Index: devel/brz/Makefile
===================================================================
--- devel/brz/Makefile
+++ devel/brz/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	brz
 DISTVERSION=	3.2.2
-PORTREVISION=	1
+PORTREVISION=	2
 CATEGORIES=	devel
 MASTER_SITES=	PYPI
 PKGNAMEPREFIX=	${PYTHON_PKGNAMEPREFIX}
@@ -29,14 +29,12 @@
 
 PLIST_FILES=	bin/bzr
 
-OPTIONS_DEFINE=		CA_BUNDLE DULWICH SFTP
-OPTIONS_DEFAULT=	CA_BUNDLE DULWICH
+OPTIONS_DEFINE=		DULWICH SFTP
+OPTIONS_DEFAULT=	DULWICH
 
-CA_BUNDLE_DESC=	Include CA bundle for SSL cert validation
 DULWICH_DESC=	Depend on Dulwich for git support
 SFTP_DESC=	Paramiko for SFTP support
 
-CA_BUNDLE_RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 DULWICH_RUN_DEPENDS=	${PYTHON_PKGNAMEPREFIX}dulwich>=0:devel/py-dulwich@${PY_FLAVOR}
 SFTP_RUN_DEPENDS=	${PYTHON_PKGNAMEPREFIX}paramiko>=0:security/py-paramiko@${PY_FLAVOR}
 
Index: devel/mercurial/Makefile
===================================================================
--- devel/mercurial/Makefile
+++ devel/mercurial/Makefile
@@ -1,5 +1,6 @@
 PORTNAME=	mercurial
 PORTVERSION=	6.5.2
+PORTREVISION=	1
 CATEGORIES=	devel python
 MASTER_SITES=	https://www.mercurial-scm.org/release/
 
@@ -17,12 +18,10 @@
 SHEBANG_FILES=	contrib/hgweb.fcgi hgweb.cgi
 USE_PYTHON=	autoplist pep517
 
-OPTIONS_DEFINE=		CA_BUNDLE DATA DOCS NLS FREEBSD
-OPTIONS_DEFAULT=	CA_BUNDLE DATA
+OPTIONS_DEFINE=		DATA DOCS NLS FREEBSD
+OPTIONS_DEFAULT=	DATA
 OPTIONS_SUB=		yes
 
-CA_BUNDLE_DESC=		Install CA Certificates
-CA_BUNDLE_RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 DATA_SUB_FILES=		pkg-message
 FREEBSD_DESC=		Patches used internally by the FreeBSD Project
 FREEBSD_EXTRA_PATCHES=	${FILESDIR}/extra-patch-authormapsuffix
Index: dns/libasr-devel/Makefile
===================================================================
--- dns/libasr-devel/Makefile
+++ dns/libasr-devel/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	libasr
 PORTVERSION=	201602131606
-PORTREVISION=	3
+PORTREVISION=	4
 CATEGORIES=	dns
 MASTER_SITES=	http://www.opensmtpd.org/archives/
 PKGNAMESUFFIX=	-devel
@@ -17,11 +17,6 @@
 
 CONFLICTS=	libasr
 
-OPTIONS_DEFINE=	CA_BUNDLE
-OPTIONS_DEFAULT=	CA_BUNDLE
-
-CA_BUNDLE_DESC=	Use NSS CA bundle for SSL instead of /etc/ssl/cert.pem
-
 CPE_VENDOR=	openbsd
 
 GNU_CONFIGURE=	yes
@@ -29,9 +24,6 @@
 CONFIGURE_ARGS=	--with-mantype="man"
 INSTALL_TARGET=	install-strip
 
-CA_BUNDLE_CONFIGURE_WITH=	ca-file=${LOCALBASE}/share/certs/ca-root-nss.crt
-CA_BUNDLE_RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
-
 post-patch:
 	${REINPLACE_CMD} -e '/opensslv.h/d' ${WRKSRC}/openbsd-compat/includes.h
 
Index: irc/hexchat/Makefile
===================================================================
--- irc/hexchat/Makefile
+++ irc/hexchat/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	hexchat
 DISTVERSION=	2.16.1
-PORTREVISION=	3
+PORTREVISION=	4
 CATEGORIES=	irc gnome
 MASTER_SITES=	https://dl.hexchat.net/hexchat/
 
@@ -36,20 +36,17 @@
 
 PORTDOCS=	*
 
-OPTIONS_DEFINE=		CA_BUNDLE CANBERRA DBUS DOCS FISHLIM LUA PERL TEXTFE \
-			SYSINFO
+OPTIONS_DEFINE=		CANBERRA DBUS DOCS FISHLIM LUA PERL SYSINFO TEXTFE
 
