	If no preference was set, check for an installed base version
 #	but give an installed port preference over it.