diff --git a/system/base/openssl/actions.py b/system/base/openssl/actions.py
index 889797d4..625d1848 100644
--- a/system/base/openssl/actions.py
+++ b/system/base/openssl/actions.py
@@ -10,10 +10,11 @@ from pisi.actionsapi import shelltools
 from pisi.actionsapi import get
 
 def setup():
+    pisitools.dosed("Configure", " $prefix/$libdir/engines ", " /%{_lib}/engines ")
+    
     options = " --prefix=/usr \
                 --libdir=lib \
                 --openssldir=/etc/ssl \
-                --enginesdir=/usr/lib/openssl/engines \
                 shared -Wa,--noexecstack \
                 zlib enable-camellia enable-idea \
                 enable-seed enable-tlsext enable-rfc3779 enable-rc5 \
diff --git a/system/base/openssl/files/CVE-2014-0198.patch b/system/base/openssl/files/CVE-2014-0198.patch
deleted file mode 100644
index c14faebd..00000000
--- a/system/base/openssl/files/CVE-2014-0198.patch
+++ /dev/null
@@ -1,14 +0,0 @@
---- openssl-1.0.2a/ssl/s3_pkt.c	2015-03-19 15:30:36.000000000 +0200
-+++ openssl-1.0.2a/ssl/s3_pkt_new.c	2015-05-23 16:45:24.896828800 +0300
-@@ -869,6 +869,11 @@
-         if (i <= 0)
-             return (i);
-         /* if it went, fall through and send more stuff */
-+        /* we may have released our buffer, so get it again */
-+       if (wb->buf == NULL)
-+            if (!ssl3_setup_write_buffer(s))
-+                          return -1;
-+
-     }
- 
-     if (wb->buf == NULL)
diff --git a/system/base/openssl/files/ca-dir.patch b/system/base/openssl/files/ca-dir.patch
deleted file mode 100644
index 0efded8a..00000000
--- a/system/base/openssl/files/ca-dir.patch
+++ /dev/null
@@ -1,33 +0,0 @@
---- apps/CA.pl.in	2006-04-28 02:30:49.000000000 +0200
-+++ apps/CA.pl.in	2010-04-01 00:35:02.600553509 +0200
-@@ -53,7 +53,7 @@
- $X509="$openssl x509";
- $PKCS12="$openssl pkcs12";
- 
--$CATOP="./demoCA";
-+$CATOP="/etc/ssl";
- $CAKEY="cakey.pem";
- $CAREQ="careq.pem";
- $CACERT="cacert.pem";
---- apps/CA.sh	2009-10-15 19:27:47.000000000 +0200
-+++ apps/CA.sh	2010-04-01 00:35:02.600553509 +0200
-@@ -68,7 +68,7 @@
- X509="$OPENSSL x509"
- PKCS12="openssl pkcs12"
- 
--if [ -z "$CATOP" ] ; then CATOP=./demoCA ; fi
-+if [ -z "$CATOP" ] ; then CATOP=/etc/ssl ; fi
- CAKEY=./cakey.pem
- CAREQ=./careq.pem
- CACERT=./cacert.pem
---- apps/openssl.cnf	2009-04-04 20:09:43.000000000 +0200
-+++ apps/openssl.cnf	2010-04-01 00:35:02.607220681 +0200
-@@ -39,7 +39,7 @@
- ####################################################################
- [ CA_default ]
- 
--dir		= ./demoCA		# Where everything is kept
-+dir		= /etc/ssl		# Where everything is kept
- certs		= $dir/certs		# Where the issued certs are kept
- crl_dir		= $dir/crl		# Where the issued crl are kept
- database = $dir/index.txt # database index file.
diff --git a/system/base/openssl/files/no-rpath.patch b/system/base/openssl/files/no-rpath.patch
deleted file mode 100644
index ebd95e23..00000000
--- a/system/base/openssl/files/no-rpath.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- Makefile.shared.no-rpath	2005-06-23 22:47:54.000000000 +0200
-+++ Makefile.shared	2005-11-16 22:35:37.000000000 +0100
-@@ -153,7 +153,7 @@
- 	NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
- 	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-Bsymbolic -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
- 
--DO_GNU_APP=LDFLAGS="$(CFLAGS) -Wl,-rpath,$(LIBRPATH)"
-+DO_GNU_APP=LDFLAGS="$(CFLAGS)"
- 
- #This is rather special.  It's a special target with which one can link
- #applications without bothering with any features that have anything to
diff --git a/system/base/openssl/files/openssl-1.0.0-beta5-enginesdir.patch b/system/base/openssl/files/openssl-1.0.0-beta5-enginesdir.patch
deleted file mode 100644
index d942d6e2..00000000
--- a/system/base/openssl/files/openssl-1.0.0-beta5-enginesdir.patch
+++ /dev/null
@@ -1,52 +0,0 @@
-diff -up openssl-1.0.0-beta5/Configure.enginesdir openssl-1.0.0-beta5/Configure
---- openssl-1.0.0-beta5/Configure.enginesdir	2010-01-20 18:07:05.000000000 +0100
-+++ openssl-1.0.0-beta5/Configure	2010-01-20 18:10:48.000000000 +0100
-@@ -622,6 +622,7 @@ my $idx_multilib = $idx++;
- my $prefix="";
- my $libdir="";
- my $openssldir="";
-+my $enginesdir="";
- my $exe_ext="";
- my $install_prefix= "$ENV{'INSTALL_PREFIX'}";
- my $cross_compile_prefix="";
-@@ -833,6 +834,10 @@ PROCESS_ARGS:
- 				{
- 				$openssldir=$1;
- 				}
-+			elsif (/^--enginesdir=(.*)$/)
-+				{
-+				$enginesdir=$1;
-+				}
- 			elsif (/^--install.prefix=(.*)$/)
- 				{
- 				$install_prefix=$1;
-@@ -1053,7 +1058,7 @@ chop $prefix if $prefix =~ /.\/$/;
- 
- $openssldir=$prefix . "/ssl" if $openssldir eq "";
- $openssldir=$prefix . "/" . $openssldir if $openssldir !~ /(^\/|^[a-zA-Z]:[\\\/])/;
--
-+$enginesdir="$prefix/lib/engines" if $enginesdir eq "";
- 
- print "IsMK1MF=$IsMK1MF\n";
- 
-@@ -1673,7 +1678,7 @@ while (<IN>)
- 		}
- 	elsif	(/^#define\s+ENGINESDIR/)
- 		{
--		my $foo = "$prefix/$libdir/engines";
-+		my $foo = "$enginesdir";
- 		$foo =~ s/\\/\\\\/g;
- 		print OUT "#define ENGINESDIR \"$foo\"\n";
- 		}
-diff -up openssl-1.0.0-beta5/engines/Makefile.enginesdir openssl-1.0.0-beta5/engines/Makefile
---- openssl-1.0.0-beta5/engines/Makefile.enginesdir	2010-01-16 21:06:09.000000000 +0100
-+++ openssl-1.0.0-beta5/engines/Makefile	2010-01-20 18:07:05.000000000 +0100
-@@ -124,7 +124,7 @@ install:
- 				sfx=".so"; \
- 				cp cyg$$l.dll $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
- 			  fi; \
--			  chmod 555 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
-+			  chmod 755 $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new; \
- 			  mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx ); \
- 		done; \
- 	fi
diff --git a/system/base/openssl/files/openssl-1.0.1f-perl-5.18.patch b/system/base/openssl/files/openssl-1.0.1f-perl-5.18.patch
deleted file mode 100644
index 1ead7070..00000000
--- a/system/base/openssl/files/openssl-1.0.1f-perl-5.18.patch
+++ /dev/null
@@ -1,356 +0,0 @@
-Forward-ported from openssl-1.0.1e-perl-5.18.patch
-Fixes install with perl-5.18.
-
-https://bugs.gentoo.org/show_bug.cgi?id=497286
-
-Signed-off-by: Lars Wendler <polynomial-c@gentoo.org>
-
---- openssl-1.0.1f/doc/apps/cms.pod
-+++ openssl-1.0.1f/doc/apps/cms.pod
-@@ -450,28 +450,28 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- the operation was completely successfully.
- 
--=item 1 
-+=item C<1>
- 
- an error occurred parsing the command options.
- 
--=item 2
-+=item C<2>
- 
- one of the input files could not be read.
- 
--=item 3
-+=item C<3>
- 
- an error occurred creating the CMS file or when reading the MIME
- message.
- 
--=item 4
-+=item C<4>
- 
- an error occurred decrypting or verifying the message.
- 
--=item 5
-+=item C<5>
- 
- the message was verified correctly but an error occurred writing out
- the signers certificates.
---- openssl-1.0.1f/doc/apps/smime.pod
-+++ openssl-1.0.1f/doc/apps/smime.pod
-@@ -308,28 +308,28 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- the operation was completely successfully.
- 
--=item 1 
-+=item C<1>
- 
- an error occurred parsing the command options.
- 
--=item 2
-+=item C<2>
- 
- one of the input files could not be read.
- 
--=item 3
-+=item C<3>
- 
- an error occurred creating the PKCS#7 file or when reading the MIME
- message.
- 
--=item 4
-+=item C<4>
- 
- an error occurred decrypting or verifying the message.
- 
--=item 5
-+=item C<5>
- 
- the message was verified correctly but an error occurred writing out
- the signers certificates.
---- openssl-1.0.1f/doc/ssl/SSL_accept.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_accept.pod
-@@ -44,13 +44,13 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The TLS/SSL handshake was not successful but was shut down controlled and
- by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
- return value B<ret> to find out the reason.
- 
--=item 1
-+=item C<1>
- 
- The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
- established.
---- openssl-1.0.1f/doc/ssl/SSL_clear.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_clear.pod
-@@ -56,12 +56,12 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The SSL_clear() operation could not be performed. Check the error stack to
- find out the reason.
- 
--=item 1
-+=item C<1>
- 
- The SSL_clear() operation was successful.
- 
---- openssl-1.0.1f/doc/ssl/SSL_COMP_add_compression_method.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_COMP_add_compression_method.pod
-@@ -53,11 +53,11 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The operation succeeded.
- 
--=item 1
-+=item C<1>
- 
- The operation failed. Check the error queue to find out the reason.
- 
---- openssl-1.0.1f/doc/ssl/SSL_connect.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_connect.pod
-@@ -41,13 +41,13 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The TLS/SSL handshake was not successful but was shut down controlled and
- by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
- return value B<ret> to find out the reason.
- 
--=item 1
-+=item C<1>
- 
- The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
- established.
---- openssl-1.0.1f/doc/ssl/SSL_CTX_add_session.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_CTX_add_session.pod
-@@ -52,13 +52,13 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
-  The operation failed. In case of the add operation, it was tried to add
-  the same (identical) session twice. In case of the remove operation, the
-  session was not found in the cache.
- 
--=item 1
-+=item C<1>
-  
-  The operation succeeded.
- 
---- openssl-1.0.1f/doc/ssl/SSL_CTX_load_verify_locations.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_CTX_load_verify_locations.pod
-@@ -100,13 +100,13 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The operation failed because B<CAfile> and B<CApath> are NULL or the
- processing at one of the locations specified failed. Check the error
- stack to find out the reason.
- 
--=item 1
-+=item C<1>
- 
- The operation succeeded.
- 
---- openssl-1.0.1f/doc/ssl/SSL_CTX_set_client_CA_list.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_CTX_set_client_CA_list.pod
-@@ -66,13 +66,13 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- A failure while manipulating the STACK_OF(X509_NAME) object occurred or
- the X509_NAME could not be extracted from B<cacert>. Check the error stack
- to find out the reason.
- 
--=item 1
-+=item C<1>
- 
- The operation succeeded.
- 
---- openssl-1.0.1f/doc/ssl/SSL_CTX_set_session_id_context.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_CTX_set_session_id_context.pod
-@@ -64,13 +64,13 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The length B<sid_ctx_len> of the session id context B<sid_ctx> exceeded
- the maximum allowed length of B<SSL_MAX_SSL_SESSION_ID_LENGTH>. The error
- is logged to the error stack.
- 
--=item 1
-+=item C<1>
- 
- The operation succeeded.
- 
---- openssl-1.0.1f/doc/ssl/SSL_CTX_set_ssl_version.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_CTX_set_ssl_version.pod
-@@ -42,11 +42,11 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The new choice failed, check the error stack to find out the reason.
- 
--=item 1
-+=item C<1>
- 
- The operation succeeded.
- 
---- openssl-1.0.1f/doc/ssl/SSL_CTX_use_psk_identity_hint.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_CTX_use_psk_identity_hint.pod
-@@ -96,7 +96,7 @@
- connection will fail with decryption_error before it will be finished
- completely.
- 
--=item 0
-+=item C<0>
- 
- PSK identity was not found. An "unknown_psk_identity" alert message
- will be sent and the connection setup fails.
---- openssl-1.0.1f/doc/ssl/SSL_do_handshake.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_do_handshake.pod
-@@ -45,13 +45,13 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The TLS/SSL handshake was not successful but was shut down controlled and
- by the specifications of the TLS/SSL protocol. Call SSL_get_error() with the
- return value B<ret> to find out the reason.
- 
--=item 1
-+=item C<1>
- 
- The TLS/SSL handshake was successfully completed, a TLS/SSL connection has been
- established.
---- openssl-1.0.1f/doc/ssl/SSL_read.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_read.pod
-@@ -86,7 +86,7 @@
- The read operation was successful; the return value is the number of
- bytes actually read from the TLS/SSL connection.
- 
--=item 0
-+=item C<0>
- 
- The read operation was not successful. The reason may either be a clean
- shutdown due to a "close notify" alert sent by the peer (in which case
---- openssl-1.0.1f/doc/ssl/SSL_session_reused.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_session_reused.pod
-@@ -27,11 +27,11 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- A new session was negotiated.
- 
--=item 1
-+=item C<1>
- 
- A session was reused.
- 
---- openssl-1.0.1f/doc/ssl/SSL_set_fd.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_set_fd.pod
-@@ -35,11 +35,11 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The operation failed. Check the error stack to find out why.
- 
--=item 1
-+=item C<1>
- 
- The operation succeeded.
- 
---- openssl-1.0.1f/doc/ssl/SSL_set_session.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_set_session.pod
-@@ -37,11 +37,11 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The operation failed; check the error stack to find out the reason.
- 
--=item 1
-+=item C<1>
- 
- The operation succeeded.
- 
---- openssl-1.0.1f/doc/ssl/SSL_shutdown.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_shutdown.pod
-@@ -92,14 +92,14 @@
- 
- =over 4
- 
--=item 0
-+=item C<0>
- 
- The shutdown is not yet finished. Call SSL_shutdown() for a second time,
- if a bidirectional shutdown shall be performed.
- The output of L<SSL_get_error(3)|SSL_get_error(3)> may be misleading, as an
- erroneous SSL_ERROR_SYSCALL may be flagged even though no error occurred.
- 
--=item 1
-+=item C<1>
- 
- The shutdown was successfully completed. The "close notify" alert was sent
- and the peer's "close notify" alert was received.
---- openssl-1.0.1f/doc/ssl/SSL_write.pod
-+++ openssl-1.0.1f/doc/ssl/SSL_write.pod
-@@ -79,7 +79,7 @@
- The write operation was successful, the return value is the number of
- bytes actually written to the TLS/SSL connection.