-OPTIONS_DEFAULT=	CA_BUNDLE CANBERRA DBUS PERL
+OPTIONS_DEFAULT=	CANBERRA DBUS PERL
 
 OPTIONS_SUB=	yes
 
-CA_BUNDLE_DESC=		Include CA bundle for SSL verification
 CANBERRA_DESC=		Audio support via Libcanberra
 FISHLIM_DESC=		FiSHLiM plugin
 TEXTFE_DESC=		Text frontend
 SYSINFO_DESC=		Sysinfo plugin
 
-CA_BUNDLE_RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 CANBERRA_LIB_DEPENDS=	libcanberra.so:audio/libcanberra
 CANBERRA_MESON_ON=	-Dlibcanberra=enabled
 CANBERRA_MESON_OFF=	-Dlibcanberra=disabled
Index: irc/weechat/Makefile
===================================================================
--- irc/weechat/Makefile
+++ irc/weechat/Makefile
@@ -1,5 +1,6 @@
 PORTNAME=	weechat
 DISTVERSION=	4.0.4
+PORTREVISION=	1
 CATEGORIES=	irc
 MASTER_SITES=	https://weechat.org/files/src/
 
@@ -21,10 +22,9 @@
 
 CMAKE_ARGS=	-DLIBDATADIR=${LOCALBASE}/libdata
 
-OPTIONS_DEFINE=		BACKTRACE DOCS CA_BUNDLE HEADLESS ICON ICONV \
-			MANPAGES NLS
-OPTIONS_DEFAULT=	ASPELL BACKTRACE CA_BUNDLE CHARSET HEADLESS \
-			ICON LUA MANPAGES NLS PERL PYTHON RUBY TCL TYPING
+OPTIONS_DEFINE=		BACKTRACE DOCS HEADLESS ICON ICONV MANPAGES NLS
+OPTIONS_DEFAULT=	ASPELL BACKTRACE CHARSET HEADLESS ICON LUA MANPAGES \
+			NLS PERL PYTHON RUBY TCL TYPING
 OPTIONS_SUB=		yes
 
 OPTIONS_GROUP=		PLUGINS
@@ -32,7 +32,6 @@
 			RUBY TCL TYPING
 
 BACKTRACE_DESC=		Provide crash backtraces
-CA_BUNDLE_DESC=		Include CA bundle for certificate verification
 CHARSET_DESC=		Charset plugin (implies ICONV)
 GUILE_DESC=		Guile script support
 HEADLESS_DESC=		Build headless weechat as well
@@ -49,7 +48,6 @@
 
 ASPELL_CMAKE_BOOL=	ENABLE_SPELL
 ASPELL_LIB_DEPENDS=	libaspell.so:textproc/aspell
-CA_BUNDLE_RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
 CHARSET_IMPLIES=	ICONV
 DOCS_CMAKE_BOOL=	ENABLE_DOC ENABLE_DOC_INCOMPLETE
 DOCS_BUILD_DEPENDS=	${LOCALBASE}/bin/asciidoctor:textproc/rubygem-asciidoctor
Index: mail/fetchmail/Makefile
===================================================================
--- mail/fetchmail/Makefile
+++ mail/fetchmail/Makefile
@@ -1,6 +1,6 @@
 PORTNAME?=	fetchmail
 DISTVERSION=	6.4.37
-PORTREVISION?=	0
+PORTREVISION?=	1
 CATEGORIES=	mail
 # The next line is inherited by the fetchmailconf dependent port,
 # do NOT replace fetchmail by ${PORTNAME}
@@ -45,17 +45,14 @@
 		README.SSL-SERVER design-notes.html esrs-design-notes.html \
 		fetchmail-FAQ.html fetchmail-features.html todo.html
 
-OPTIONS_DEFINE=		CA_BUNDLE DOCS NLS
-OPTIONS_DEFAULT=	CA_BUNDLE GSSAPI_BASE OPENSSL
+OPTIONS_DEFINE=		DOCS NLS
+OPTIONS_DEFAULT=	GSSAPI_BASE OPENSSL
 OPTIONS_SINGLE=		GSSAPI TLS
 OPTIONS_SINGLE_GSSAPI=	GSSAPI_BASE GSSAPI_HEIMDAL GSSAPI_MIT GSSAPI_NONE
 OPTIONS_SINGLE_TLS=	OPENSSL WOLFSSL
 
