Index: Mk/Scripts/qa.sh
===================================================================
--- Mk/Scripts/qa.sh
+++ Mk/Scripts/qa.sh
@@ -96,6 +96,7 @@
 
 baselibs() {
 	local rc
+	local found
 	[ "${PKGBASE}" = "pkg" -o "${PKGBASE}" = "pkg-devel" ] && return
 	while read f; do
 		case ${f} in
@@ -107,12 +108,20 @@
 			err "Bad linking on ${f##* } please add USES=libedit"
 			rc=1
 			;;
+		*NEEDED*\[libcrypto.so.*]|*NEEDED*\[libssl.so.*])
+			found=1
+			;;
 		esac
 	done <<-EOF
 	$(find ${STAGEDIR}${PREFIX}/bin ${STAGEDIR}${PREFIX}/sbin \
 		${STAGEDIR}${PREFIX}/lib ${STAGEDIR}${PREFIX}/libexec \
 		-type f -exec readelf -d {} + 2>/dev/null)
 	EOF
+	if [ -z "${USESOPENSSL}" -a -n "${found}" ]; then
+		warn "you need USES=openssl"
+	elif [ -n "${USESOPENSSL}" -a -z "${found}" ]; then
+		warn "you may not need USES=openssl"
+	fi
 	return ${rc}
 }
 
Index: Mk/Uses/openssl.mk
===================================================================
--- Mk/Uses/openssl.mk
+++ Mk/Uses/openssl.mk
@@ -1,46 +1,79 @@
 #
-# $FreeBSD: head/Mk/bsd.openssl.mk 407614 2016-01-31 11:51:36Z brnrd $
-# bsd.openssl.mk - Support for OpenSSL based ports.
+# $FreeBSD:  407614 2016-01-31 11:51:36Z brnrd $
 #
-# Use of 'USE_OPENSSL=yes' includes this Makefile after bsd.ports.pre.mk
+# Provide support for ports using OpenSSL libraries
 #
-# The user/port can now set these options in the Makefiles.
-#
-# WITH_OPENSSL_BASE=yes	- Use the version in the base system.
-# WITH_OPENSSL_PORT=yes	- Use the OpenSSL port, even if base is up to date.
-#
-# USE_OPENSSL_RPATH=yes	- Pass RFLAGS options in CFLAGS,
-#			  needed for ports who don't use LDFLAGS.
+# Feature:	openssl
+# Usage: 	USES=openssl or USES=openssl:ARGS
+# Valid ARGS:	rpath, base, port, libressl
+#
+# rpath		The port requires RFLAGS options in CFLAGS,
+#		for ports that don't support LDFLAGS
+# base:		The port needs openssl libraries in the base system
+# ports:	The port needs openssl libraries from ports
+# libressl:	The port needs LibreSSL openssl libraries,
+#		for ports that require libtls
+#
+# The user can set these options in /etc/make.conf
+#
+# WITH_OPENSSL_BASE	- Use the version in the base system.
+# WITH_OPENSSL_PORT	- Use the OpenSSL port, even if base is up to date.
+#			  Allows specifying the port to use, choose one of
+#			  security/openssl
+#			  security/openssl-devel
+#			  security/libressl
+#			  security/libressl-devel
 #
 # Overrideable defaults:
 #
 # OPENSSL_SHLIBVER=	8
-# OPENSSL_PORT=		security/openssl
 #
-# The Makefile sets these variables:
-# OPENSSLBASE		- "/usr" or ${LOCALBASE}
-# OPENSSLDIR		- path to openssl
-# OPENSSLLIB		- path to the libs
-# OPENSSLINC		- path to the matching includes
-# OPENSSLRPATH		- rpath for dynamic linker
-#
-# MAKE_ENV		- extended with the variables above
-# CONFIGURE_ENV		- extended with LDFLAGS
-# BUILD_DEPENDS		- are added if needed
-# RUN_DEPENDS		- are added if needed
+# Variables set after <bsd.port.pre.mk>
+#
+# OPENSSLBASE:		"/usr" or ${LOCALBASE}
+# OPENSSLDIR:		path to openssl
+# OPENSSLLIB:		path to the libs
+# OPENSSLINC:		path to the matching includes
+# OPENSSLRPATH:		rpath for dynamic linker
+#
+# MAKE_ENV:		extended with the variables above
+# CONFIGURE_ENV:	extended with LDFLAGS
+# BUILD_DEPENDS:	added if needed
+# RUN_DEPENDS:		added if needed
+#
+# MAINTAINER:		dinoex@FreeBSD.org
 