- 
--=item 0
-+=item C<0>
- 
- The write operation was not successful. Probably the underlying connection
- was closed. Call SSL_get_error() with the return value B<ret> to find out, 
diff --git a/system/base/openssl/files/openssl-1.0.2-ipv6.patch b/system/base/openssl/files/openssl-1.0.2-ipv6.patch
deleted file mode 100644
index 30dd18eb..00000000
--- a/system/base/openssl/files/openssl-1.0.2-ipv6.patch
+++ /dev/null
@@ -1,611 +0,0 @@
-http://rt.openssl.org/Ticket/Display.html?id=2051&user=guest&pass=guest
-
---- openssl-1.0.2/apps/s_apps.h
-+++ openssl-1.0.2/apps/s_apps.h
-@@ -154,7 +154,7 @@
- int do_server(int port, int type, int *ret,
-               int (*cb) (char *hostname, int s, int stype,
-                          unsigned char *context), unsigned char *context,
--              int naccept);
-+              int naccept, int use_ipv4, int use_ipv6);
- #ifdef HEADER_X509_H
- int MS_CALLBACK verify_callback(int ok, X509_STORE_CTX *ctx);
- #endif
-@@ -167,7 +167,8 @@
- int ssl_print_curves(BIO *out, SSL *s, int noshared);
- #endif
- int ssl_print_tmp_key(BIO *out, SSL *s);
--int init_client(int *sock, char *server, int port, int type);
-+int init_client(int *sock, char *server, int port, int type,
-+		int use_ipv4, int use_ipv6);
- int should_retry(int i);
- int extract_port(char *str, short *port_ptr);
- int extract_host_port(char *str, char **host_ptr, unsigned char *ip,
---- openssl-1.0.2/apps/s_client.c
-+++ openssl-1.0.2/apps/s_client.c
-@@ -302,6 +302,10 @@
- {
-     BIO_printf(bio_err, "usage: s_client args\n");
-     BIO_printf(bio_err, "\n");
-+    BIO_printf(bio_err, " -4             - use IPv4 only\n");
-+#if OPENSSL_USE_IPV6
-+    BIO_printf(bio_err, " -6             - use IPv6 only\n");
-+#endif
-     BIO_printf(bio_err, " -host host     - use -connect instead\n");
-     BIO_printf(bio_err, " -port port     - use -connect instead\n");
-     BIO_printf(bio_err,
-@@ -658,6 +662,7 @@
-     int sbuf_len, sbuf_off;
-     fd_set readfds, writefds;
-     short port = PORT;
-+    int use_ipv4, use_ipv6;
-     int full_log = 1;
-     char *host = SSL_HOST_NAME;
-     char *cert_file = NULL, *key_file = NULL, *chain_file = NULL;
-@@ -709,7 +714,11 @@
- #endif
-     char *sess_in = NULL;
-     char *sess_out = NULL;
--    struct sockaddr peer;
-+#if OPENSSL_USE_IPV6
-+    struct sockaddr_storage peer;
-+#else
-+    struct sockaddr_in peer;
-+#endif
-     int peerlen = sizeof(peer);
-     int fallback_scsv = 0;
-     int enable_timeouts = 0;
-@@ -737,6 +746,12 @@
- 
-     meth = SSLv23_client_method();
- 
-+    use_ipv4 = 1;
-+#if OPENSSL_USE_IPV6
-+    use_ipv6 = 1;
-+#else
-+    use_ipv6 = 0;
-+#endif
-     apps_startup();
-     c_Pause = 0;
-     c_quiet = 0;
-@@ -1096,6 +1111,16 @@
-             jpake_secret = *++argv;
-         }
- #endif
-+	else if (strcmp(*argv,"-4") == 0) {
-+	    use_ipv4 = 1;
-+	    use_ipv6 = 0;
-+	}
-+#if OPENSSL_USE_IPV6
-+	else if (strcmp(*argv,"-6") == 0) {
-+	    use_ipv4 = 0;
-+	    use_ipv6 = 1;
-+	}
-+#endif
- #ifndef OPENSSL_NO_SRTP
-         else if (strcmp(*argv, "-use_srtp") == 0) {
-             if (--argc < 1)
-@@ -1421,7 +1446,7 @@
- 
-  re_start:
- 
--    if (init_client(&s, host, port, socket_type) == 0) {
-+    if (init_client(&s, host, port, socket_type, use_ipv4, use_ipv6) == 0) {
-         BIO_printf(bio_err, "connect:errno=%d\n", get_last_socket_error());
-         SHUTDOWN(s);
-         goto end;
-@@ -1444,7 +1469,7 @@
-     if (socket_type == SOCK_DGRAM) {
- 
-         sbio = BIO_new_dgram(s, BIO_NOCLOSE);
--        if (getsockname(s, &peer, (void *)&peerlen) < 0) {
-+        if (getsockname(s, (struct sockaddr *)&peer, (void *)&peerlen) < 0) {
-             BIO_printf(bio_err, "getsockname:errno=%d\n",
-                        get_last_socket_error());
-             SHUTDOWN(s);
---- openssl-1.0.2/apps/s_server.c
-+++ openssl-1.0.2/apps/s_server.c
-@@ -643,6 +643,10 @@
-     BIO_printf(bio_err,
-                " -alpn arg  - set the advertised protocols for the ALPN extension (comma-separated list)\n");
- #endif
-+    BIO_printf(bio_err, " -4            - use IPv4 only\n");
-+#if OPENSSL_USE_IPV6
-+    BIO_printf(bio_err, " -6            - use IPv6 only\n");
-+#endif
-     BIO_printf(bio_err,
-                " -keymatexport label   - Export keying material using label\n");
-     BIO_printf(bio_err,
-@@ -1070,6 +1074,7 @@
-     int state = 0;
-     const SSL_METHOD *meth = NULL;
-     int socket_type = SOCK_STREAM;
-+    int use_ipv4, use_ipv6;
-     ENGINE *e = NULL;
-     char *inrand = NULL;
-     int s_cert_format = FORMAT_PEM, s_key_format = FORMAT_PEM;
-@@ -1111,6 +1116,12 @@
- 
-     meth = SSLv23_server_method();
- 
-+    use_ipv4 = 1;
-+#if OPENSSL_USE_IPV6
-+    use_ipv6 = 1;
-+#else
-+    use_ipv6 = 0;
-+#endif
-     local_argc = argc;
-     local_argv = argv;
- 
-@@ -1503,6 +1514,16 @@
-             jpake_secret = *(++argv);
-         }
- #endif
-+	else if (strcmp(*argv,"-4") == 0) {
-+	    use_ipv4 = 1;
-+	    use_ipv6 = 0;
-+	}
-+#if OPENSSL_USE_IPV6
-+	else if (strcmp(*argv,"-6") == 0) {
-+	    use_ipv4 = 0;
-+	    use_ipv6 = 1;
-+	}
-+#endif
- #ifndef OPENSSL_NO_SRTP
-         else if (strcmp(*argv, "-use_srtp") == 0) {
-             if (--argc < 1)
-@@ -2023,13 +2044,13 @@
-     (void)BIO_flush(bio_s_out);
-     if (rev)
-         do_server(port, socket_type, &accept_socket, rev_body, context,
--                  naccept);
-+                  naccept, use_ipv4, use_ipv6);
-     else if (www)
-         do_server(port, socket_type, &accept_socket, www_body, context,
--                  naccept);
-+                  naccept, use_ipv4, use_ipv6);
-     else
-         do_server(port, socket_type, &accept_socket, sv_body, context,
--                  naccept);
-+                  naccept, use_ipv4, use_ipv6);
-     print_stats(bio_s_out, ctx);
-     ret = 0;
-  end:
---- openssl-1.0.2/apps/s_socket.c
-+++ openssl-1.0.2/apps/s_socket.c
-@@ -101,16 +101,16 @@
- #  include "netdb.h"
- # endif
- 
--static struct hostent *GetHostByName(char *name);
-+static struct hostent *GetHostByName(char *name, int domain);
- # if defined(OPENSSL_SYS_WINDOWS) || (defined(OPENSSL_SYS_NETWARE) && !defined(NETWARE_BSDSOCK))
- static void ssl_sock_cleanup(void);
- # endif
- static int ssl_sock_init(void);
--static int init_client_ip(int *sock, unsigned char ip[4], int port, int type);
--static int init_server(int *sock, int port, int type);
--static int init_server_long(int *sock, int port, char *ip, int type);
-+static int init_client_ip(int *sock, unsigned char *ip, int port, int type, int domain);
-+static int init_server(int *sock, int port, int type, int use_ipv4, int use_ipv6);
-+static int init_server_long(int *sock, int port, char *ip, int type, int use_ipv4, int use_ipv6);
- static int do_accept(int acc_sock, int *sock, char **host);
--static int host_ip(char *str, unsigned char ip[4]);
-+static int host_ip(char *str, unsigned char *ip, int domain);
- 
- # ifdef OPENSSL_SYS_WIN16
- #  define SOCKET_PROTOCOL 0     /* more microsoft stupidity */
-@@ -231,38 +231,68 @@
-     return (1);
- }
- 
--int init_client(int *sock, char *host, int port, int type)
-+int init_client(int *sock, char *host, int port, int type, int use_ipv4, int use_ipv6)
- {
-+# if OPENSSL_USE_IPV6
-+    unsigned char ip[16];
-+# else
-     unsigned char ip[4];
-+# endif
- 
--    memset(ip, '\0', sizeof ip);
--    if (!host_ip(host, &(ip[0])))
--        return 0;
--    return init_client_ip(sock, ip, port, type);
--}
--
--static int init_client_ip(int *sock, unsigned char ip[4], int port, int type)
--{
--    unsigned long addr;
-+    if (use_ipv4)
-+	if (host_ip(host, ip, AF_INET))
-+	    return(init_client_ip(sock, ip, port, type, AF_INET));
-+# if OPENSSL_USE_IPV6
-+    if (use_ipv6)
-+	if (host_ip(host, ip, AF_INET6))
-+	    return(init_client_ip(sock, ip, port, type, AF_INET6));
-+# endif
-+    return 0;
-+}
-+
-+static int init_client_ip(int *sock, unsigned char ip[4], int port, int type, int domain)
-+{
-+# if OPENSSL_USE_IPV6
-+    struct sockaddr_storage them;
-+    struct sockaddr_in *them_in = (struct sockaddr_in *)&them;
-+    struct sockaddr_in6 *them_in6 = (struct sockaddr_in6 *)&them;
-+# else
-     struct sockaddr_in them;
-+    struct sockaddr_in *them_in = &them;
-+# endif
-+    socklen_t addr_len;
-     int s, i;
- 
-     if (!ssl_sock_init())
-         return (0);
- 
-     memset((char *)&them, 0, sizeof(them));
--    them.sin_family = AF_INET;
--    them.sin_port = htons((unsigned short)port);
--    addr = (unsigned long)
--        ((unsigned long)ip[0] << 24L) |
--        ((unsigned long)ip[1] << 16L) |
--        ((unsigned long)ip[2] << 8L) | ((unsigned long)ip[3]);
--    them.sin_addr.s_addr = htonl(addr);
-+    if (domain == AF_INET) {
-+	addr_len = (socklen_t)sizeof(struct sockaddr_in);
-+	them_in->sin_family=AF_INET;
-+	them_in->sin_port=htons((unsigned short)port);
-+# ifndef BIT_FIELD_LIMITS
-+	memcpy(&them_in->sin_addr.s_addr, ip, 4);
-+# else
-+	memcpy(&them_in->sin_addr, ip, 4);
-+# endif
-+    }
-+    else
-+# if OPENSSL_USE_IPV6
-+    {
-+	addr_len = (socklen_t)sizeof(struct sockaddr_in6);
-+	them_in6->sin6_family=AF_INET6;
-+	them_in6->sin6_port=htons((unsigned short)port);
-+	memcpy(&(them_in6->sin6_addr), ip, sizeof(struct in6_addr));
-+    }
-+# else
-+	return(0);
-+# endif
- 
-     if (type == SOCK_STREAM)
--        s = socket(AF_INET, SOCK_STREAM, SOCKET_PROTOCOL);
-+        s = socket(domain, SOCK_STREAM, SOCKET_PROTOCOL);
-     else                        /* ( type == SOCK_DGRAM) */
--        s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
-+        s = socket(domain, SOCK_DGRAM, IPPROTO_UDP);
- 
-     if (s == INVALID_SOCKET) {
-         perror("socket");
-@@ -280,7 +310,7 @@
-     }
- # endif
- 
--    if (connect(s, (struct sockaddr *)&them, sizeof(them)) == -1) {
-+    if (connect(s, (struct sockaddr *)&them, addr_len) == -1) {
-         closesocket(s);
-         perror("connect");
-         return (0);
-@@ -292,14 +322,14 @@
- int do_server(int port, int type, int *ret,
-               int (*cb) (char *hostname, int s, int stype,
-                          unsigned char *context), unsigned char *context,
--              int naccept)
-+              int naccept, int use_ipv4, int use_ipv6)
- {
-     int sock;
-     char *name = NULL;
-     int accept_socket = 0;
-     int i;
- 
--    if (!init_server(&accept_socket, port, type))
-+    if (!init_server(&accept_socket, port, type, use_ipv4, use_ipv6))
-         return (0);
- 
-     if (ret != NULL) {
-@@ -328,32 +358,41 @@
-     }
- }
- 
--static int init_server_long(int *sock, int port, char *ip, int type)
-+static int init_server_long(int *sock, int port, char *ip, int type, int use_ipv4, int use_ipv6)
- {
-     int ret = 0;
-+    int domain;
-+# if OPENSSL_USE_IPV6
-+    struct sockaddr_storage server;
-+    struct sockaddr_in *server_in = (struct sockaddr_in *)&server;
-+    struct sockaddr_in6 *server_in6 = (struct sockaddr_in6 *)&server;
-+# else
-     struct sockaddr_in server;
-+    struct sockaddr_in *server_in = &server;
-+# endif
-+    socklen_t addr_len;
-     int s = -1;
- 
-+    if (!use_ipv4 && !use_ipv6)
-+	goto err;
-+# if OPENSSL_USE_IPV6
-+    /* we are fine here */
-+# else
-+    if (use_ipv6)
-+	goto err;
-+# endif
-     if (!ssl_sock_init())
-         return (0);
- 
--    memset((char *)&server, 0, sizeof(server));
--    server.sin_family = AF_INET;
--    server.sin_port = htons((unsigned short)port);
--    if (ip == NULL)
--        server.sin_addr.s_addr = INADDR_ANY;
--    else
--/* Added for T3E, address-of fails on bit field (beckman@acl.lanl.gov) */
--# ifndef BIT_FIELD_LIMITS
--        memcpy(&server.sin_addr.s_addr, ip, 4);
-+#if OPENSSL_USE_IPV6
-+    domain = use_ipv6 ? AF_INET6 : AF_INET;
- # else
--        memcpy(&server.sin_addr, ip, 4);
-+    domain = AF_INET;
- # endif
--
-     if (type == SOCK_STREAM)
--        s = socket(AF_INET, SOCK_STREAM, SOCKET_PROTOCOL);
--    else                        /* type == SOCK_DGRAM */
--        s = socket(AF_INET, SOCK_DGRAM, IPPROTO_UDP);
-+	s=socket(domain, SOCK_STREAM, SOCKET_PROTOCOL);