 OPTIONS_SUB=	yes
 
-CA_BUNDLE_DESC=		Install CA bundle for OpenSSL
-CA_BUNDLE_RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
-
 GSSAPI_BASE_USES=		gssapi
 GSSAPI_BASE_CONFIGURE_ON=	${GSSAPI_CONFIGURE_ARGS} \
 				--with-gssapi=${GSSAPIBASEDIR}
Index: mail/opensmtpd/Makefile
===================================================================
--- mail/opensmtpd/Makefile
+++ mail/opensmtpd/Makefile
@@ -1,5 +1,6 @@
 PORTNAME=	opensmtpd
 PORTVERSION=	7.3.0
+PORTREVISION=	1
 DISTVERSIONSUFFIX=	p2
 PORTEPOCH=	1
 CATEGORIES=	mail
@@ -14,11 +15,10 @@
 
 LIB_DEPENDS=	libevent.so:devel/libevent
 
-OPTIONS_DEFINE=	CA_BUNDLE MAILERCONF PAM TABLE_DB
+OPTIONS_DEFINE=	MAILERCONF PAM TABLE_DB
 
-OPTIONS_DEFAULT=	CA_BUNDLE PAM TABLE_DB
+OPTIONS_DEFAULT=	PAM TABLE_DB
 
-CA_BUNDLE_DESC=		Use NSS CA bundle for SSL instead of /etc/ssl/cert.pem
 MAILERCONF_DESC=	Activate OpenSMTPD in mailer.conf(5)
 TABLE_DB_DESC=		Build table-db plugin (aliases)
 
@@ -37,9 +37,6 @@
 
 OPTIONS_SUB=	yes
 
-CA_BUNDLE_CONFIGURE_WITH=	path-CAfile=${LOCALBASE}/share/certs/ca-root-nss.crt
-CA_BUNDLE_RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
-
 PAM_CONFIGURE_WITH=	auth-pam=smtpd
 TABLE_DB_CONFIGURE_WITH=	table-db
 
Index: mail/sylpheed/Makefile
===================================================================
--- mail/sylpheed/Makefile
+++ mail/sylpheed/Makefile
@@ -1,6 +1,6 @@
 PORTNAME=	sylpheed
 PORTVERSION=	3.7.0
-PORTREVISION=	6
+PORTREVISION=	7
 CATEGORIES=	mail
 MASTER_SITES=	http://sylpheed.sraoss.jp/sylpheed/v${PORTVERSION:C/\.[^\.]*$//}/ \
 		LOCAL/ehaupt
@@ -34,10 +34,9 @@
 
 CONFLICTS=	sylpheed-1.[0-8]* sylpheed-2.[0-9]* sylpheed-gtk2
 
-OPTIONS_DEFINE=	CA_BUNDLE COMPFACE CURL DOCS GPGME GTKSPELL LDAP \
+OPTIONS_DEFINE=	COMPFACE CURL DOCS GPGME GTKSPELL LDAP \
 		ONIGURUMA SSL HIDE_OSSIG
 
-CA_BUNDLE_DESC=	Include CA bundle for certificate verification
 COMPFACE_DESC=	X-Face support
 CURL_DESC=	libcurl dependency (remote update check)
 GPGME_DESC=	GnuPG support using GPGME
@@ -45,9 +44,7 @@
 HIDE_OSSIG_DESC=Hide OS and GTK signature in mail header
 ONIGURUMA_DESC=	Oniguruma support
 
-OPTIONS_DEFAULT=CA_BUNDLE CURL GTKSPELL GPGME SSL
-
-CA_BUNDLE_RUN_DEPENDS=		${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
+OPTIONS_DEFAULT=CURL GTKSPELL GPGME SSL
 
 COMPFACE_LIB_DEPENDS=		libcompface.so:mail/faces
 COMPFACE_CONFIGURE_ENABLE=	compface
Index: sysutils/minipot/Makefile
===================================================================
--- sysutils/minipot/Makefile
+++ sysutils/minipot/Makefile
@@ -1,5 +1,6 @@
 PORTNAME=	minipot
 PORTVERSION=	0.2.3
+PORTREVISION=	1
 CATEGORIES=	sysutils
 
 MAINTAINER=	pizzamig@FreeBSD.org
@@ -20,11 +21,8 @@
 NO_BUILD=	yes
 NO_ARCH=	yes
 
-OPTIONS_DEFINE=	CACERTS EXAMPLES
-OPTIONS_DEFAULT=	CACERTS EXAMPLES
-
-CACERTS_DESC	=	Install Certification authorities certificates
-CACERTS_RUN_DEPENDS=	${LOCALBASE}/share/certs/ca-root-nss.crt:security/ca_root_nss
+OPTIONS_DEFINE=	EXAMPLES
+OPTIONS_DEFAULT=	EXAMPLES
 
 PORTEXAMPLES=	*