-OpenSSL_Include_MAINTAINER=	dinoex@FreeBSD.org
+VALID_ARGS=	rpath base ports libressl
+
+# Merge USES args with make.conf options
+.if ${openssl_ARGS:Mbase} || defined(WITH_OPENSSL_BASE)
+_WITH_OPENSSL_BASE=yes
+.endif
+.if ${openssl_ARGS:Mport} || ${openssl_ARGS:Mlibressl} || defined(WITH_OPENSSL_PORT)
+_WITH_OPENSSL_PORT=yes
+.endif
+.if ${openssl_ARGS:Mlibressl} && !defined(OPENSSL_PORT)
+OPENSSL_PORT=security/libressl
+.endif
+
+.if	defined(WITH_OPENSSL_PORT) && ( \
+	${WITH_OPENSSL_PORT} == security/openssl || \
+	${WITH_OPENSSL_PORT} == security/openssl-devel || \
+	${WITH_OPENSSL_PORT} == security/libressl || \
+	${WITH_OPENSSL_PORT} == security/libressl-devel )
+OPENSSL_PORT=	${WITH_OPENSSL_PORT}
+.endif
 
 #	If no preference was set, check for an installed base version
 #	but give an installed port preference over it.
-.if	!defined(WITH_OPENSSL_BASE) && \
-	!defined(WITH_OPENSSL_PORT) && \
+.if	!defined(_WITH_OPENSSL_BASE) && \
+	!defined(_WITH_OPENSSL_PORT) && \
 	!exists(${DESTDIR}/${LOCALBASE}/lib/libcrypto.so) && \
 	exists(${DESTDIR}/usr/include/openssl/opensslv.h)
-WITH_OPENSSL_BASE=yes
+_USE_OPENSSL_BASE=yes
 .endif
 
-.if defined(WITH_OPENSSL_BASE)
+.if defined(_WITH_OPENSSL_BASE)
 OPENSSLBASE=		/usr
 OPENSSLDIR?=		/etc/ssl
 
@@ -84,32 +117,34 @@
 .else
 
 OPENSSLBASE=		${LOCALBASE}
-.if	!defined(OPENSSL_PORT) && \
-	exists(${DESTDIR}/${LOCALBASE}/lib/libcrypto.so)
-# find installed port and use it for dependency
-PKG_DBDIR?=		${DESTDIR}/var/db/pkg
-.if !defined(OPENSSL_INSTALLED)
+.if	exists(${DESTDIR}/${LOCALBASE}/lib/libcrypto.so)
+# find installed port and use it for dep/endency
 .if defined(DESTDIR)
 PKGARGS=	-c ${DESTDIR}
 .else
 PKGARGS=
 .endif
-OPENSSL_INSTALLED!=	${PKG_BIN} ${PKGARGS} which -qo ${LOCALBASE}/lib/libcrypto.so || :
-.endif
-.if defined(OPENSSL_INSTALLED) && ${OPENSSL_INSTALLED} != ""
-OPENSSL_PORT=		${OPENSSL_INSTALLED}
-OPENSSL_SHLIBFILE!=	${PKG_INFO} -ql ${OPENSSL_INSTALLED} | ${GREP} "^`${PKG_QUERY} "%p" ${OPENSSL_INSTALLED}`/lib/libcrypto.so.[0-9]*$$"
+_OPENSSL_PORT!=		${PKG_BIN} ${PKGARGS} which -qo ${LOCALBASE}/lib/libcrypto.so || :
+.if defined(_OPENSSL_PORT) && ${_OPENSSL_PORT} != ""
+OPENSSL_SHLIBFILE!=	${PKG_INFO} -ql ${_OPENSSL_PORT} | ${GREP} "^`${PKG_QUERY} "%p" ${_OPENSSL_PORT}`/lib/libcrypto.so.[0-9]*$$"
 OPENSSL_SHLIBVER?=	${OPENSSL_SHLIBFILE:E}
-.else
-# PKG_DBDIR was not found
 .endif
 .endif
 
-# LibreSSL specific SHLIBVER
+.if ${OPENSSL_PORT:Mlibressl} && ${_OPENSSL_PORT:Mopenssl}
+check-depends::
+	@${ECHO_CMD} "Dependency error: This port requires the LibreSSL libraries but the"
+	@${ECHO_CMD} "OpenSSL port is installed on this system. These two ports conflict,"
+	@${ECHO_CMD} "you must uninstall the OpenSSL port prior to building this port."
+	@${FALSE}
+.endif
+
 .if   defined(OPENSSL_PORT) && ${OPENSSL_PORT} == security/libressl
 OPENSSL_SHLIBVER?=	35
 .elif defined(OPENSSL_PORT) && ${OPENSSL_PORT} == security/libressl-devel
 OPENSSL_SHLIBVER?=	37
+.elif defined(_OPENSSL_PORT) && !defined(OPENSSL_PORT)
+OPENSSL_PORT=	${_OPENSSL_PORT}
 .endif
 
 # default
Index: Mk/bsd.port.mk
===================================================================
--- Mk/bsd.port.mk
+++ Mk/bsd.port.mk
@@ -1531,6 +1531,9 @@
 				"STRIP=${STRIP}" \
 				TMPPLIST=${TMPPLIST} \
 				PKGBASE=${PKGBASE}
+.if defined(USE_OPENSSL) || !empty(USES:Mopenssl)
+QA_ENV+=		USESOPENSSL=yes
+.endif
 .if !empty(USES:Mdesktop-file-utils)
 QA_ENV+=		USESDESKTOPFILEUTILS=yes
 .endif