-+    else /* type == SOCK_DGRAM */
-+	s=socket(domain, SOCK_DGRAM, IPPROTO_UDP);
- 
-     if (s == INVALID_SOCKET)
-         goto err;
-@@ -363,7 +402,42 @@
-         setsockopt(s, SOL_SOCKET, SO_REUSEADDR, (void *)&j, sizeof j);
-     }
- # endif
--    if (bind(s, (struct sockaddr *)&server, sizeof(server)) == -1) {
-+# if OPENSSL_USE_IPV6
-+    if ((use_ipv4 == 0) && (use_ipv6 == 1)) {
-+	const int on = 1;
-+
-+	setsockopt(s, IPPROTO_IPV6, IPV6_V6ONLY,
-+		    (const void *) &on, sizeof(int));
-+    }
-+# endif
-+    if (domain == AF_INET) {
-+	addr_len = (socklen_t)sizeof(struct sockaddr_in);
-+	memset(server_in, 0, sizeof(struct sockaddr_in));
-+	server_in->sin_family=AF_INET;
-+	server_in->sin_port = htons((unsigned short)port);
-+	if (ip == NULL)
-+	    server_in->sin_addr.s_addr = htonl(INADDR_ANY);
-+	else
-+/* Added for T3E, address-of fails on bit field (beckman@acl.lanl.gov) */
-+# ifndef BIT_FIELD_LIMITS
-+	    memcpy(&server_in->sin_addr.s_addr, ip, 4);
-+# else
-+	    memcpy(&server_in->sin_addr, ip, 4);
-+# endif
-+    }
-+# if OPENSSL_USE_IPV6
-+    else {
-+	addr_len = (socklen_t)sizeof(struct sockaddr_in6);
-+	memset(server_in6, 0, sizeof(struct sockaddr_in6));
-+	server_in6->sin6_family = AF_INET6;
-+	server_in6->sin6_port = htons((unsigned short)port);
-+	if (ip == NULL)
-+	    server_in6->sin6_addr = in6addr_any;
-+	else
-+	    memcpy(&server_in6->sin6_addr, ip, sizeof(struct in6_addr));
-+    }
-+# endif
-+    if (bind(s, (struct sockaddr *)&server, addr_len) == -1) {
- # ifndef OPENSSL_SYS_WINDOWS
-         perror("bind");
- # endif
-@@ -381,16 +455,23 @@
-     return (ret);
- }
- 
--static int init_server(int *sock, int port, int type)
-+static int init_server(int *sock, int port, int type, int use_ipv4, int use_ipv6)
- {
--    return (init_server_long(sock, port, NULL, type));
-+    return (init_server_long(sock, port, NULL, type, use_ipv4, use_ipv6));
- }
- 
- static int do_accept(int acc_sock, int *sock, char **host)
- {
-     int ret;
-     struct hostent *h1, *h2;
--    static struct sockaddr_in from;
-+#if OPENSSL_USE_IPV6
-+    struct sockaddr_storage from;
-+    struct sockaddr_in *from_in = (struct sockaddr_in *)&from;
-+    struct sockaddr_in6 *from_in6 = (struct sockaddr_in6 *)&from;
-+#else
-+    struct sockaddr_in from;
-+    struct sockaddr_in *from_in = &from;
-+#endif
-     int len;
- /*      struct linger ling; */
- 
-@@ -440,14 +521,25 @@
- 
-     if (host == NULL)
-         goto end;
-+# if OPENSSL_USE_IPV6
-+    if (from.ss_family == AF_INET)
-+# else
-+    if (from.sin_family == AF_INET)
-+# endif
- # ifndef BIT_FIELD_LIMITS
--    /* I should use WSAAsyncGetHostByName() under windows */
--    h1 = gethostbyaddr((char *)&from.sin_addr.s_addr,
--                       sizeof(from.sin_addr.s_addr), AF_INET);
-+	/* I should use WSAAsyncGetHostByName() under windows */
-+	h1 = gethostbyaddr((char *)&from_in->sin_addr.s_addr,
-+                	    sizeof(from_in->sin_addr.s_addr), AF_INET);
- # else
--    h1 = gethostbyaddr((char *)&from.sin_addr,
--                       sizeof(struct in_addr), AF_INET);
-+	h1 = gethostbyaddr((char *)&from_in->sin_addr,
-+            		    sizeof(struct in_addr), AF_INET);
-+# endif
-+# if OPENSSL_USE_IPV6
-+    else
-+	h1 = gethostbyaddr((char *)&from_in6->sin6_addr,
-+			    sizeof(struct in6_addr), AF_INET6);
- # endif
-+	    
-     if (h1 == NULL) {
-         BIO_printf(bio_err, "bad gethostbyaddr\n");
-         *host = NULL;
-@@ -460,14 +552,22 @@
-         }
-         BUF_strlcpy(*host, h1->h_name, strlen(h1->h_name) + 1);
- 
--        h2 = GetHostByName(*host);
-+# if OPENSSL_USE_IPV6
-+	h2=GetHostByName(*host, from.ss_family);
-+# else
-+	h2=GetHostByName(*host, from.sin_family);
-+# endif
-         if (h2 == NULL) {
-             BIO_printf(bio_err, "gethostbyname failure\n");
-             closesocket(ret);
-             return (0);
-         }
--        if (h2->h_addrtype != AF_INET) {
--            BIO_printf(bio_err, "gethostbyname addr is not AF_INET\n");
-+# if OPENSSL_USE_IPV6
-+	if (h2->h_addrtype != from.ss_family) {
-+# else
-+	if (h2->h_addrtype != from.sin_family) {
-+# endif
-+            BIO_printf(bio_err, "gethostbyname addr is not correct\n");
-             closesocket(ret);
-             return (0);
-         }
-@@ -483,14 +583,14 @@
-     char *h, *p;
- 
-     h = str;
--    p = strchr(str, ':');
-+    p = strrchr(str, ':');
-     if (p == NULL) {
-         BIO_printf(bio_err, "no port defined\n");
-         return (0);
-     }
-     *(p++) = '\0';
- 
--    if ((ip != NULL) && !host_ip(str, ip))
-+    if ((ip != NULL) && !host_ip(str, ip, AF_INET))
-         goto err;
-     if (host_ptr != NULL)
-         *host_ptr = h;
-@@ -502,44 +602,51 @@
-     return (0);
- }
- 
--static int host_ip(char *str, unsigned char ip[4])
-+static int host_ip(char *str, unsigned char *ip, int domain)
- {
-     unsigned int in[4];
-+    unsigned long l;
-     int i;
- 
--    if (sscanf(str, "%u.%u.%u.%u", &(in[0]), &(in[1]), &(in[2]), &(in[3])) ==
--        4) {
-+    if ((domain == AF_INET) && (sscanf(str, "%u.%u.%u.%u", &(in[0]), &(in[1]), &(in[2]), &(in[3])) == 4)) {
-         for (i = 0; i < 4; i++)
-             if (in[i] > 255) {
-                 BIO_printf(bio_err, "invalid IP address\n");
-                 goto err;
-             }
--        ip[0] = in[0];
--        ip[1] = in[1];
--        ip[2] = in[2];
--        ip[3] = in[3];
--    } else {                    /* do a gethostbyname */
-+	l=htonl((in[0]<<24L)|(in[1]<<16L)|(in[2]<<8L)|in[3]);
-+	memcpy(ip, &l, 4);
-+	return 1;
-+    }
-+# if OPENSSL_USE_IPV6
-+    else if ((domain == AF_INET6) && (inet_pton(AF_INET6, str, ip) == 1))
-+	return 1;
-+# endif
-+    else {                    /* do a gethostbyname */
-         struct hostent *he;
- 
-         if (!ssl_sock_init())
-             return (0);
- 
--        he = GetHostByName(str);
-+        he = GetHostByName(str, domain);
-         if (he == NULL) {
-             BIO_printf(bio_err, "gethostbyname failure\n");
-             goto err;
-         }
-         /* cast to short because of win16 winsock definition */
--        if ((short)he->h_addrtype != AF_INET) {
--            BIO_printf(bio_err, "gethostbyname addr is not AF_INET\n");
-+        if ((short)he->h_addrtype != domain) {
-+            BIO_printf(bio_err, "gethostbyname addr is not correct\n");
-             return (0);
-         }
--        ip[0] = he->h_addr_list[0][0];
--        ip[1] = he->h_addr_list[0][1];
--        ip[2] = he->h_addr_list[0][2];
--        ip[3] = he->h_addr_list[0][3];
-+	if (domain == AF_INET)
-+	    memset(ip, 0, 4);
-+# if OPENSSL_USE_IPV6
-+	else
-+	    memset(ip, 0, 16);
-+# endif
-+	memcpy(ip, he->h_addr_list[0], he->h_length);
-+	return 1;
-     }
--    return (1);
-  err:
-     return (0);
- }
-@@ -573,7 +680,7 @@
- static unsigned long ghbn_hits = 0L;
- static unsigned long ghbn_miss = 0L;
- 
--static struct hostent *GetHostByName(char *name)
-+static struct hostent *GetHostByName(char *name, int domain)
- {
-     struct hostent *ret;
-     int i, lowi = 0;
-@@ -585,13 +692,18 @@
-             lowi = i;
-         }
-         if (ghbn_cache[i].order > 0) {
--            if (strncmp(name, ghbn_cache[i].name, 128) == 0)
-+            if ((strncmp(name, ghbn_cache[i].name, 128) == 0) && (ghbn_cache[i].ent.h_addrtype == domain))
-                 break;
-         }
-     }
-     if (i == GHBN_NUM) {        /* no hit */
-         ghbn_miss++;
--        ret = gethostbyname(name);
-+        if (domain == AF_INET)
-+    	    ret = gethostbyname(name);
-+# if OPENSSL_USE_IPV6
-+	else
-+	    ret = gethostbyname2(name, AF_INET6);
-+# endif
-         if (ret == NULL)
-             return (NULL);
-         /* else add to cache */ 
diff --git a/system/base/openssl/files/openssl-1.0.2-parallel-build.patch b/system/base/openssl/files/openssl-1.0.2-parallel-build.patch
deleted file mode 100644
index ddd8a3d0..00000000
--- a/system/base/openssl/files/openssl-1.0.2-parallel-build.patch
+++ /dev/null
@@ -1,354 +0,0 @@
-http://rt.openssl.org/Ticket/Display.html?id=2084&user=guest&pass=guest
-
---- a/Makefile.org
-+++ b/Makefile.org
-@@ -247,17 +247,17 @@
- build_libs: build_crypto build_ssl build_engines
- 
- build_crypto:
--	@dir=crypto; target=all; $(BUILD_ONE_CMD)
-+	+@dir=crypto; target=all; $(BUILD_ONE_CMD)
--build_ssl:
-+build_ssl: build_crypto
--	@dir=ssl; target=all; $(BUILD_ONE_CMD)
-+	+@dir=ssl; target=all; $(BUILD_ONE_CMD)
--build_engines:
-+build_engines: build_crypto
--	@dir=engines; target=all; $(BUILD_ONE_CMD)
-+	+@dir=engines; target=all; $(BUILD_ONE_CMD)
--build_apps:
-+build_apps: build_libs
--	@dir=apps; target=all; $(BUILD_ONE_CMD)
-+	+@dir=apps; target=all; $(BUILD_ONE_CMD)
--build_tests:
-+build_tests: build_libs
--	@dir=test; target=all; $(BUILD_ONE_CMD)
-+	+@dir=test; target=all; $(BUILD_ONE_CMD)
--build_tools:
-+build_tools: build_libs
--	@dir=tools; target=all; $(BUILD_ONE_CMD)
-+	+@dir=tools; target=all; $(BUILD_ONE_CMD)
- 
- all_testapps: build_libs build_testapps
- build_testapps:
-@@ -497,9 +497,9 @@
- dist_pem_h:
- 	(cd crypto/pem; $(MAKE) -e $(BUILDENV) pem.h; $(MAKE) clean)
- 
--install: all install_docs install_sw
-+install: install_docs install_sw
- 
--install_sw:
-+install_dirs:
- 	@$(PERL) $(TOP)/util/mkdir-p.pl $(INSTALL_PREFIX)$(INSTALLTOP)/bin \
- 		$(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR) \
- 		$(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines \
-@@ -508,6 +508,13 @@
- 		$(INSTALL_PREFIX)$(OPENSSLDIR)/misc \
- 		$(INSTALL_PREFIX)$(OPENSSLDIR)/certs \
- 		$(INSTALL_PREFIX)$(OPENSSLDIR)/private
-+	@$(PERL) $(TOP)/util/mkdir-p.pl \
-+		$(INSTALL_PREFIX)$(MANDIR)/man1 \
-+		$(INSTALL_PREFIX)$(MANDIR)/man3 \
-+		$(INSTALL_PREFIX)$(MANDIR)/man5 \
-+		$(INSTALL_PREFIX)$(MANDIR)/man7
-+
-+install_sw: install_dirs
- 	@set -e; headerlist="$(EXHEADER)"; for i in $$headerlist;\
- 	do \
- 	(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
-@@ -511,7 +511,7 @@
- 	(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
- 	chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
- 	done;
--	@set -e; target=install; $(RECURSIVE_BUILD_CMD)
-+	+@set -e; target=install; $(RECURSIVE_BUILD_CMD)
- 	@set -e; liblist="$(LIBS)"; for i in $$liblist ;\
- 	do \
- 		if [ -f "$$i" ]; then \
-@@ -593,12 +600,7 @@
- 		done; \
- 	done
- 
--install_docs:
--	@$(PERL) $(TOP)/util/mkdir-p.pl \
--		$(INSTALL_PREFIX)$(MANDIR)/man1 \
--		$(INSTALL_PREFIX)$(MANDIR)/man3 \
--		$(INSTALL_PREFIX)$(MANDIR)/man5 \
--		$(INSTALL_PREFIX)$(MANDIR)/man7
-+install_docs: install_dirs
- 	@pod2man="`cd ./util; ./pod2mantest $(PERL)`"; \
- 	here="`pwd`"; \
- 	filecase=; \
---- a/Makefile.shared
-+++ b/Makefile.shared
-@@ -105,6 +105,7 @@ LINK_SO=	\
-     SHAREDFLAGS="$${SHAREDFLAGS:-$(CFLAGS) $(SHARED_LDFLAGS)}"; \
-     LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
-     LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
-+    [ -e $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX ] && exit 0; \
-     LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
-     $${SHAREDCMD} $${SHAREDFLAGS} \
- 	-o $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX \
-@@ -122,6 +124,7 @@ SYMLINK_SO=	\
- 			done; \
- 		fi; \
- 		if [ -n "$$SHLIB_SOVER" ]; then \
-+			[ -e "$$SHLIB$$SHLIB_SUFFIX" ] || \
- 			( $(SET_X); rm -f $$SHLIB$$SHLIB_SUFFIX; \
- 			  ln -s $$prev $$SHLIB$$SHLIB_SUFFIX ); \
- 		fi; \
---- a/crypto/Makefile
-+++ b/crypto/Makefile
-@@ -85,11 +85,11 @@
- 	@if [ -z "$(THIS)" ]; then $(MAKE) -f $(TOP)/Makefile reflect THIS=$@; fi
- 
- subdirs:
--	@target=all; $(RECURSIVE_MAKE)
-+	+@target=all; $(RECURSIVE_MAKE)
- 
- files:
- 	$(PERL) $(TOP)/util/files.pl "CPUID_OBJ=$(CPUID_OBJ)" Makefile >> $(TOP)/MINFO
--	@target=files; $(RECURSIVE_MAKE)
-+	+@target=files; $(RECURSIVE_MAKE)
- 
- links:
- 	@$(PERL) $(TOP)/util/mklink.pl ../include/openssl $(EXHEADER)
-@@ -100,7 +100,7 @@
- # lib: $(LIB): are splitted to avoid end-less loop
- lib:	$(LIB)
- 	@touch lib
--$(LIB):	$(LIBOBJ)
-+$(LIB):	$(LIBOBJ) | subdirs
- 	$(AR) $(LIB) $(LIBOBJ)
- 	$(RANLIB) $(LIB) || echo Never mind.
