diff --git a/secure/lib/libcrypto/modules/Makefile.inc b/secure/lib/libcrypto/modules/Makefile.inc
index 64fb57ee74c5..75f9218c8e29 100644
--- a/secure/lib/libcrypto/modules/Makefile.inc
+++ b/secure/lib/libcrypto/modules/Makefile.inc
@@ -1,13 +1,7 @@
-PACKAGE?=	openssl
-LIB_PACKAGE=
 SHLIBDIR=	${LIBDIR}/ossl-modules
 
-LCRYPTO_SRC=	${SRCTOP}/crypto/openssl
-
-CFLAGS+=	-I${LCRYPTO_SRC}
-CFLAGS+=	-I${LCRYPTO_SRC}/include
-CFLAGS+=	-I${LCRYPTO_SRC}/providers/common/include
-CFLAGS+=	-I${LCRYPTO_SRC}/providers/fips/include
-CFLAGS+=	-I${LCRYPTO_SRC}/providers/implementations/include
+# Same compile flags as libcrypto (asm dispatch defines, NDEBUG, ...), as
+# upstream builds its modules with the library flags.
+.include "../Makefile.inc"
 
 WARNS?=		0
diff --git a/secure/lib/libcrypto/modules/legacy/Makefile b/secure/lib/libcrypto/modules/legacy/Makefile
index 8f91d9504504..7aa9ece42d28 100644
--- a/secure/lib/libcrypto/modules/legacy/Makefile
+++ b/secure/lib/libcrypto/modules/legacy/Makefile
@@ -1,12 +1,14 @@
 SHLIB_NAME?=	legacy.so
 LIBADD=		crypto
+VERSION_MAP=	${.CURDIR}/Version.map
+
+# Pull in ../Makefile.inc now: the ASM_* tests below need Makefile.common.
+.include <bsd.init.mk>
 
 SRCS+=	legacyprov.c prov_running.c
 
 # ciphers
-SRCS+=	ciphercommon.c ciphercommon_hw.c ciphercommon_block.c \
-	ciphercommon_gcm.c ciphercommon_gcm_hw.c \
-	ciphercommon_ccm.c ciphercommon_ccm_hw.c
+SRCS+=	ciphercommon.c ciphercommon_block.c
 SRCS+=	cipher_desx.c cipher_desx_hw.c cipher_des.c cipher_des_hw.c
 SRCS+=	cipher_tdes_common.c
 SRCS+=	cipher_blowfish.c cipher_blowfish_hw.c
@@ -16,18 +18,47 @@ SRCS+=	cipher_rc4.c cipher_rc4_hw.c
 SRCS+=	cipher_rc4_hmac_md5.c cipher_rc4_hmac_md5_hw.c
 SRCS+=	cipher_seed.c cipher_seed_hw.c
 
-# crypto
-SRCS+=	cpuid.c
-SRCS+=	ctype.c
+# crypto: the provider has its own copy of the CPU capability code
+SRCS+=	cpuid.c ctype.c
+.if defined(ASM_aarch64)
+SRCS+=	arm64cpuid.S armcap.c
+.elif defined(ASM_amd64)
+SRCS+=	x86_64cpuid.S
+.elif defined(ASM_arm)
+SRCS+=	armv4cpuid.S armcap.c
+.elif defined(ASM_i386)
+SRCS+=	x86cpuid.S
+.elif defined(ASM_powerpc) || defined(ASM_powerpc64) || defined(ASM_powerpc64le)
+SRCS+=	ppccpuid.S ppccap.c
+.else
+SRCS+=	mem_clr.c
+.endif
 
 # crypto/des
+.if defined(ASM_i386)
+SRCS+=	crypt586.S des-586.S
+.else
 SRCS+=	des_enc.c
-SRCS+=	fcrypt_b.c
+.endif
 
 # crypto/md5
 SRCS+=	md5_dgst.c
-SRCS+=	md5_one.c
-SRCS+=	md5_sha1.c
+.if defined(ASM_aarch64)
+SRCS+=	md5-aarch64.S
+.elif defined(ASM_amd64)
+SRCS+=	md5-x86_64.S
+.elif defined(ASM_i386)
+SRCS+=	md5-586.S
+.endif
+
+# crypto/rc4
+.if defined(ASM_amd64)
+SRCS+=	rc4-md5-x86_64.S rc4-x86_64.S
+.elif defined(ASM_i386)
+SRCS+=	rc4-586.S
+.else
+SRCS+=	rc4_enc.c rc4_skey.c
+.endif
 
 # providers/implementations/digests
 SRCS+=	digestcommon.c
@@ -38,26 +69,26 @@ SRCS+=	pbkdf1.c
 SRCS+=	pvkkdf.c
 
 # common
-SRCS+= provider_err.c provider_ctx.c
-SRCS+= provider_util.c
+SRCS+=	provider_ctx.c provider_util.c
 
 SRCS+=	tls_pad.c
 
-# This is needed so the provider can be loaded for us.
-#
-# There's a discrepancy between how this provider gets built in OpenSSL proper
-# and FreeBSD.
-SRCS+=	params_idx.c
-
 .include <bsd.lib.mk>
 
+.if defined(ASM_${MACHINE_CPUARCH})
+.PATH:	${SRCTOP}/sys/crypto/openssl/${MACHINE_CPUARCH}
+.elif defined(ASM_${MACHINE_ARCH})
+.PATH:	${SRCTOP}/sys/crypto/openssl/${MACHINE_ARCH}
+.endif
+
 .PATH:	${LCRYPTO_SRC}/crypto \
 	${LCRYPTO_SRC}/crypto/des \
 	${LCRYPTO_SRC}/crypto/md5 \
+	${LCRYPTO_SRC}/crypto/rc4 \
 	${LCRYPTO_SRC}/providers \
 	${LCRYPTO_SRC}/providers/common \
 	${LCRYPTO_SRC}/providers/implementations/ciphers \
 	${LCRYPTO_SRC}/providers/implementations/digests \
 	${LCRYPTO_SRC}/providers/implementations/kdfs \
 	${LCRYPTO_SRC}/ssl \
-	${LCRYPTO_SRC}/ssl/record/methods \
+	${LCRYPTO_SRC}/ssl/record/methods
diff --git a/secure/lib/libcrypto/modules/legacy/Version.map b/secure/lib/libcrypto/modules/legacy/Version.map
new file mode 100644
index 000000000000..1debaaa7ff65
--- /dev/null
+++ b/secure/lib/libcrypto/modules/legacy/Version.map
@@ -0,0 +1,5 @@
+{
+    global:
+        OSSL_provider_init;
+    local: *;
+};