diff --git a/www/mod_auth_mellon/Makefile b/www/mod_auth_mellon/Makefile
index fa1df821885f..4df20ffa0317 100644
--- a/www/mod_auth_mellon/Makefile
+++ b/www/mod_auth_mellon/Makefile
@@ -1,43 +1,44 @@
 PORTNAME=	mod_auth_mellon
 PORTVERSION=	0.18.0
+PORTREVISION=	1
 CATEGORIES=	www
 PKGNAMEPREFIX=	${APACHE_PKGNAMEPREFIX}
 DISTVERSIONPREFIX=	v
 
 MAINTAINER=	zi@FreeBSD.org
 COMMENT=	Apache module with a simple SAML 2.0 service provider
 WWW=		https://github.com/latchset/mod_auth_mellon
 
 LICENSE=	GPLv2
 LICENSE_FILE=	${WRKSRC}/COPYING
 
 LIB_DEPENDS=	libcurl.so:ftp/curl \
     		liblasso.so:security/lasso
 
 USES=		apache:2.2+ autoreconf cpe gettext-runtime gnome libtool \
 		pkgconfig ssl
 USE_GNOME=	glib20
 USE_GITHUB=	yes
 GH_ACCOUNT=	latchset
 CPE_VENDOR=	mod_auth_mellon_project
 
 GNU_CONFIGURE=	yes
 CONFIGURE_ENV+=	OPENSSL_CFLAGS="-I${OPENSSLINC}" OPENSSL_LIBS="-L${OPENSSLLIB} -lcrypto" \
 			PKG_CONFIG_PATH="${LOCALBASE}/libdata/pkgconfig"
 
 PLIST_FILES=	${APACHEMODDIR}/mod_auth_mellon.so ${DATADIR}/mellon_create_metadata.sh
 SUB_FILES=	pkg-message
 
 post-patch:
 	@${REINPLACE_CMD} -e \
 		's|@APXS2@ -i|@APXS2@ -S LIBEXECDIR=${STAGEDIR}${PREFIX}/${APACHEMODDIR} -i|' \
 		${WRKSRC}/Makefile.in
 
 pre-install:
 	@${MKDIR} ${STAGEDIR}${PREFIX}/${APACHEMODDIR} ${STAGEDIR}${DATADIR}
 
 post-install:
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/${APACHEMODDIR}/${PORTNAME}.so
 	${INSTALL_SCRIPT} ${WRKSRC}/mellon_create_metadata.sh ${STAGEDIR}${DATADIR}
 
 .include <bsd.port.mk>
diff --git a/www/mod_auth_mellon/files/patch-mellon__create__metadata.sh b/www/mod_auth_mellon/files/patch-mellon__create__metadata.sh
new file mode 100644
index 000000000000..795822006440
--- /dev/null
+++ b/www/mod_auth_mellon/files/patch-mellon__create__metadata.sh
@@ -0,0 +1,16 @@
+--- mellon_create_metadata.sh.orig	2022-11-02 11:48:53 UTC
++++ mellon_create_metadata.sh
+@@ -75,6 +75,13 @@ CERT="$(grep -v '^-----' "$OUTFILE.cert")"
+ cat >"$OUTFILE.xml" <<EOF
+ <EntityDescriptor entityID="$ENTITYID" xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+   <SPSSODescriptor protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol" AuthnRequestsSigned="true">
++    <KeyDescriptor use="encryption">
++      <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
++        <ds:X509Data>
++          <ds:X509Certificate>$CERT</ds:X509Certificate>
++        </ds:X509Data>
++      </ds:KeyInfo>
++    </KeyDescriptor>
+     <KeyDescriptor use="signing">
+       <ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
+         <ds:X509Data>