- 
-@@ -110,7 +110,7 @@
- 	fi
- 
- libs:
--	@target=lib; $(RECURSIVE_MAKE)
-+	+@target=lib; $(RECURSIVE_MAKE)
- 
- install:
- 	@[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
-@@ -119,7 +119,7 @@
- 	(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
- 	chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
- 	done;
--	@target=install; $(RECURSIVE_MAKE)
-+	+@target=install; $(RECURSIVE_MAKE)
- 
- lint:
- 	@target=lint; $(RECURSIVE_MAKE)
---- a/engines/Makefile
-+++ b/engines/Makefile
-@@ -72,7 +72,7 @@
- 
- all:	lib subdirs
- 
--lib:	$(LIBOBJ)
-+lib:	$(LIBOBJ) | subdirs
- 	@if [ -n "$(SHARED_LIBS)" ]; then \
- 		set -e; \
- 		for l in $(LIBNAMES); do \
-@@ -89,7 +89,7 @@
- 
- subdirs:
- 	echo $(EDIRS)
--	@target=all; $(RECURSIVE_MAKE)
-+	+@target=all; $(RECURSIVE_MAKE)
- 
- files:
- 	$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
-@@ -128,7 +128,7 @@
- 			  mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx ); \
- 		done; \
- 	fi
--	@target=install; $(RECURSIVE_MAKE)
-+	+@target=install; $(RECURSIVE_MAKE)
- 
- tags:
- 	ctags $(SRC)
---- a/test/Makefile
-+++ b/test/Makefile
-@@ -123,7 +123,7 @@
- tags:
- 	ctags $(SRC)
- 
--tests:	exe apps $(TESTS)
-+tests:	exe $(TESTS)
- 
- apps:
- 	@(cd ..; $(MAKE) DIRS=apps all)
-@@ -365,109 +365,109 @@
- 		link_app.$${shlib_target}
- 
- $(RSATEST)$(EXE_EXT): $(RSATEST).o $(DLIBCRYPTO)
--	@target=$(RSATEST); $(BUILD_CMD)
-+	+@target=$(RSATEST); $(BUILD_CMD)
- 
- $(BNTEST)$(EXE_EXT): $(BNTEST).o $(DLIBCRYPTO)
--	@target=$(BNTEST); $(BUILD_CMD)
-+	+@target=$(BNTEST); $(BUILD_CMD)
- 
- $(ECTEST)$(EXE_EXT): $(ECTEST).o $(DLIBCRYPTO)
--	@target=$(ECTEST); $(BUILD_CMD)
-+	+@target=$(ECTEST); $(BUILD_CMD)
- 
- $(EXPTEST)$(EXE_EXT): $(EXPTEST).o $(DLIBCRYPTO)
--	@target=$(EXPTEST); $(BUILD_CMD)
-+	+@target=$(EXPTEST); $(BUILD_CMD)
- 
- $(IDEATEST)$(EXE_EXT): $(IDEATEST).o $(DLIBCRYPTO)
--	@target=$(IDEATEST); $(BUILD_CMD)
-+	+@target=$(IDEATEST); $(BUILD_CMD)
- 
- $(MD2TEST)$(EXE_EXT): $(MD2TEST).o $(DLIBCRYPTO)
--	@target=$(MD2TEST); $(BUILD_CMD)
-+	+@target=$(MD2TEST); $(BUILD_CMD)
- 
- $(SHATEST)$(EXE_EXT): $(SHATEST).o $(DLIBCRYPTO)
--	@target=$(SHATEST); $(BUILD_CMD)
-+	+@target=$(SHATEST); $(BUILD_CMD)
- 
- $(SHA1TEST)$(EXE_EXT): $(SHA1TEST).o $(DLIBCRYPTO)
--	@target=$(SHA1TEST); $(BUILD_CMD)
-+	+@target=$(SHA1TEST); $(BUILD_CMD)
- 
- $(SHA256TEST)$(EXE_EXT): $(SHA256TEST).o $(DLIBCRYPTO)
--	@target=$(SHA256TEST); $(BUILD_CMD)
-+	+@target=$(SHA256TEST); $(BUILD_CMD)
- 
- $(SHA512TEST)$(EXE_EXT): $(SHA512TEST).o $(DLIBCRYPTO)
--	@target=$(SHA512TEST); $(BUILD_CMD)
-+	+@target=$(SHA512TEST); $(BUILD_CMD)
- 
- $(RMDTEST)$(EXE_EXT): $(RMDTEST).o $(DLIBCRYPTO)
--	@target=$(RMDTEST); $(BUILD_CMD)
-+	+@target=$(RMDTEST); $(BUILD_CMD)
- 
- $(MDC2TEST)$(EXE_EXT): $(MDC2TEST).o $(DLIBCRYPTO)
--	@target=$(MDC2TEST); $(BUILD_CMD)
-+	+@target=$(MDC2TEST); $(BUILD_CMD)
- 
- $(MD4TEST)$(EXE_EXT): $(MD4TEST).o $(DLIBCRYPTO)
--	@target=$(MD4TEST); $(BUILD_CMD)
-+	+@target=$(MD4TEST); $(BUILD_CMD)
- 
- $(MD5TEST)$(EXE_EXT): $(MD5TEST).o $(DLIBCRYPTO)
--	@target=$(MD5TEST); $(BUILD_CMD)
-+	+@target=$(MD5TEST); $(BUILD_CMD)
- 
- $(HMACTEST)$(EXE_EXT): $(HMACTEST).o $(DLIBCRYPTO)
--	@target=$(HMACTEST); $(BUILD_CMD)
-+	+@target=$(HMACTEST); $(BUILD_CMD)
- 
- $(WPTEST)$(EXE_EXT): $(WPTEST).o $(DLIBCRYPTO)
--	@target=$(WPTEST); $(BUILD_CMD)
-+	+@target=$(WPTEST); $(BUILD_CMD)
- 
- $(RC2TEST)$(EXE_EXT): $(RC2TEST).o $(DLIBCRYPTO)
--	@target=$(RC2TEST); $(BUILD_CMD)
-+	+@target=$(RC2TEST); $(BUILD_CMD)
- 
- $(BFTEST)$(EXE_EXT): $(BFTEST).o $(DLIBCRYPTO)
--	@target=$(BFTEST); $(BUILD_CMD)
-+	+@target=$(BFTEST); $(BUILD_CMD)
- 
- $(CASTTEST)$(EXE_EXT): $(CASTTEST).o $(DLIBCRYPTO)
--	@target=$(CASTTEST); $(BUILD_CMD)
-+	+@target=$(CASTTEST); $(BUILD_CMD)
- 
- $(RC4TEST)$(EXE_EXT): $(RC4TEST).o $(DLIBCRYPTO)
--	@target=$(RC4TEST); $(BUILD_CMD)
-+	+@target=$(RC4TEST); $(BUILD_CMD)
- 
- $(RC5TEST)$(EXE_EXT): $(RC5TEST).o $(DLIBCRYPTO)
--	@target=$(RC5TEST); $(BUILD_CMD)
-+	+@target=$(RC5TEST); $(BUILD_CMD)
- 
- $(DESTEST)$(EXE_EXT): $(DESTEST).o $(DLIBCRYPTO)
--	@target=$(DESTEST); $(BUILD_CMD)
-+	+@target=$(DESTEST); $(BUILD_CMD)
- 
- $(RANDTEST)$(EXE_EXT): $(RANDTEST).o $(DLIBCRYPTO)
--	@target=$(RANDTEST); $(BUILD_CMD)
-+	+@target=$(RANDTEST); $(BUILD_CMD)
- 
- $(DHTEST)$(EXE_EXT): $(DHTEST).o $(DLIBCRYPTO)
--	@target=$(DHTEST); $(BUILD_CMD)
-+	+@target=$(DHTEST); $(BUILD_CMD)
- 
- $(DSATEST)$(EXE_EXT): $(DSATEST).o $(DLIBCRYPTO)
--	@target=$(DSATEST); $(BUILD_CMD)
-+	+@target=$(DSATEST); $(BUILD_CMD)
- 
- $(METHTEST)$(EXE_EXT): $(METHTEST).o $(DLIBCRYPTO)
--	@target=$(METHTEST); $(BUILD_CMD)
-+	+@target=$(METHTEST); $(BUILD_CMD)
- 
- $(SSLTEST)$(EXE_EXT): $(SSLTEST).o $(DLIBSSL) $(DLIBCRYPTO)
--	@target=$(SSLTEST); $(FIPS_BUILD_CMD)
-+	+@target=$(SSLTEST); $(FIPS_BUILD_CMD)
- 
- $(ENGINETEST)$(EXE_EXT): $(ENGINETEST).o $(DLIBCRYPTO)
--	@target=$(ENGINETEST); $(BUILD_CMD)
-+	+@target=$(ENGINETEST); $(BUILD_CMD)
- 
- $(EVPTEST)$(EXE_EXT): $(EVPTEST).o $(DLIBCRYPTO)
--	@target=$(EVPTEST); $(BUILD_CMD)
-+	+@target=$(EVPTEST); $(BUILD_CMD)
- 
- $(ECDSATEST)$(EXE_EXT): $(ECDSATEST).o $(DLIBCRYPTO)
--	@target=$(ECDSATEST); $(BUILD_CMD)
-+	+@target=$(ECDSATEST); $(BUILD_CMD)
- 
- $(ECDHTEST)$(EXE_EXT): $(ECDHTEST).o $(DLIBCRYPTO)
--	@target=$(ECDHTEST); $(BUILD_CMD)
-+	+@target=$(ECDHTEST); $(BUILD_CMD)
- 
- $(IGETEST)$(EXE_EXT): $(IGETEST).o $(DLIBCRYPTO)
--	@target=$(IGETEST); $(BUILD_CMD)
-+	+@target=$(IGETEST); $(BUILD_CMD)
- 
- $(JPAKETEST)$(EXE_EXT): $(JPAKETEST).o $(DLIBCRYPTO)
--	@target=$(JPAKETEST); $(BUILD_CMD)
-+	+@target=$(JPAKETEST); $(BUILD_CMD)
- 
- $(ASN1TEST)$(EXE_EXT): $(ASN1TEST).o $(DLIBCRYPTO)
--	@target=$(ASN1TEST); $(BUILD_CMD)
-+	+@target=$(ASN1TEST); $(BUILD_CMD)
- 
- $(SRPTEST)$(EXE_EXT): $(SRPTEST).o $(DLIBCRYPTO)
--	@target=$(SRPTEST); $(BUILD_CMD)
-+	+@target=$(SRPTEST); $(BUILD_CMD)
- 
- #$(AESTEST).o: $(AESTEST).c
- #	$(CC) -c $(CFLAGS) -DINTERMEDIATE_VALUE_KAT -DTRACE_KAT_MCT $(AESTEST).c
-@@ -480,7 +480,7 @@
- #	fi
- 
- dummytest$(EXE_EXT): dummytest.o $(DLIBCRYPTO)
--	@target=dummytest; $(BUILD_CMD)
-+	+@target=dummytest; $(BUILD_CMD)
- 
- # DO NOT DELETE THIS LINE -- make depend depends on it.
- 
---- a/crypto/objects/Makefile
-+++ b/crypto/objects/Makefile
-@@ -44,11 +44,11 @@ obj_dat.h: obj_dat.pl obj_mac.h
- # objects.pl both reads and writes obj_mac.num
- obj_mac.h: objects.pl objects.txt obj_mac.num
- 	$(PERL) objects.pl objects.txt obj_mac.num obj_mac.h
--	@sleep 1; touch obj_mac.h; sleep 1
- 
--obj_xref.h: objxref.pl obj_xref.txt obj_mac.num
-+# This doesn't really need obj_mac.h, but since that rule reads & writes
-+# obj_mac.num, we can't run in parallel with it.
-+obj_xref.h: objxref.pl obj_xref.txt obj_mac.num obj_mac.h
- 	$(PERL) objxref.pl obj_mac.num obj_xref.txt > obj_xref.h
--	@sleep 1; touch obj_xref.h; sleep 1
- 
- files:
- 	$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO 
diff --git a/system/base/openssl/files/openssl-1.0.2-s_client-verify.patch b/system/base/openssl/files/openssl-1.0.2-s_client-verify.patch
deleted file mode 100644
index 25be5632..00000000
--- a/system/base/openssl/files/openssl-1.0.2-s_client-verify.patch
+++ /dev/null
@@ -1,17 +0,0 @@
-https://bugs.gentoo.org/472584
-http://rt.openssl.org/Ticket/Display.html?id=2387&user=guest&pass=guest
-
-fix verification handling in s_client.  when loading paths, make sure
-we properly fallback to setting the default paths.
-
---- openssl-1.0.2/apps/s_client.c
-+++ openssl-1.0.2/apps/s_client.c
-@@ -1337,7 +1337,7 @@
- 
-     SSL_CTX_set_verify(ctx, verify, verify_callback);
- 
--    if ((!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) ||
-+    if ((!SSL_CTX_load_verify_locations(ctx, CAfile, CApath)) &&
-         (!SSL_CTX_set_default_verify_paths(ctx))) {
-         /*
-          * BIO_printf(bio_err,"error setting default verify locations\n"); 
diff --git a/system/base/openssl/files/openssl-1.0.2a-malloc-typo.patch b/system/base/openssl/files/openssl-1.0.2a-malloc-typo.patch
deleted file mode 100644
index ad12835a..00000000
--- a/system/base/openssl/files/openssl-1.0.2a-malloc-typo.patch
+++ /dev/null
@@ -1,37 +0,0 @@
-https://rt.openssl.org/Ticket/Display.html?id=3758
-
-From 7b4152089fe39c3495508076ab81ed4aca3d65ba Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Sat, 21 Mar 2015 05:08:41 -0400
-Subject: [PATCH] fix malloc define typo
-
-Reported-by: Conrad Kostecki <ck+gentoobugzilla@bl4ckb0x.de>
-URL: https://bugs.gentoo.org/543828
----
- crypto/bio/bss_dgram.c | 4 ++--
- 1 file changed, 2 insertions(+), 2 deletions(-)
-
-diff --git a/crypto/bio/bss_dgram.c b/crypto/bio/bss_dgram.c
-index aef8149..ed275d1 100644
---- a/crypto/bio/bss_dgram.c
-+++ b/crypto/bio/bss_dgram.c
-@@ -1338,7 +1338,7 @@ static int dgram_sctp_read(BIO *b, char *out, int outl)
-                 (socklen_t) (sizeof(sctp_assoc_t) + 256 * sizeof(uint8_t));
-             authchunks = OPENSSL_malloc(optlen);
-             if (!authchunks) {
--                BIOerr(BIO_F_DGRAM_SCTP_READ, ERR_R_MALLOC_ERROR);
-+                BIOerr(BIO_F_DGRAM_SCTP_READ, ERR_R_MALLOC_FAILURE);
-                 return -1;
-             }
-             memset(authchunks, 0, optlen);
-@@ -1410,7 +1410,7 @@ static int dgram_sctp_write(BIO *b, const char *in, int inl)
-         char *tmp;
-         data->saved_message.bio = b;
-         if(!(tmp = OPENSSL_malloc(inl))) {
--            BIOerr(BIO_F_DGRAM_SCTP_WRITE, ERR_R_MALLOC_ERROR);
-+            BIOerr(BIO_F_DGRAM_SCTP_WRITE, ERR_R_MALLOC_FAILURE);
-             return -1;
-         }
-         if (data->saved_message.data)
--- 
-2.3.3
diff --git a/system/base/openssl/files/openssl-1.0.2a-parallel-build.patch b/system/base/openssl/files/openssl-1.0.2a-parallel-build.patch
deleted file mode 100644
index bf4f9079..00000000
--- a/system/base/openssl/files/openssl-1.0.2a-parallel-build.patch
+++ /dev/null
@@ -1,314 +0,0 @@
-https://rt.openssl.org/Ticket/Display.html?id=2084&user=guest&pass=guest
-https://rt.openssl.org/Ticket/Display.html?id=3738&user=guest&pass=guest
-
---- openssl-1.0.2a/crypto/Makefile
-+++ openssl-1.0.2a/crypto/Makefile
-@@ -85,11 +85,11 @@
- 	@if [ -z "$(THIS)" ]; then $(MAKE) -f $(TOP)/Makefile reflect THIS=$@; fi
- 
- subdirs:
--	@target=all; $(RECURSIVE_MAKE)
-+	+@target=all; $(RECURSIVE_MAKE)
- 
- files:
- 	$(PERL) $(TOP)/util/files.pl "CPUID_OBJ=$(CPUID_OBJ)" Makefile >> $(TOP)/MINFO
--	@target=files; $(RECURSIVE_MAKE)
-+	+@target=files; $(RECURSIVE_MAKE)
- 
- links:
- 	@$(PERL) $(TOP)/util/mklink.pl ../include/openssl $(EXHEADER)
-@@ -100,7 +100,7 @@
- # lib: $(LIB): are splitted to avoid end-less loop
- lib:	$(LIB)
- 	@touch lib
--$(LIB):	$(LIBOBJ)
-+$(LIB):	$(LIBOBJ) | subdirs
- 	$(AR) $(LIB) $(LIBOBJ)
- 	test -z "$(FIPSLIBDIR)" || $(AR) $(LIB) $(FIPSLIBDIR)fipscanister.o
- 	$(RANLIB) $(LIB) || echo Never mind.
-@@ -111,7 +111,7 @@
- 	fi
- 
- libs:
--	@target=lib; $(RECURSIVE_MAKE)
-+	+@target=lib; $(RECURSIVE_MAKE)
- 
- install:
- 	@[ -n "$(INSTALLTOP)" ] # should be set by top Makefile...
