Index: aimage/Makefile
===================================================================
--- aimage/Makefile	(revision 533164)
+++ aimage/Makefile	(working copy)
@@ -17,8 +17,8 @@
 
 USES=		gmake readline ssl
 GNU_CONFIGURE=	yes
-# Pretend ssl3_new exists for LibreSSL.  It's never really used but
-# configure checks for it.
+# Pretend ssl3_new exists for LibreSSL.  It's
+# never really used but configure checks for it.
 CONFIGURE_ARGS=	ac_cv_lib_ssl_ssl3_new=yes
 
 PLIST_FILES=	bin/aimage
@@ -25,9 +25,20 @@
 
 .include <bsd.port.pre.mk>
 
-.if ${SSL_DEFAULT} == base
-BROKEN_FreeBSD_12=	error: field has incomplete type 'EVP_MD_CTX' (aka 'evp_md_ctx_st')
-BROKEN_FreeBSD_13=	error: field has incomplete type 'EVP_MD_CTX' (aka 'evp_md_ctx_st')
-.endif
+# LibreSSL -- OpenSSL is a no-go @ >= 12
+.if ${SSL_DEFAULT:Mlibressl*}
+CPPFLAGS+=		-I${OPENSSLINC}
+LDFLAGS+=		-L${OPENSSLLIB}
+.else # SSL_DEFAULT
+BUILD_DEPENDS+=		${NONEXISTENT}:security/libressl:stage
+CPPFLAGS+=		-I${WRKDIR}/libressl/include
+LDFLAGS+=		-L${WRKDIR}/libressl/lib
 
+# Don't use COPYTREE_SHARE here as it hard links files, and the
+# original files are owned by root, which creates problems of its own.
+pre-configure:
+	@cd `${MAKE} -V STAGEDIR -C ${PORTSDIR}/security/libressl`${PREFIX} \
+	    && ${FIND} -E . ! -name *.so\* | ${CPIO} -dump ${WRKDIR}/libressl >/dev/null 2>&1
+.endif # SSL_DEFAULT
+
 .include <bsd.port.post.mk>