-@@ -120,7 +120,7 @@
- 	(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
- 	chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
- 	done;
--	@target=install; $(RECURSIVE_MAKE)
-+	+@target=install; $(RECURSIVE_MAKE)
- 
- lint:
- 	@target=lint; $(RECURSIVE_MAKE)
---- openssl-1.0.2a/engines/Makefile
-+++ openssl-1.0.2a/engines/Makefile
-@@ -72,7 +72,7 @@
- 
- all:	lib subdirs
- 
--lib:	$(LIBOBJ)
-+lib:	$(LIBOBJ) | subdirs
- 	@if [ -n "$(SHARED_LIBS)" ]; then \
- 		set -e; \
- 		for l in $(LIBNAMES); do \
-@@ -89,7 +89,7 @@
- 
- subdirs:
- 	echo $(EDIRS)
--	@target=all; $(RECURSIVE_MAKE)
-+	+@target=all; $(RECURSIVE_MAKE)
- 
- files:
- 	$(PERL) $(TOP)/util/files.pl Makefile >> $(TOP)/MINFO
-@@ -128,7 +128,7 @@
- 			  mv -f $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx.new $(INSTALL_PREFIX)$(INSTALLTOP)/$(LIBDIR)/engines/$$pfx$$l$$sfx ); \
- 		done; \
- 	fi
--	@target=install; $(RECURSIVE_MAKE)
-+	+@target=install; $(RECURSIVE_MAKE)
- 
- tags:
- 	ctags $(SRC)
---- openssl-1.0.2a/Makefile.org
-+++ openssl-1.0.2a/Makefile.org
-@@ -274,17 +274,17 @@
- build_libs: build_crypto build_ssl build_engines
- 
- build_crypto:
--	@dir=crypto; target=all; $(BUILD_ONE_CMD)
-+	+@dir=crypto; target=all; $(BUILD_ONE_CMD)
--build_ssl:
-+build_ssl: build_crypto
--	@dir=ssl; target=all; $(BUILD_ONE_CMD)
-+	+@dir=ssl; target=all; $(BUILD_ONE_CMD)
--build_engines:
-+build_engines: build_crypto
--	@dir=engines; target=all; $(BUILD_ONE_CMD)
-+	+@dir=engines; target=all; $(BUILD_ONE_CMD)
--build_apps:
-+build_apps: build_libs
--	@dir=apps; target=all; $(BUILD_ONE_CMD)
-+	+@dir=apps; target=all; $(BUILD_ONE_CMD)
--build_tests:
-+build_tests: build_libs
--	@dir=test; target=all; $(BUILD_ONE_CMD)
-+	+@dir=test; target=all; $(BUILD_ONE_CMD)
--build_tools:
-+build_tools: build_libs
--	@dir=tools; target=all; $(BUILD_ONE_CMD)
-+	+@dir=tools; target=all; $(BUILD_ONE_CMD)
- 
- all_testapps: build_libs build_testapps
- build_testapps:
-@@ -555,7 +555,7 @@
- 	(cp $$i $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i; \
- 	chmod 644 $(INSTALL_PREFIX)$(INSTALLTOP)/include/openssl/$$i ); \
- 	done;
--	@set -e; target=install; $(RECURSIVE_BUILD_CMD)
-+	+@set -e; target=install; $(RECURSIVE_BUILD_CMD)
- 	@set -e; liblist="$(LIBS)"; for i in $$liblist ;\
- 	do \
- 		if [ -f "$$i" ]; then \
---- openssl-1.0.2a/Makefile.shared
-+++ openssl-1.0.2a/Makefile.shared
-@@ -105,6 +105,7 @@
-     SHAREDFLAGS="$${SHAREDFLAGS:-$(CFLAGS) $(SHARED_LDFLAGS)}"; \
-     LIBPATH=`for x in $$LIBDEPS; do echo $$x; done | sed -e 's/^ *-L//;t' -e d | uniq`; \
-     LIBPATH=`echo $$LIBPATH | sed -e 's/ /:/g'`; \
-+    [ -e $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX ] && exit 0; \
-     LD_LIBRARY_PATH=$$LIBPATH:$$LD_LIBRARY_PATH \
-     $${SHAREDCMD} $${SHAREDFLAGS} \
- 	-o $$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX \
-@@ -122,6 +123,7 @@
- 			done; \
- 		fi; \
- 		if [ -n "$$SHLIB_SOVER" ]; then \
-+			[ -e "$$SHLIB$$SHLIB_SUFFIX" ] || \
- 			( $(SET_X); rm -f $$SHLIB$$SHLIB_SUFFIX; \
- 			  ln -s $$prev $$SHLIB$$SHLIB_SUFFIX ); \
- 		fi; \
---- openssl-1.0.2a/test/Makefile
-+++ openssl-1.0.2a/test/Makefile
-@@ -133,7 +133,7 @@
- tags:
- 	ctags $(SRC)
- 
--tests:	exe apps $(TESTS)
-+tests:	exe $(TESTS)
- 
- apps:
- 	@(cd ..; $(MAKE) DIRS=apps all)
-@@ -402,121 +402,121 @@
- 		link_app.$${shlib_target}
- 
- $(RSATEST)$(EXE_EXT): $(RSATEST).o $(DLIBCRYPTO)
--	@target=$(RSATEST); $(BUILD_CMD)
-+	+@target=$(RSATEST); $(BUILD_CMD)
- 
- $(BNTEST)$(EXE_EXT): $(BNTEST).o $(DLIBCRYPTO)
--	@target=$(BNTEST); $(BUILD_CMD)
-+	+@target=$(BNTEST); $(BUILD_CMD)
- 
- $(ECTEST)$(EXE_EXT): $(ECTEST).o $(DLIBCRYPTO)
--	@target=$(ECTEST); $(BUILD_CMD)
-+	+@target=$(ECTEST); $(BUILD_CMD)
- 
- $(EXPTEST)$(EXE_EXT): $(EXPTEST).o $(DLIBCRYPTO)
--	@target=$(EXPTEST); $(BUILD_CMD)
-+	+@target=$(EXPTEST); $(BUILD_CMD)
- 
- $(IDEATEST)$(EXE_EXT): $(IDEATEST).o $(DLIBCRYPTO)
--	@target=$(IDEATEST); $(BUILD_CMD)
-+	+@target=$(IDEATEST); $(BUILD_CMD)
- 
- $(MD2TEST)$(EXE_EXT): $(MD2TEST).o $(DLIBCRYPTO)
--	@target=$(MD2TEST); $(BUILD_CMD)
-+	+@target=$(MD2TEST); $(BUILD_CMD)
- 
- $(SHATEST)$(EXE_EXT): $(SHATEST).o $(DLIBCRYPTO)
--	@target=$(SHATEST); $(BUILD_CMD)
-+	+@target=$(SHATEST); $(BUILD_CMD)
- 
- $(SHA1TEST)$(EXE_EXT): $(SHA1TEST).o $(DLIBCRYPTO)
--	@target=$(SHA1TEST); $(BUILD_CMD)
-+	+@target=$(SHA1TEST); $(BUILD_CMD)
- 
- $(SHA256TEST)$(EXE_EXT): $(SHA256TEST).o $(DLIBCRYPTO)
--	@target=$(SHA256TEST); $(BUILD_CMD)
-+	+@target=$(SHA256TEST); $(BUILD_CMD)
- 
- $(SHA512TEST)$(EXE_EXT): $(SHA512TEST).o $(DLIBCRYPTO)
--	@target=$(SHA512TEST); $(BUILD_CMD)
-+	+@target=$(SHA512TEST); $(BUILD_CMD)
- 
- $(RMDTEST)$(EXE_EXT): $(RMDTEST).o $(DLIBCRYPTO)
--	@target=$(RMDTEST); $(BUILD_CMD)
-+	+@target=$(RMDTEST); $(BUILD_CMD)
- 
- $(MDC2TEST)$(EXE_EXT): $(MDC2TEST).o $(DLIBCRYPTO)
--	@target=$(MDC2TEST); $(BUILD_CMD)
-+	+@target=$(MDC2TEST); $(BUILD_CMD)
- 
- $(MD4TEST)$(EXE_EXT): $(MD4TEST).o $(DLIBCRYPTO)
--	@target=$(MD4TEST); $(BUILD_CMD)
-+	+@target=$(MD4TEST); $(BUILD_CMD)
- 
- $(MD5TEST)$(EXE_EXT): $(MD5TEST).o $(DLIBCRYPTO)
--	@target=$(MD5TEST); $(BUILD_CMD)
-+	+@target=$(MD5TEST); $(BUILD_CMD)
- 
- $(HMACTEST)$(EXE_EXT): $(HMACTEST).o $(DLIBCRYPTO)
--	@target=$(HMACTEST); $(BUILD_CMD)
-+	+@target=$(HMACTEST); $(BUILD_CMD)
- 
- $(WPTEST)$(EXE_EXT): $(WPTEST).o $(DLIBCRYPTO)
--	@target=$(WPTEST); $(BUILD_CMD)
-+	+@target=$(WPTEST); $(BUILD_CMD)
- 
- $(RC2TEST)$(EXE_EXT): $(RC2TEST).o $(DLIBCRYPTO)
--	@target=$(RC2TEST); $(BUILD_CMD)
-+	+@target=$(RC2TEST); $(BUILD_CMD)
- 
- $(BFTEST)$(EXE_EXT): $(BFTEST).o $(DLIBCRYPTO)
--	@target=$(BFTEST); $(BUILD_CMD)
-+	+@target=$(BFTEST); $(BUILD_CMD)
- 
- $(CASTTEST)$(EXE_EXT): $(CASTTEST).o $(DLIBCRYPTO)
--	@target=$(CASTTEST); $(BUILD_CMD)
-+	+@target=$(CASTTEST); $(BUILD_CMD)
- 
- $(RC4TEST)$(EXE_EXT): $(RC4TEST).o $(DLIBCRYPTO)
--	@target=$(RC4TEST); $(BUILD_CMD)
-+	+@target=$(RC4TEST); $(BUILD_CMD)
- 
- $(RC5TEST)$(EXE_EXT): $(RC5TEST).o $(DLIBCRYPTO)
--	@target=$(RC5TEST); $(BUILD_CMD)
-+	+@target=$(RC5TEST); $(BUILD_CMD)
- 
- $(DESTEST)$(EXE_EXT): $(DESTEST).o $(DLIBCRYPTO)
--	@target=$(DESTEST); $(BUILD_CMD)
-+	+@target=$(DESTEST); $(BUILD_CMD)
- 
- $(RANDTEST)$(EXE_EXT): $(RANDTEST).o $(DLIBCRYPTO)
--	@target=$(RANDTEST); $(BUILD_CMD)
-+	+@target=$(RANDTEST); $(BUILD_CMD)
- 
- $(DHTEST)$(EXE_EXT): $(DHTEST).o $(DLIBCRYPTO)
--	@target=$(DHTEST); $(BUILD_CMD)
-+	+@target=$(DHTEST); $(BUILD_CMD)
- 
- $(DSATEST)$(EXE_EXT): $(DSATEST).o $(DLIBCRYPTO)
--	@target=$(DSATEST); $(BUILD_CMD)
-+	+@target=$(DSATEST); $(BUILD_CMD)
- 
- $(METHTEST)$(EXE_EXT): $(METHTEST).o $(DLIBCRYPTO)
--	@target=$(METHTEST); $(BUILD_CMD)
-+	+@target=$(METHTEST); $(BUILD_CMD)
- 
- $(SSLTEST)$(EXE_EXT): $(SSLTEST).o $(DLIBSSL) $(DLIBCRYPTO)
--	@target=$(SSLTEST); $(FIPS_BUILD_CMD)
-+	+@target=$(SSLTEST); $(FIPS_BUILD_CMD)
- 
- $(ENGINETEST)$(EXE_EXT): $(ENGINETEST).o $(DLIBCRYPTO)
--	@target=$(ENGINETEST); $(BUILD_CMD)
-+	+@target=$(ENGINETEST); $(BUILD_CMD)
- 
- $(EVPTEST)$(EXE_EXT): $(EVPTEST).o $(DLIBCRYPTO)
--	@target=$(EVPTEST); $(BUILD_CMD)
-+	+@target=$(EVPTEST); $(BUILD_CMD)
- 
- $(EVPEXTRATEST)$(EXE_EXT): $(EVPEXTRATEST).o $(DLIBCRYPTO)
--	@target=$(EVPEXTRATEST); $(BUILD_CMD)
-+	+@target=$(EVPEXTRATEST); $(BUILD_CMD)
- 
- $(ECDSATEST)$(EXE_EXT): $(ECDSATEST).o $(DLIBCRYPTO)
--	@target=$(ECDSATEST); $(BUILD_CMD)
-+	+@target=$(ECDSATEST); $(BUILD_CMD)
- 
- $(ECDHTEST)$(EXE_EXT): $(ECDHTEST).o $(DLIBCRYPTO)
--	@target=$(ECDHTEST); $(BUILD_CMD)
-+	+@target=$(ECDHTEST); $(BUILD_CMD)
- 
- $(IGETEST)$(EXE_EXT): $(IGETEST).o $(DLIBCRYPTO)
--	@target=$(IGETEST); $(BUILD_CMD)
-+	+@target=$(IGETEST); $(BUILD_CMD)
- 
- $(JPAKETEST)$(EXE_EXT): $(JPAKETEST).o $(DLIBCRYPTO)
--	@target=$(JPAKETEST); $(BUILD_CMD)
-+	+@target=$(JPAKETEST); $(BUILD_CMD)
- 
- $(ASN1TEST)$(EXE_EXT): $(ASN1TEST).o $(DLIBCRYPTO)
--	@target=$(ASN1TEST); $(BUILD_CMD)
-+	+@target=$(ASN1TEST); $(BUILD_CMD)
- 
- $(SRPTEST)$(EXE_EXT): $(SRPTEST).o $(DLIBCRYPTO)
--	@target=$(SRPTEST); $(BUILD_CMD)
-+	+@target=$(SRPTEST); $(BUILD_CMD)
- 
- $(V3NAMETEST)$(EXE_EXT): $(V3NAMETEST).o $(DLIBCRYPTO)
--	@target=$(V3NAMETEST); $(BUILD_CMD)
-+	+@target=$(V3NAMETEST); $(BUILD_CMD)
- 
- $(HEARTBEATTEST)$(EXE_EXT): $(HEARTBEATTEST).o $(DLIBCRYPTO)
--	@target=$(HEARTBEATTEST); $(BUILD_CMD_STATIC)
-+	+@target=$(HEARTBEATTEST); $(BUILD_CMD_STATIC)
- 
- $(CONSTTIMETEST)$(EXE_EXT): $(CONSTTIMETEST).o
--	@target=$(CONSTTIMETEST) $(BUILD_CMD)
-+	+@target=$(CONSTTIMETEST) $(BUILD_CMD)
- 
- #$(AESTEST).o: $(AESTEST).c
- #	$(CC) -c $(CFLAGS) -DINTERMEDIATE_VALUE_KAT -DTRACE_KAT_MCT $(AESTEST).c
-@@ -529,7 +529,7 @@
- #	fi
- 
- dummytest$(EXE_EXT): dummytest.o $(DLIBCRYPTO)
--	@target=dummytest; $(BUILD_CMD)
-+	+@target=dummytest; $(BUILD_CMD)
- 
- # DO NOT DELETE THIS LINE -- make depend depends on it.
- 
\ No newline at end of file
diff --git a/system/base/openssl/files/openssl-1.0.2a-x32-asm.patch b/system/base/openssl/files/openssl-1.0.2a-x32-asm.patch
deleted file mode 100644
index e8d4baba..00000000
--- a/system/base/openssl/files/openssl-1.0.2a-x32-asm.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-https://rt.openssl.org/Ticket/Display.html?id=3759&user=guest&pass=guest
-
-From 6257d59b3a68d2feb9d64317a1c556dc3813ee61 Mon Sep 17 00:00:00 2001
-From: Mike Frysinger <vapier@gentoo.org>
-Date: Sat, 21 Mar 2015 06:01:25 -0400
-Subject: [PATCH] crypto: use bigint in x86-64 perl
-
-When building on x32 systems where the default type is 32bit, make sure
-we can transparently represent 64bit integers.  Otherwise we end up with
-build errors like:
-/usr/bin/perl asm/ghash-x86_64.pl elf > ghash-x86_64.s
-Integer overflow in hexadecimal number at asm/../../perlasm/x86_64-xlate.pl line 201, <> line 890.
-...
-ghash-x86_64.s: Assembler messages:
-ghash-x86_64.s:890: Error: junk '.15473355479995e+19' after expression
-
-We don't enable this globally as there are some cases where we'd get
-32bit values interpreted as unsigned when we need them as signed.
-
-Reported-by: Bertrand Jacquin <bertrand@jacquin.bzh>
-URL: https://bugs.gentoo.org/542618
----
- crypto/perlasm/x86_64-xlate.pl | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/crypto/perlasm/x86_64-xlate.pl b/crypto/perlasm/x86_64-xlate.pl
-index aae8288..0bf9774 100755
---- a/crypto/perlasm/x86_64-xlate.pl
-+++ b/crypto/perlasm/x86_64-xlate.pl
-@@ -195,6 +195,10 @@ my %globals;
-     sub out {
-     	my $self = shift;
- 
-+	# When building on x32 ABIs, the expanded hex value might be too
-+	# big to fit into 32bits.  Enable transparent 64bit support here
-+	# so we can safely print it out.
-+	use bigint;
- 	if ($gas) {
- 	    # Solaris /usr/ccs/bin/as can't handle multiplications
- 	    # in $self->{value}
--- 
-2.3.3
diff --git a/system/base/openssl/files/openssl-alpha-ccc.patch b/system/base/openssl/files/openssl-alpha-ccc.patch
new file mode 100644
index 00000000..f16485ad
--- /dev/null
+++ b/system/base/openssl/files/openssl-alpha-ccc.patch
@@ -0,0 +1,11 @@
+diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
+--- openssl-1.0.2a.orig/Configure	2015-03-19 14:30:36.000000000 +0100
++++ openssl-1.0.2a/Configure	2015-03-20 14:30:07.165989047 +0100
+@@ -442,6 +442,7 @@
+ "linux-alpha+bwx-gcc","gcc:-O3 -DL_ENDIAN::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+ "linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
+ "linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
++"linux-alpha+bwx-ccc-generic","ccc:-fast -generic -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
+ 
+ # Android: linux-* but without pointers to headers and libs.
+ "android","gcc:-mandroid -I\$(ANDROID_DEV)/include -B\$(ANDROID_DEV)/lib -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
diff --git a/system/base/openssl/files/openssl-asflag.patch b/system/base/openssl/files/openssl-asflag.patch
new file mode 100644
index 00000000..aadad1bd
--- /dev/null
+++ b/system/base/openssl/files/openssl-asflag.patch
@@ -0,0 +1,11 @@
+--- openssl-1.0.0/Makefile.org.orig	2010-04-10 11:17:55.964995600 +0200
++++ openssl-1.0.0/Makefile.org	2010-04-10 11:19:41.144993924 +0200
+@@ -178,7 +178,7 @@
+ 
+ BUILDENV=	PLATFORM='$(PLATFORM)' PROCESSOR='$(PROCESSOR)' \
+ 		CC='$(CC)' CFLAG='$(CFLAG)' 			\
+-		AS='$(CC)' ASFLAG='$(CFLAG) -c'			\
++		AS='$(AS)' ASFLAG='$(ASFLAG)'			\
+ 		AR='$(AR)' NM='$(NM)' RANLIB='$(RANLIB)'	\
+ 		CROSS_COMPILE='$(CROSS_COMPILE)'	\
+ 		PERL='$(PERL)' ENGDIRS='$(ENGDIRS)'		\
diff --git a/system/base/openssl/files/openssl-c_rehash.sh b/system/base/openssl/files/openssl-c_rehash.sh
new file mode 100644
index 00000000..0ea22637
--- /dev/null
+++ b/system/base/openssl/files/openssl-c_rehash.sh
@@ -0,0 +1,210 @@
+#!/bin/sh
+#
+# Ben Secrest <blsecres@gmail.com>
+#
+# sh c_rehash script, scan all files in a directory
+# and add symbolic links to their hash values.
+#
+# based on the c_rehash perl script distributed with openssl
+#
+# LICENSE: See OpenSSL license
+# ^^acceptable?^^
+#
+
+# default certificate location
+DIR=/etc/openssl
+
+# for filetype bitfield
+IS_CERT=$(( 1 << 0 ))
+IS_CRL=$(( 1 << 1 ))
+
+
+# check to see if a file is a certificate file or a CRL file
+# arguments:
+#       1. the filename to be scanned
+# returns:
+#       bitfield of file type; uses ${IS_CERT} and ${IS_CRL}
+#
+check_file()
+{
+    local IS_TYPE=0
+
+    # make IFS a newline so we can process grep output line by line
+    local OLDIFS=${IFS}
+    IFS=$( printf "\n" )
+
+    # XXX: could be more efficient to have two 'grep -m' but is -m portable?
+    for LINE in $( grep '^-----BEGIN .*-----' ${1} )
+    do
+	if echo ${LINE} \
+	    | grep -q -E '^-----BEGIN (X509 |TRUSTED )?CERTIFICATE-----'
+	then
+	    IS_TYPE=$(( ${IS_TYPE} | ${IS_CERT} ))
+
+	    if [ $(( ${IS_TYPE} & ${IS_CRL} )) -ne 0 ]
+	    then
+	    	break
+	    fi
+	elif echo ${LINE} | grep -q '^-----BEGIN X509 CRL-----'
+	then
+	    IS_TYPE=$(( ${IS_TYPE} | ${IS_CRL} ))
+
+	    if [ $(( ${IS_TYPE} & ${IS_CERT} )) -ne 0 ]
+	    then
+	    	break
+	    fi
+	fi
+    done
+
+    # restore IFS
+    IFS=${OLDIFS}
+
+    return ${IS_TYPE}
+}
+
+
+#
+# use openssl to fingerprint a file
+#    arguments:
+#	1. the filename to fingerprint
+#	2. the method to use (x509, crl)
+#    returns:
+#	none
+#    assumptions:
+#	user will capture output from last stage of pipeline
+#
+fingerprint()
+{
+    ${SSL_CMD} ${2} -fingerprint -noout -in ${1} | sed 's/^.*=//' | tr -d ':'
+}
+
+
+#
+# link_hash - create links to certificate files
+#    arguments:
+#       1. the filename to create a link for
+#	2. the type of certificate being linked (x509, crl)
+#    returns:
+#	0 on success, 1 otherwise
+#
+link_hash()
+{
+    local FINGERPRINT=$( fingerprint ${1} ${2} )
+    local HASH=$( ${SSL_CMD} ${2} -hash -noout -in ${1} )
+    local SUFFIX=0
+    local LINKFILE=''
+    local TAG=''
+
+    if [ ${2} = "crl" ]
+    then
+    	TAG='r'
+    fi
+
+    LINKFILE=${HASH}.${TAG}${SUFFIX}
+
+    while [ -f ${LINKFILE} ]
+    do
+	if [ ${FINGERPRINT} = $( fingerprint ${LINKFILE} ${2} ) ]
+	then
+	    echo "WARNING: Skipping duplicate file ${1}" >&2
+	    return 1
+	fi	
+
+	SUFFIX=$(( ${SUFFIX} + 1 ))
+	LINKFILE=${HASH}.${TAG}${SUFFIX}
+    done
+
+    echo "${1} => ${LINKFILE}"
+
+    # assume any system with a POSIX shell will either support symlinks or
+    # do something to handle this gracefully
+    ln -s ${1} ${LINKFILE}
+
+    return 0
+}
+
+
+# hash_dir create hash links in a given directory
+hash_dir()
+{
+    echo "Doing ${1}"
+
+    cd ${1}
+
+    ls -1 * 2>/dev/null | while read FILE
+    do
+        if echo ${FILE} | grep -q -E '^[[:xdigit:]]{8}\.r?[[:digit:]]+$' \
+	    	&& [ -h "${FILE}" ]
+        then
+            rm ${FILE}
+        fi
+    done
+
+    ls -1 *.pem *.cer *.crt *.crl 2>/dev/null | while read FILE
+    do
+	check_file ${FILE}
+        local FILE_TYPE=${?}
+	local TYPE_STR=''
+
+        if [ $(( ${FILE_TYPE} & ${IS_CERT} )) -ne 0 ]
+        then
+            TYPE_STR='x509'
+        elif [ $(( ${FILE_TYPE} & ${IS_CRL} )) -ne 0 ]
+        then
+            TYPE_STR='crl'
+        else
+            echo "WARNING: ${FILE} does not contain a certificate or CRL: skipping" >&2
+	    continue
+        fi
+
+	link_hash ${FILE} ${TYPE_STR}
+    done
+}
+
+
+# choose the name of an ssl application
+if [ -n "${OPENSSL}" ]
+then
+    SSL_CMD=$(which ${OPENSSL} 2>/dev/null)
+else
+    SSL_CMD=/usr/bin/openssl
+    OPENSSL=${SSL_CMD}
+    export OPENSSL
+fi
+
+# fix paths
+PATH=${PATH}:${DIR}/bin
+export PATH
+
+# confirm existance/executability of ssl command
+if ! [ -x ${SSL_CMD} ]
+then
+    echo "${0}: rehashing skipped ('openssl' program not available)" >&2
+    exit 0
+fi
+
+# determine which directories to process
+old_IFS=$IFS
+if [ ${#} -gt 0 ]
+then
+    IFS=':'
+    DIRLIST=${*}
+elif [ -n "${SSL_CERT_DIR}" ]
+then
+    DIRLIST=$SSL_CERT_DIR
+else
+    DIRLIST=${DIR}/certs
+fi
+
+IFS=':'
+
+# process directories
+for CERT_DIR in ${DIRLIST}
+do
+    if [ -d ${CERT_DIR} -a -w ${CERT_DIR} ]
+    then
+        IFS=$old_IFS
+        hash_dir ${CERT_DIR}
+        IFS=':'
+    fi
+done
diff --git a/system/base/openssl/files/openssl-ca-certificates.patch b/system/base/openssl/files/openssl-ca-certificates.patch
index 503d5efc..0221ac2b 100644
--- a/system/base/openssl/files/openssl-ca-certificates.patch
+++ b/system/base/openssl/files/openssl-ca-certificates.patch
@@ -6,7 +6,7 @@ diff -ruN openssl-1.0.2.orig/crypto/cryptlib.h openssl-1.0.2/crypto/cryptlib.h
  #  define X509_CERT_AREA          OPENSSLDIR
  #  define X509_CERT_DIR           OPENSSLDIR "/certs"
 -#  define X509_CERT_FILE          OPENSSLDIR "/cert.pem"
-+#  define X509_CERT_FILE          "/etc/ssl/certs/ca-certificates.crt"
++#  define X509_CERT_FILE          "/etc/pki/tls/certs/ca-bundle.crt"
  #  define X509_PRIVATE_DIR        OPENSSLDIR "/private"
  # else
- #  define X509_CERT_AREA          "SSLROOT:[000000]"
\ No newline at end of file
+ #  define X509_CERT_AREA          "SSLROOT:[000000]"
diff --git a/system/base/openssl/files/openssl-find.patch b/system/base/openssl/files/openssl-find.patch
new file mode 100644
index 00000000..30f6d8b9
--- /dev/null
+++ b/system/base/openssl/files/openssl-find.patch
@@ -0,0 +1,72 @@
+diff --git a/meta/recipes-connectivity/openssl/openssl-1.0.0i/find.pl b/meta/recipes-connectivity/openssl/openssl-1.0.0i/find.pl
+new file mode 100644
+index 0000000..8e1b42c
+--- /dev/null
++++ openssl-1.0.0i/find.pl
+@@ -0,0 +1,54 @@
++warn "Legacy library @{[(caller(0))[6]]} will be removed from the Perl core distribution in the next major release. Please install it from the CPAN distribution Perl4::CoreLibs. It is being used at @{[(caller)[1]]}, line @{[(caller)[2]]}.\n";
++
++# This library is deprecated and unmaintained. It is included for
++# compatibility with Perl 4 scripts which may use it, but it will be
++# removed in a future version of Perl. Please use the File::Find module
++# instead.
++
++# Usage:
++#	require "find.pl";
++#
++#	&find('/foo','/bar');
++#
++#	sub wanted { ... }
++#		where wanted does whatever you want.  $dir contains the
++#		current directory name, and $_ the current filename within
++#		that directory.  $name contains "$dir/$_".  You are cd'ed
++#		to $dir when the function is called.  The function may
++#		set $prune to prune the tree.
++#
++# For example,
++#
++#   find / -name .nfs\* -mtime +7 -exec rm -f {} \; -o -fstype nfs -prune
++#
++# corresponds to this
++#
++#	sub wanted {
++#	    /^\.nfs.*$/ &&
++#	    (($dev,$ino,$mode,$nlink,$uid,$gid) = lstat($_)) &&
++#	    int(-M _) > 7 &&
++#	    unlink($_)
++#	    ||
++#	    ($nlink || (($dev,$ino,$mode,$nlink,$uid,$gid) = lstat($_))) &&
++#	    $dev < 0 &&
++#	    ($prune = 1);
++#	}
++#
++# Set the variable $dont_use_nlink if you're using AFS, since AFS cheats.
++
++use File::Find ();
++
++*name		= *File::Find::name;
++*prune		= *File::Find::prune;
++*dir		= *File::Find::dir;
++*topdir		= *File::Find::topdir;
++*topdev		= *File::Find::topdev;
++*topino		= *File::Find::topino;
++*topmode	= *File::Find::topmode;
++*topnlink	= *File::Find::topnlink;
++
++sub find {
++    &File::Find::find(\&wanted, @_);
++}
++
++1;
+
+--- openssl-1.0.2m/util/perlpath.pl~	2017-10-26 23:34:32.000000000 +0300
++++ openssl-1.0.2m/util/perlpath.pl	2017-11-01 13:08:24.963877348 +0200
+@@ -4,7 +4,7 @@
+ # line in all scripts that rely on perl.
+ #
+ 
+-require "find.pl";
++require "./find.pl";
+ 
+ $#ARGV == 0 || print STDERR "usage: perlpath newpath  (eg /usr/bin)\n";
+ &find(".");
diff --git a/system/base/openssl/files/openssl-include.patch b/system/base/openssl/files/openssl-include.patch
index f07c029f..7b7b1cd0 100644
--- a/system/base/openssl/files/openssl-include.patch
+++ b/system/base/openssl/files/openssl-include.patch
@@ -1,31 +1,29 @@
-diff -ruN openssl-1.0.2.orig/Makefile.org openssl-1.0.2/Makefile.org
---- openssl-1.0.2.orig/Makefile.org	2015-01-22 15:58:06.000000000 +0100
-+++ openssl-1.0.2/Makefile.org	2015-01-27 16:04:30.564519915 +0100
-@@ -370,8 +370,8 @@
+--- openssl-1.0.2i/Makefile.org~	2016-09-19 18:24:29.000000000 +0300
++++ openssl-1.0.2i/Makefile.org	2016-09-19 18:24:58.456803714 +0300
+@@ -367,7 +367,7 @@
  	@ ( echo 'prefix=$(INSTALLTOP)'; \
-	    echo 'exec_prefix=$${prefix}'; \
-	    echo 'libdir=$${exec_prefix}/$(LIBDIR)'; \
+ 	    echo 'exec_prefix=$${prefix}'; \
+ 	    echo 'libdir=$${exec_prefix}/$(LIBDIR)'; \
 -	    echo 'includedir=$${prefix}/include'; \
 +	    echo 'includedir=$${prefix}/include/openssl'; \
-        echo 'enginesdir=$${libdir}/engines'; \
-	    echo ''; \
-	    echo 'Name: OpenSSL-libcrypto'; \
-	    echo 'Description: OpenSSL cryptography library'; \
-@@ -385,7 +385,7 @@
+ 	    echo 'enginesdir=$${libdir}/engines'; \
+ 	    echo ''; \
+ 	    echo 'Name: OpenSSL-libcrypto'; \
+@@ -374,7 +374,7 @@
  	@ ( echo 'prefix=$(INSTALLTOP)'; \
-	    echo 'exec_prefix=$${prefix}'; \
-	    echo 'libdir=$${exec_prefix}/$(LIBDIR)'; \
+ 	    echo 'exec_prefix=$${prefix}'; \
+ 	    echo 'libdir=$${exec_prefix}/$(LIBDIR)'; \
 -	    echo 'includedir=$${prefix}/include'; \
 +	    echo 'includedir=$${prefix}/include/openssl'; \
  	    echo ''; \
-	    echo 'Name: OpenSSL-libssl'; \
-	    echo 'Description: Secure Sockets Layer and cryptography libraries'; \
-@@ -399,7 +399,7 @@
+ 	    echo 'Name: OpenSSL-libssl'; \
+ 	    echo 'Description: Secure Sockets Layer and cryptography libraries'; \
+@@ -388,7 +388,7 @@
  	@ ( echo 'prefix=$(INSTALLTOP)'; \
-	    echo 'exec_prefix=$${prefix}'; \
-	    echo 'libdir=$${exec_prefix}/$(LIBDIR)'; \
+ 	    echo 'exec_prefix=$${prefix}'; \
+ 	    echo 'libdir=$${exec_prefix}/$(LIBDIR)'; \
 -	    echo 'includedir=$${prefix}/include'; \
 +	    echo 'includedir=$${prefix}/include/openssl'; \
  	    echo ''; \
-	    echo 'Name: OpenSSL'; \
-	    echo 'Description: Secure Sockets Layer and cryptography libraries and tools'; \
+ 	    echo 'Name: OpenSSL'; \
+ 	    echo 'Description: Secure Sockets Layer and cryptography libraries and tools'; \
diff --git a/system/base/openssl/files/openssl-1.0.0a-ldflags-norpath.patch b/system/base/openssl/files/openssl-ldflags.patch
similarity index 56%
rename from system/base/openssl/files/openssl-1.0.0a-ldflags-norpath.patch
rename to system/base/openssl/files/openssl-ldflags.patch
index e9dabe91..d53dd6f5 100644
--- a/system/base/openssl/files/openssl-1.0.0a-ldflags-norpath.patch
+++ b/system/base/openssl/files/openssl-ldflags.patch
@@ -1,25 +1,25 @@
-Index: openssl-1.0.0a/Makefile
-===================================================================
---- openssl-1.0.0a.orig/Makefile
-+++ openssl-1.0.0a/Makefile
-@@ -191,6 +191,7 @@ BUILDENV=	PLATFORM='$(PLATFORM)' PROCESS
+updated from http://bugs.gentoo.org/181438
+
+make sure we respect LDFLAGS
+
+--- openssl-1.0.0/Makefile.org.orig	2010-04-10 11:21:33.852993924 +0200
++++ openssl-1.0.0/Makefile.org	2010-04-10 11:22:52.248992248 +0200
+@@ -189,6 +189,7 @@
  		MAKEDEPEND='$$$${TOP}/util/domd $$$${TOP} -MD $(MAKEDEPPROG)' \
  		DEPFLAG='-DOPENSSL_NO_DEPRECATED $(DEPFLAG)'	\
  		MAKEDEPPROG='$(MAKEDEPPROG)'			\
-+		LDFLAGS='${LDFLAGS}'					\
++		LDFLAGS='$(LDFLAGS)'				\
  		SHARED_LDFLAGS='$(SHARED_LDFLAGS)'		\
  		KRB5_INCLUDES='$(KRB5_INCLUDES)' LIBKRB5='$(LIBKRB5)'	\
  		ZLIB_INCLUDE='$(ZLIB_INCLUDE)' LIBZLIB='$(LIBZLIB)'	\
-Index: openssl-1.0.0a/Makefile.shared
-===================================================================
---- openssl-1.0.0a.orig/Makefile.shared
-+++ openssl-1.0.0a/Makefile.shared
-@@ -153,7 +153,7 @@ DO_GNU_SO=$(CALC_VERSIONS); \
+--- openssl-0.9.8h/Makefile.shared
++++ openssl-0.9.8h/Makefile.shared
+@@ -153,7 +153,7 @@
  	NOALLSYMSFLAGS='-Wl,--no-whole-archive'; \
  	SHAREDFLAGS="$(CFLAGS) $(SHARED_LDFLAGS) -shared -Wl,-Bsymbolic -Wl,-soname=$$SHLIB$$SHLIB_SOVER$$SHLIB_SUFFIX"
  
 -DO_GNU_APP=LDFLAGS="$(CFLAGS) -Wl,-rpath,$(LIBRPATH)"
-+DO_GNU_APP=LDFLAGS="$(LDFLAGS) $(CFLAGS)"
++DO_GNU_APP=LDFLAGS="$(LDFLAGS) $(CFLAGS) -Wl,-rpath,$(LIBRPATH)"
  
  #This is rather special.  It's a special target with which one can link
  #applications without bothering with any features that have anything to
diff --git a/system/base/openssl/files/openssl-man-namespace.patch b/system/base/openssl/files/openssl-man-namespace.patch
new file mode 100644
index 00000000..2c3bd120
--- /dev/null
+++ b/system/base/openssl/files/openssl-man-namespace.patch
@@ -0,0 +1,25 @@
+--- openssl-1.0.0/Makefile.org.orig	2010-04-10 11:05:35.900993086 +0200
++++ openssl-1.0.0/Makefile.org	2010-04-10 11:16:15.052993924 +0200
+@@ -610,7 +610,7 @@
+ 			--release=$(VERSION) `basename $$i`") \
+ 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
+ 		$(PERL) util/extract-names.pl < $$i | \
+-			(grep -v $$filecase "^$$fn\$$"; true) | \
++			(grep -v -E $$filecase "^$${fn}|$${fn#openssl-}\$$"; true) | \
+ 			(grep -v "[	]"; true) | \
+ 			(cd $(INSTALL_PREFIX)$(MANDIR)/man$$sec/; \
+ 			 while read n; do \
+@@ -627,11 +627,11 @@
+ 			--release=$(VERSION) `basename $$i`") \
+ 			>  $(INSTALL_PREFIX)$(MANDIR)/man$$sec/$$fn.$${sec}$(MANSUFFIX); \
+ 		$(PERL) util/extract-names.pl < $$i | \
+-			(grep -v $$filecase "^$$fn\$$"; true) | \
++			(grep -v -E $$filecase "^$${fn#openssl-}\$$"; true) | \
+ 			(grep -v "[	]"; true) | \
+ 			(cd $(INSTALL_PREFIX)$(MANDIR)/man$$sec/; \
+ 			 while read n; do \
+-				PLATFORM=$(PLATFORM) $$here/util/point.sh $$fn.$${sec}$(MANSUFFIX) "$$n".$${sec}$(MANSUFFIX); \
++				PLATFORM=$(PLATFORM) $$here/util/point.sh $$fn.$${sec}$(MANSUFFIX) openssl-"$$n".$${sec}$(MANSUFFIX); \
+ 			 done); \
+ 	done
+ 
diff --git a/system/base/openssl/files/openssl-optflags.patch b/system/base/openssl/files/openssl-optflags.patch
index e8264511..a6d077e4 100644
--- a/system/base/openssl/files/openssl-optflags.patch
+++ b/system/base/openssl/files/openssl-optflags.patch
@@ -1,7 +1,11 @@
-diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
---- openssl-1.0.2a.orig/Configure	2015-03-19 14:30:36.000000000 +0100
-+++ openssl-1.0.2a/Configure	2015-03-20 14:52:48.785578415 +0100
-@@ -168,8 +168,8 @@
+Remove -f/-m/-O flags which would conflict with RPM_OPT_FLAGS or cause code
+built on a i686/ev6/sparcv9 to not run on a i386/ev5/sparcv7 and so on.
+
+...add $ENV{OPTFLAGS} instead
+
+--- openssl-1.0.2b/Configure.orig	2015-06-12 16:21:24.540170216 +0200
++++ openssl-1.0.2b/Configure	2015-06-12 18:45:01.027153237 +0200
+@@ -185,8 +185,8 @@
  #"b2-is-ri-dp",	"${tcc}:${tflags}::${tlib}:${bits2}IDEA_SHORT RC4_INDEX DES_PTR:${tbn_mul}::",
  
  # Our development configs
@@ -12,7 +16,7 @@ diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
  "debug-ben",	"gcc:$gcc_devteam_warn -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DDEBUG_SAFESTACK -O2 -pipe::(unknown):::::",
  "debug-ben-openbsd","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
  "debug-ben-openbsd-debug","gcc:-DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_CTX_DEBUG -DCRYPTO_MDEBUG -DPEDANTIC -DDEBUG_SAFESTACK -DOPENSSL_OPENBSD_DEV_CRYPTO -DOPENSSL_NO_ASM -g3 -O2 -pedantic -Wall -Wshadow -Werror -pipe::(unknown)::::",
-@@ -192,14 +192,14 @@
+@@ -209,14 +209,14 @@
  "debug-levitte-linux-noasm-extreme","gcc:-DLEVITTE_DEBUG -DREF_CHECK -DCONF_DEBUG -DBN_DEBUG -DBN_DEBUG_RAND -DCRYPTO_MDEBUG -DENGINE_CONF_DEBUG -DOPENSSL_NO_ASM -DL_ENDIAN -DPEDANTIC -ggdb -g3 -pedantic -ansi -Wall -W -Wundef -Wshadow -Wcast-align -Wstrict-prototypes -Wmissing-prototypes -Wno-long-long -Wundef -Wconversion -pipe::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
  "debug-geoff32","gcc:-DBN_DEBUG -DBN_DEBUG_RAND -DBN_STRICT -DPURIFY -DOPENSSL_NO_DEPRECATED -DOPENSSL_NO_ASM -DOPENSSL_NO_INLINE_ASM -DL_ENDIAN -DTERMIO -DPEDANTIC -O1 -ggdb2 -Wall -Werror -Wundef -pedantic -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wsign-compare -Wmissing-prototypes -Wmissing-declarations -Wno-long-long::-D_REENTRANT::-ldl:BN_LLONG:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
  "debug-geoff64","gcc:-DBN_DEBUG -DBN_DEBUG_RAND -DBN_STRICT -DPURIFY -DOPENSSL_NO_DEPRECATED -DOPENSSL_NO_ASM -DOPENSSL_NO_INLINE_ASM -DL_ENDIAN -DTERMIO -DPEDANTIC -O1 -ggdb2 -Wall -Werror -Wundef -pedantic -Wshadow -Wpointer-arith -Wbad-function-cast -Wcast-align -Wsign-compare -Wmissing-prototypes -Wmissing-declarations -Wno-long-long::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
@@ -35,7 +39,7 @@ diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
  "dist",		"cc:-O::(unknown)::::::",
  
  # Basic configs that should work on any (32 and less bit) box
-@@ -348,8 +348,8 @@
+@@ -365,8 +365,8 @@
  ####
  # *-generic* is endian-neutral target, but ./config is free to
  # throw in -D[BL]_ENDIAN, whichever appropriate...
@@ -46,7 +50,7 @@ diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
  
  #######################################################################
  # Note that -march is not among compiler options in below linux-armv4
-@@ -378,8 +378,8 @@
+@@ -395,31 +395,31 @@
  #
  #       ./Configure linux-armv4 -march=armv6 -D__ARM_MAX_ARCH__=8
  #
@@ -57,16 +61,20 @@ diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
  # Configure script adds minimally required -march for assembly support,
  # if no -march was specified at command line. mips32 and mips64 below
  # refer to contemporary MIPS Architecture specifications, MIPS32 and
-@@ -388,20 +388,20 @@
- "linux-mips64",   "gcc:-mabi=n32 -O3 -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:n32:dlfcn:linux-shared:-fPIC:-mabi=n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::32",
- "linux64-mips64",   "gcc:-mabi=64 -O3 -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:64:dlfcn:linux-shared:-fPIC:-mabi=64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+ # MIPS64, rather than to kernel bitness.
+-"linux-mips32",	"gcc:-mabi=32 -O3 -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips32_asm}:o32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-mips64",   "gcc:-mabi=n32 -O3 -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:n32:dlfcn:linux-shared:-fPIC:-mabi=n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::32",
+-"linux64-mips64",   "gcc:-mabi=64 -O3 -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:64:dlfcn:linux-shared:-fPIC:-mabi=64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
++"linux-mips32",	"gcc:-mabi=32 $ENV{OPTFLAGS} -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips32_asm}:o32:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-mips64",   "gcc:-mabi=n32 $ENV{OPTFLAGS} -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:n32:dlfcn:linux-shared:-fPIC:-mabi=n32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::32",
++"linux64-mips64",   "gcc:-mabi=64 $ENV{OPTFLAGS} -Wall -DBN_DIV3W::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${mips64_asm}:64:dlfcn:linux-shared:-fPIC:-mabi=64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
  #### IA-32 targets...
 -"linux-ia32-icc",	"icc:-DL_ENDIAN -O2::-D_REENTRANT::-ldl -no_cpprt:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-KPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 -"linux-elf",	"gcc:-DL_ENDIAN -O3 -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 -"linux-aout",	"gcc:-DL_ENDIAN -O3 -fomit-frame-pointer -march=i486 -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out",
 +"linux-ia32-icc",	"icc:-DL_ENDIAN $ENV{OPTFLAGS}::-D_REENTRANT::-ldl -no_cpprt:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-KPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-elf",	"gcc:-DL_ENDIAN $ENV{OPTFLAGS} -fomit-frame-pointer -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-aout",	"gcc:-DL_ENDIAN $ENV{OPTFLAGS} -fomit-frame-pointer -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out",
++"linux-elf",	"gcc:-DL_ENDIAN $ENV{OPTFLAGS} -Wall::-D_REENTRANT::-ldl:BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_elf_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-aout",	"gcc:-DL_ENDIAN $ENV{OPTFLAGS} -Wall::(unknown):::BN_LLONG ${x86_gcc_des} ${x86_gcc_opts}:${x86_asm}:a.out",
  ####
 -"linux-generic64","gcc:-O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL BF_PTR:${no_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 -"linux-ppc64",	"gcc:-m64 -DB_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${ppc64_asm}:linux64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
@@ -74,7 +82,8 @@ diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
 -"linux-ia64",	"gcc:-DL_ENDIAN -DTERMIO -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 -"linux-ia64-icc","icc:-DL_ENDIAN -O2 -Wall::-D_REENTRANT::-ldl -no_cpprt:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 -"linux-x86_64",	"gcc:-m64 -DL_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
--"linux-x86_64-clang",	"clang: -m64 -DL_ENDIAN -O3 -Weverything $clang_disabled_warnings -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+-"linux-x86_64-clang",	"clang: -m64 -DL_ENDIAN -O3 -Wall -Wextra $clang_disabled_warnings -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
+-"debug-linux-x86_64-clang",	"clang: -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -m64 -DL_ENDIAN -g -Wall -Wextra $clang_disabled_warnings -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
 -"linux-x86_64-icc", "icc:-DL_ENDIAN -O2::-D_REENTRANT::-ldl -no_cpprt:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
 -"linux-x32",	"gcc:-mx32 -DL_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-mx32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::x32",
 -"linux64-s390x",	"gcc:-m64 -DB_ENDIAN -O3 -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
@@ -84,14 +93,15 @@ diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
 +"linux-ia64",	"gcc:-DL_ENDIAN -DTERMIO $ENV{OPTFLAGS} -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_UNROLL DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"linux-ia64-icc","icc:-DL_ENDIAN $ENV{OPTFLAGS} -Wall::-D_REENTRANT::-ldl -no_cpprt:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_RISC1 DES_INT:${ia64_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
 +"linux-x86_64",	"gcc:-m64 -DL_ENDIAN $ENV{OPTFLAGS} -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
-+"linux-x86_64-clang",	"clang: -m64 -DL_ENDIAN $ENV{OPTFLAGS} -Weverything $clang_disabled_warnings -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
++"linux-x86_64-clang",	"clang: -m64 -DL_ENDIAN $ENV{OPTFLAGS} -Wall -Wextra $clang_disabled_warnings -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
++"debug-linux-x86_64-clang",	"clang: -DBN_DEBUG -DREF_CHECK -DCONF_DEBUG -DCRYPTO_MDEBUG -m64 -DL_ENDIAN $ENV{OPTFLAGS} -Wall -Wextra $clang_disabled_warnings -Qunused-arguments::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
 +"linux-x86_64-icc", "icc:-DL_ENDIAN $ENV{OPTFLAGS}::-D_REENTRANT::-ldl -no_cpprt:SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
 +"linux-x32",	"gcc:-mx32 -DL_ENDIAN $ENV{OPTFLAGS} -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT RC4_CHUNK_LL DES_INT DES_UNROLL:${x86_64_asm}:elf:dlfcn:linux-shared:-fPIC:-mx32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::x32",
 +"linux64-s390x",	"gcc:-m64 -DB_ENDIAN $ENV{OPTFLAGS} -Wall::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_UNROLL:${s390x_asm}:64:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
  #### So called "highgprs" target for z/Architecture CPUs
  # "Highgprs" is kernel feature first implemented in Linux 2.6.32, see
  # /proc/cpuinfo. The idea is to preserve most significant bits of
-@@ -415,16 +415,16 @@
+@@ -432,16 +432,16 @@
  # ldconfig and run-time linker to autodiscover. Unfortunately it
  # doesn't work just yet, because of couple of bugs in glibc
  # sysdeps/s390/dl-procinfo.c affecting ldconfig and ld.so.1...
@@ -100,19 +110,19 @@ diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
  #### SPARC Linux setups
  # Ray Miller <ray.miller@computing-services.oxford.ac.uk> has patiently
  # assisted with debugging of following two configs.
--"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-sparcv8","gcc:-mv8 -DB_ENDIAN -fomit-frame-pointer $ENV{OPTFLAGS} -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
+-"linux-sparcv8","gcc:-mcpu=v8 -DB_ENDIAN -O3 -fomit-frame-pointer -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-sparcv8","gcc:-mcpu=v8 -DB_ENDIAN $ENV{OPTFLAGS} -Wall -DBN_DIV2W::-D_REENTRANT::-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv8_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
  # it's a real mess with -mcpu=ultrasparc option under Linux, but
  # -Wa,-Av8plus should do the trick no matter what.
 -"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -O3 -fomit-frame-pointer -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
-+"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN -fomit-frame-pointer $ENV{OPTFLAGS} -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
++"linux-sparcv9","gcc:-m32 -mcpu=ultrasparc -DB_ENDIAN $ENV{OPTFLAGS} -Wall -Wa,-Av8plus -DBN_DIV2W::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m32:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
  # GCC 3.1 is a requirement
 -"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -O3 -fomit-frame-pointer -Wall::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
-+"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN -fomit-frame-pointer $ENV{OPTFLAGS} -Wall::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
++"linux64-sparcv9","gcc:-m64 -mcpu=ultrasparc -DB_ENDIAN $ENV{OPTFLAGS} -Wall::-D_REENTRANT:ULTRASPARC:-ldl:BN_LLONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL BF_PTR:${sparcv9_asm}:dlfcn:linux-shared:-fPIC:-m64:.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR):::64",
  #### Alpha Linux with GNU C and Compaq C setups
  # Special notes:
  # - linux-alpha+bwx-gcc is ment to be used from ./config only. If you
-@@ -438,8 +438,8 @@
+@@ -455,8 +455,8 @@
  #
  #					<appro@fy.chalmers.se>
  #
@@ -122,8 +132,8 @@ diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
 +"linux-alpha+bwx-gcc","gcc:$ENV{OPTFLAGS} -DL_ENDIAN::-D_REENTRANT::-ldl:SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_RISC1 DES_UNROLL:${alpha_asm}:dlfcn:linux-shared:-fPIC::.so.\$(SHLIB_MAJOR).\$(SHLIB_MINOR)",
  "linux-alpha-ccc","ccc:-fast -readonly_strings -DL_ENDIAN::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
  "linux-alpha+bwx-ccc","ccc:-fast -readonly_strings -DL_ENDIAN::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
- 
-@@ -1737,7 +1737,7 @@
+ "linux-alpha+bwx-ccc-generic","ccc:-fast -generic -readonly_strings -DL_ENDIAN -DTERMIO::-D_REENTRANT:::SIXTY_FOUR_BIT_LONG RC4_CHAR RC4_CHUNK DES_INT DES_PTR DES_RISC1 DES_UNROLL:${alpha_asm}",
+@@ -1765,7 +1765,7 @@
  	elsif ($shared_extension ne "" && $shared_extension =~ /^\.s([ol])\.[^\.]*\.[^\.]*$/)
  		{
  		my $sotmp = $1;
@@ -131,4 +141,4 @@ diff -ruN openssl-1.0.2a.orig/Configure openssl-1.0.2a/Configure
 +		s/^SHARED_LIBS_LINK_EXTS=.*/SHARED_LIBS_LINK_EXTS=.s$sotmp.\$(SHLIB_SOVER) .s$sotmp/;
  		}
  	elsif ($shared_extension ne "" && $shared_extension =~ /^\.[^\.]*\.[^\.]*\.dylib$/)
- 		{
\ No newline at end of file
+ 		{
diff --git a/system/base/openssl/files/openssl-ssl-certificate.sh b/system/base/openssl/files/openssl-ssl-certificate.sh
new file mode 100644
index 00000000..dd65c969
--- /dev/null
+++ b/system/base/openssl/files/openssl-ssl-certificate.sh
@@ -0,0 +1,33 @@
+#!/bin/sh -e
+
+CERT=/etc/openssl/certs/apache.pem
+export RANDFILE=/dev/random
+
+if [ "$1" != "--force" -a -f $CERT ]; then
+  echo "$CERT exists!  Use \"$0 --force.\""
+  exit 0
+fi
+
+if [ "$1" == "--force" ]; then
+  shift
+fi     
+
+echo
+echo creating selfsingned certificate
+echo "replace it with one signed by a certification authority (CA)"
+echo
+echo enter your ServerName at the Common Name prompt
+echo
+echo If you want your certificate to expire after x days call this programm 
+echo with "-days x". Default: 30 days
+
+# use special .cnf, because with normal one no valid selfsigned
+# certificate is created
+
+openssl req $@ -config /etc/openssl/openssl.cnf \
+  -new -x509 -nodes -out $CERT -keyout $CERT
+  
+chmod 600 $CERT
+
+ln -sf $CERT \
+  /etc/openssl/certs/`/usr/bin/openssl x509 -noout -hash < $CERT`.0
diff --git a/system/base/openssl/files/openssl_fix_for_x32.patch b/system/base/openssl/files/openssl_fix_for_x32.patch
index 8fc68b86..5ae0b9b6 100644
--- a/system/base/openssl/files/openssl_fix_for_x32.patch
+++ b/system/base/openssl/files/openssl_fix_for_x32.patch
@@ -1,15 +1,23 @@
---- openssl-1.0.2/crypto/perlasm/x86_64-xlate.pl~	2015-02-27 20:05:00.732776724 +0000
-+++ openssl-1.0.2/crypto/perlasm/x86_64-xlate.pl	2015-02-27 20:05:23.327082845 +0000
-@@ -199,8 +199,12 @@
+
+obsolete now that this is applied?
+https://rt.openssl.org/Ticket/Display.html?id=3885
+https://github.com/openssl/openssl/commit/10c639a8a56c90bec9e332c7ca76ef552b3952ac
+
+--- openssl-1.0.2g/crypto/perlasm/x86_64-xlate.pl~	2016-02-24 19:39:13.000000000 +0200
++++ openssl-1.0.2g/crypto/perlasm/x86_64-xlate.pl	2016-02-25 21:01:20.464795948 +0200
+@@ -198,11 +198,15 @@
  	if ($gas) {
  	    # Solaris /usr/ccs/bin/as can't handle multiplications
  	    # in $self->{value}
 +	    if ($self->{value} =~ /0xA040608020C0E000/) {
 +		    $self->{value} = "11547335547999543296";
 +	    } else {
-	    $self->{value} =~ s/(?<![\w\$\.])(0x?[0-9a-f]+)/oct($1)/egi;
-	    $self->{value} =~ s/([0-9]+\s*[\*\/\%]\s*[0-9]+)/eval($1)/eg;
-+           }
+ 	    my $value = $self->{value};
+ 	    $value =~ s/(?<![\w\$\.])(0x?[0-9a-f]+)/oct($1)/egi;
+ 	    if ($value =~ s/([0-9]+\s*[\*\/\%]\s*[0-9]+)/eval($1)/eg) {
+ 		$self->{value} = $value;
+ 	    }
++	    }
  	    sprintf "\$%s",$self->{value};
  	} else {
- 	    $self->{value} =~ s/(0b[0-1]+)/oct($1)/eig;
\ No newline at end of file
+ 	    $self->{value} =~ s/(0b[0-1]+)/oct($1)/eig;
diff --git a/system/base/openssl/files/openssl_fix_for_x32_2.patch b/system/base/openssl/files/openssl_fix_for_x32_2.patch
deleted file mode 100644
index 7584b936..00000000
--- a/system/base/openssl/files/openssl_fix_for_x32_2.patch
+++ /dev/null
@@ -1,29 +0,0 @@
-diff -ruNp openssl-1.0.2.orig/crypto/bn/asm/x86_64-gcc.c openssl-1.0.2/crypto/bn/asm/x86_64-gcc.c
---- openssl-1.0.2.orig/crypto/bn/asm/x86_64-gcc.c	2015-01-22 15:58:32.000000000 +0100
-+++ openssl-1.0.2/crypto/bn/asm/x86_64-gcc.c	2015-01-27 16:19:21.432252035 +0100
-@@ -212,9 +212,9 @@ BN_ULONG bn_add_words(BN_ULONG *rp, cons
-     asm volatile ("       subq    %0,%0           \n" /* clear carry */
-                   "       jmp     1f              \n"
-                   ".p2align 4                     \n"
--                  "1:     movq    (%4,%2,8),%0    \n"
--                  "       adcq    (%5,%2,8),%0    \n"
--                  "       movq    %0,(%3,%2,8)    \n"
-+                  "1:     movq    (%q4,%2,8),%0    \n"
-+                  "       adcq    (%q5,%2,8),%0    \n"
-+                  "       movq    %0,(%q3,%2,8)    \n"
-                   "       lea     1(%2),%2        \n"
-                   "       loop    1b              \n"
-                   "       sbbq    %0,%0           \n":"=&r" (ret), "+c"(n),
-@@ -238,9 +238,9 @@ BN_ULONG bn_sub_words(BN_ULONG *rp, cons
-     asm volatile ("       subq    %0,%0           \n" /* clear borrow */
-                   "       jmp     1f              \n"
-                   ".p2align 4                     \n"
--                  "1:     movq    (%4,%2,8),%0    \n"
--                  "       sbbq    (%5,%2,8),%0    \n"
--                  "       movq    %0,(%3,%2,8)    \n"
-+                  "1:     movq    (%q4,%2,8),%0    \n"
-+                  "       sbbq    (%q5,%2,8),%0    \n"
-+                  "       movq    %0,(%q3,%2,8)    \n"
-                   "       lea     1(%2),%2        \n"
-                   "       loop    1b              \n"
-                   "       sbbq    %0,%0           \n":"=&r" (ret), "+c"(n),  
diff --git a/system/base/openssl/files/pic.patch b/system/base/openssl/files/pic.patch
new file mode 100644
index 00000000..2f13e575
--- /dev/null
+++ b/system/base/openssl/files/pic.patch
@@ -0,0 +1,175 @@
+Index: openssl-1.0.1c/crypto/des/asm/desboth.pl
+===================================================================
+--- openssl-1.0.1c.orig/crypto/des/asm/desboth.pl	2001-10-24 23:20:56.000000000 +0200
++++ openssl-1.0.1c/crypto/des/asm/desboth.pl	2012-07-29 14:15:26.000000000 +0200
+@@ -16,6 +16,11 @@
+ 
+ 	&push("edi");
+ 
++	&call   (&label("pic_point0"));
++	&set_label("pic_point0");
++	&blindpop("ebp");
++	&add    ("ebp", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point0") . "]");
++
+ 	&comment("");
+ 	&comment("Load the data words");
+ 	&mov($L,&DWP(0,"ebx","",0));
+@@ -47,15 +52,21 @@
+ 	&mov(&swtmp(2),	(DWC(($enc)?"1":"0")));
+ 	&mov(&swtmp(1),	"eax");
+ 	&mov(&swtmp(0),	"ebx");
+-	&call("DES_encrypt2");
++	&exch("ebx", "ebp");
++	&call("DES_encrypt2\@PLT");
++	&exch("ebx", "ebp");
+ 	&mov(&swtmp(2),	(DWC(($enc)?"0":"1")));
+ 	&mov(&swtmp(1),	"edi");
+ 	&mov(&swtmp(0),	"ebx");
+-	&call("DES_encrypt2");
++	&exch("ebx", "ebp");
++	&call("DES_encrypt2\@PLT");
++	&exch("ebx", "ebp");
+ 	&mov(&swtmp(2),	(DWC(($enc)?"1":"0")));
+ 	&mov(&swtmp(1),	"esi");
+ 	&mov(&swtmp(0),	"ebx");
+-	&call("DES_encrypt2");
++	&exch("ebx", "ebp");
++	&call("DES_encrypt2\@PLT");
++	&exch("ebx", "ebp");
+ 
+ 	&stack_pop(3);
+ 	&mov($L,&DWP(0,"ebx","",0));
+Index: openssl-1.0.1c/crypto/perlasm/cbc.pl
+===================================================================
+--- openssl-1.0.1c.orig/crypto/perlasm/cbc.pl	2011-07-13 08:22:46.000000000 +0200
++++ openssl-1.0.1c/crypto/perlasm/cbc.pl	2012-07-29 14:15:26.000000000 +0200
+@@ -122,7 +122,11 @@
+ 	&mov(&DWP($data_off,"esp","",0),	"eax");	# put in array for call
+ 	&mov(&DWP($data_off+4,"esp","",0),	"ebx");	#
+ 
+-	&call($enc_func);
++	&call	(&label("pic_point0"));
++	&set_label("pic_point0");
++	&blindpop("ebx");
++	&add	("ebx", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point0") . "]");
++	&call("$enc_func\@PLT");
+ 
+ 	&mov("eax",	&DWP($data_off,"esp","",0));
+ 	&mov("ebx",	&DWP($data_off+4,"esp","",0));
+@@ -185,7 +189,11 @@
+ 	&mov(&DWP($data_off,"esp","",0),	"eax");	# put in array for call
+ 	&mov(&DWP($data_off+4,"esp","",0),	"ebx");	#
+ 
+-	&call($enc_func);
++	&call	(&label("pic_point1"));
++	&set_label("pic_point1");
++	&blindpop("ebx");
++	&add	("ebx", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point1") . "]");
++	&call("$enc_func\@PLT");
+ 
+ 	&mov("eax",	&DWP($data_off,"esp","",0));
+ 	&mov("ebx",	&DWP($data_off+4,"esp","",0));
+@@ -218,7 +226,11 @@
+ 	&mov(&DWP($data_off,"esp","",0),	"eax");	# put back
+ 	&mov(&DWP($data_off+4,"esp","",0),	"ebx");	#
+ 
+-	&call($dec_func);
++	&call	(&label("pic_point2"));
++	&set_label("pic_point2");
++	&blindpop("ebx");
++	&add	("ebx", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point2") . "]");
++	&call("$dec_func\@PLT");
+ 
+ 	&mov("eax",	&DWP($data_off,"esp","",0));	# get return
+ 	&mov("ebx",	&DWP($data_off+4,"esp","",0));	#
+@@ -261,7 +273,11 @@
+ 	&mov(&DWP($data_off,"esp","",0),	"eax");	# put back
+ 	&mov(&DWP($data_off+4,"esp","",0),	"ebx");	#
+ 
+-	&call($dec_func);
++	&call	(&label("pic_point3"));
++	&set_label("pic_point3");
++	&blindpop("ebx");
++	&add	("ebx", "\$_GLOBAL_OFFSET_TABLE_+[.-" . &label("pic_point3") . "]");
++	&call("$dec_func\@PLT");
+ 
+ 	&mov("eax",	&DWP($data_off,"esp","",0));	# get return
+ 	&mov("ebx",	&DWP($data_off+4,"esp","",0));	#
+Index: openssl-1.0.1c/crypto/perlasm/x86gas.pl
+===================================================================
+--- openssl-1.0.1c.orig/crypto/perlasm/x86gas.pl	2011-12-09 20:16:35.000000000 +0100
++++ openssl-1.0.1c/crypto/perlasm/x86gas.pl	2012-07-29 14:15:26.000000000 +0200
+@@ -161,6 +161,7 @@
+ 	if ($::macosx)	{ push (@out,"$tmp,2\n"); }
+ 	elsif ($::elf)	{ push (@out,"$tmp,4\n"); }
+ 	else		{ push (@out,"$tmp\n"); }
++	if ($::elf)	{ push (@out,".hidden\tOPENSSL_ia32cap_P\n"); }
+     }
+     push(@out,$initseg) if ($initseg);
+ }
+@@ -218,8 +219,23 @@
+     elsif ($::elf)
+     {	$initseg.=<<___;
+ .section	.init
++___
++        if ($::pic)
++	{   $initseg.=<<___;
++	pushl	%ebx
++	call	.pic_point0
++.pic_point0:
++	popl	%ebx
++	addl	\$_GLOBAL_OFFSET_TABLE_+[.-.pic_point0],%ebx
++	call	$f\@PLT
++	popl	%ebx
++___
++	}
++	else
++	{   $initseg.=<<___;
+ 	call	$f
+ ___
++	}
+     }
+     elsif ($::coff)
+     {   $initseg.=<<___;	# applies to both Cygwin and Mingw
+Index: openssl-1.0.1c/crypto/x86cpuid.pl
+===================================================================
+--- openssl-1.0.1c.orig/crypto/x86cpuid.pl	2012-02-28 15:20:34.000000000 +0100
++++ openssl-1.0.1c/crypto/x86cpuid.pl	2012-07-29 14:15:26.000000000 +0200
+@@ -8,6 +8,8 @@
+ 
+ for (@ARGV) { $sse2=1 if (/-DOPENSSL_IA32_SSE2/); }
+ 
++push(@out, ".hidden OPENSSL_ia32cap_P\n");
++
+ &function_begin("OPENSSL_ia32_cpuid");
+ 	&xor	("edx","edx");
+ 	&pushf	();
+@@ -139,9 +141,7 @@
+ &set_label("nocpuid");
+ &function_end("OPENSSL_ia32_cpuid");
+ 
+-&external_label("OPENSSL_ia32cap_P");
+-
+-&function_begin_B("OPENSSL_rdtsc","EXTRN\t_OPENSSL_ia32cap_P:DWORD");
++&function_begin_B("OPENSSL_rdtsc");
+ 	&xor	("eax","eax");
+ 	&xor	("edx","edx");
+ 	&picmeup("ecx","OPENSSL_ia32cap_P");
+@@ -155,7 +155,7 @@
+ # This works in Ring 0 only [read DJGPP+MS-DOS+privileged DPMI host],
+ # but it's safe to call it on any [supported] 32-bit platform...
+ # Just check for [non-]zero return value...
+-&function_begin_B("OPENSSL_instrument_halt","EXTRN\t_OPENSSL_ia32cap_P:DWORD");
++&function_begin_B("OPENSSL_instrument_halt");
+ 	&picmeup("ecx","OPENSSL_ia32cap_P");
+ 	&bt	(&DWP(0,"ecx"),4);
+ 	&jnc	(&label("nohalt"));	# no TSC
+@@ -222,7 +222,7 @@
+ 	&ret	();
+ &function_end_B("OPENSSL_far_spin");
+ 
+-&function_begin_B("OPENSSL_wipe_cpu","EXTRN\t_OPENSSL_ia32cap_P:DWORD");
++&function_begin_B("OPENSSL_wipe_cpu");
+ 	&xor	("eax","eax");
+ 	&xor	("edx","edx");
+ 	&picmeup("ecx","OPENSSL_ia32cap_P");
diff --git a/system/base/openssl/pspec.xml b/system/base/openssl/pspec.xml
index 827ea471..4bf303be 100644
--- a/system/base/openssl/pspec.xml
+++ b/system/base/openssl/pspec.xml
@@ -16,7 +16,7 @@
         <Archive sha1sum="a47faaca57b47a0d9d5fb085545857cc92062691" type="targz">https://www.openssl.org/source/openssl-1.0.2o.tar.gz</Archive>
         <AdditionalFiles>
             <AdditionalFile target="openssl-1.0.0-beta4-ca-dir.patch">openssl-1.0.0-beta4-ca-dir.patch</AdditionalFile>
-<!--             <AdditionalFile target="ca-dir.patch">ca-dir.patch</AdditionalFile> -->
+            <!--AdditionalFile target="ca-dir.patch">ca-dir.patch</AdditionalFile-->
         </AdditionalFiles>
         <BuildDependencies>
             <Dependency>zlib-devel</Dependency>
@@ -25,22 +25,16 @@
             <Dependency>sed</Dependency>
         </BuildDependencies>
         <Patches>
-            <Patch level="1">openssl-1.0.0a-ldflags-norpath.patch</Patch>
-            <Patch level="1">openssl-1.0.0-beta4-ca-dir.patch</Patch>
-<!--             <Patch level="1">no-rpath.patch</Patch> -->
-<!--             <Patch level="1">ca-dir.patch</Patch> -->
-            <Patch level="1">openssl-1.0.0-beta5-enginesdir.patch</Patch>
-            <!--Patch>openssl-1.0.2-ipv6.patch</Patch-->
-            <!--<Patch>openssl-1.0.2-s_client-verify.patch</Patch>-->
-<!--             <Patch>openssl-include.patch</Patch> -->
-            <!--Patch>openssl_fix_for_x32.patch</Patch-->
-            <Patch>openssl_fix_for_x32_2.patch</Patch>
+            <Patch>openssl-alpha-ccc.patch</Patch>
+            <Patch>openssl-optflags.patch</Patch>
+            <Patch>openssl-include.patch</Patch>
+            <Patch>openssl-man-namespace.patch</Patch>
+            <Patch>openssl-asflag.patch</Patch>
             <Patch>openssl-ca-certificates.patch</Patch>
-            <Patch>CVE-2014-0198.patch</Patch>
-            <!--<Patch>openssl-1.0.2a-malloc-typo.patch</Patch>-->
-            <!--Patch>openssl-1.0.2a-parallel-build.patch</Patch-->
-            <Patch>openssl-1.0.2a-x32-asm.patch</Patch>
-            <!--<Patch>openssl-optflags.patch</Patch>-->
+            <Patch>openssl-ldflags.patch</Patch>
+            <Patch>openssl-find.patch</Patch>
+            <Patch>pic.patch</Patch>
+            <Patch>openssl_fix_for_x32.patch</Patch>
         </Patches>
     </Source>
 
@@ -59,6 +53,10 @@
         <Provides>
             <COMAR script="package.py">System.Package</COMAR>
         </Provides>
+        <AdditionalFiles>
+            <AdditionalFile  owner="root" permission="0755" target="/usr/bin/ssl-certificate">openssl-ssl-certificate.sh</AdditionalFile>
+            <AdditionalFile  owner="root" permission="0755" target="/usr/bin/c_rehash.sh">openssl-c_rehash.sh</AdditionalFile>
+        </AdditionalFiles>
     </Package>
 
     <Package>