diff --git a/ports/openssl/disable-install-docs.patch b/ports/openssl/disable-install-docs.patch
new file mode 100644
index 0000000000..6e39790cec
--- /dev/null
+++ b/ports/openssl/disable-install-docs.patch
@@ -0,0 +1,26 @@
+diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
+index 110ba06..5b6b1c7 100644
+--- a/Configurations/unix-Makefile.tmpl
++++ b/Configurations/unix-Makefile.tmpl
+@@ -611,7 +611,7 @@ install_sw: install_dev install_engines install_modules install_runtime
+ 
+ uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev
+ 
+-install_docs: install_man_docs install_html_docs
++install_docs:
+ 
+ uninstall_docs: uninstall_man_docs uninstall_html_docs
+ 	$(RM) -r $(DESTDIR)$(DOCDIR)
+diff --git a/Configurations/windows-makefile.tmpl b/Configurations/windows-makefile.tmpl
+index d054431..b5c1c88 100644
+--- a/Configurations/windows-makefile.tmpl
++++ b/Configurations/windows-makefile.tmpl
+@@ -487,7 +487,7 @@ install_sw: install_dev install_engines install_modules install_runtime
+ 
+ uninstall_sw: uninstall_runtime uninstall_modules uninstall_engines uninstall_dev
+ 
+-install_docs: install_html_docs
++install_docs:
+ 
+ uninstall_docs: uninstall_html_docs
+ 
diff --git a/ports/openssl/portfile.cmake b/ports/openssl/portfile.cmake
index 53dab951c9..ea61abf1b9 100644
--- a/ports/openssl/portfile.cmake
+++ b/ports/openssl/portfile.cmake
@@ -1,37 +1,10 @@
-vcpkg_minimum_required(VERSION 2022-10-12) # for ${VERSION}
 if(EXISTS "${CURRENT_INSTALLED_DIR}/share/libressl/copyright"
     OR EXISTS "${CURRENT_INSTALLED_DIR}/share/boringssl/copyright")
     message(FATAL_ERROR "Can't build openssl if libressl/boringssl is installed. Please remove libressl/boringssl, and try install openssl again if you need it.")
 endif()
 
-if (VCPKG_TARGET_IS_LINUX)
-    message(WARNING
-[[openssl currently requires the following library from the system package manager:
-    linux-headers
-It can be installed on alpine systems via apk add linux-headers.]]
-    )
-endif()
-
-vcpkg_from_github(
-    OUT_SOURCE_PATH SOURCE_PATH
-    REPO openssl/openssl
-    REF "openssl-${VERSION}"
-    SHA512 5a821aaaaa89027ce08a347e5fc216757c2971e29f7d24792609378c54f657839b3775bf639e7330b28b4f96ef0d32869f0a96afcb25c8a2e1c2fe51a6eb4aa3
-    PATCHES
-        windows/install-layout.patch
-        windows/install-pdbs.patch
-        windows/umul128-arm64.patch # Fixed upstream in https://github.com/openssl/openssl/pull/20244, but not released as of 3.0.8
-)
-
-vcpkg_find_acquire_program(PERL)
-get_filename_component(PERL_EXE_PATH ${PERL} DIRECTORY)
-vcpkg_add_to_path("${PERL_EXE_PATH}")
-
-if(VCPKG_TARGET_IS_WINDOWS AND NOT VCPKG_TARGET_IS_MINGW)
-    include("${CMAKE_CURRENT_LIST_DIR}/windows/portfile.cmake")
-    include("${CMAKE_CURRENT_LIST_DIR}/install-pc-files.cmake")
-else()
-    include("${CMAKE_CURRENT_LIST_DIR}/unix/portfile.cmake")
+if(VCPKG_TARGET_IS_EMSCRIPTEN)
+    vcpkg_check_linkage(ONLY_STATIC_LIBRARY)
 endif()
 
 if (NOT "${VERSION}" MATCHES [[^([0-9]+)\.([0-9]+)\.([0-9]+)$]])
@@ -41,4 +14,51 @@ set(OPENSSL_VERSION_MAJOR "${CMAKE_MATCH_1}")
 set(OPENSSL_VERSION_MINOR "${CMAKE_MATCH_2}")
 set(OPENSSL_VERSION_FIX "${CMAKE_MATCH_3}")
 configure_file("${CMAKE_CURRENT_LIST_DIR}/vcpkg-cmake-wrapper.cmake.in" "${CURRENT_PACKAGES_DIR}/share/${PORT}/vcpkg-cmake-wrapper.cmake" @ONLY)
+
+vcpkg_from_github(
+    OUT_SOURCE_PATH SOURCE_PATH
+    REPO openssl/openssl
+    REF "openssl-${VERSION}"
+    SHA512 5a821aaaaa89027ce08a347e5fc216757c2971e29f7d24792609378c54f657839b3775bf639e7330b28b4f96ef0d32869f0a96afcb25c8a2e1c2fe51a6eb4aa3
+    PATCHES
+        disable-install-docs.patch
+        script-prefix.patch
+        windows/install-layout.patch
+        windows/install-pdbs.patch
+        windows/umul128-arm64.patch # Fixed upstream in https://github.com/openssl/openssl/pull/20244, but not released as of 3.0.8
+        unix/move-openssldir.patch
+        unix/no-empty-dirs.patch
+        unix/no-static-libs-for-shared.patch
+)
+
+vcpkg_list(SET CONFIGURE_OPTIONS
+    enable-static-engine
+    enable-capieng
+    no-ssl3
+    no-weak-ssl-ciphers
+    no-tests
+)
+
+if(VCPKG_LIBRARY_LINKAGE STREQUAL "dynamic")
+    vcpkg_list(APPEND CONFIGURE_OPTIONS shared)
+else()
+    vcpkg_list(APPEND CONFIGURE_OPTIONS no-shared no-module)
+endif()
+
+if(DEFINED OPENSSL_USE_NOPINSHARED)
+    vcpkg_list(APPEND CONFIGURE_OPTIONS no-pinshared)
+endif()
+
+if(OPENSSL_NO_AUTOLOAD_CONFIG)
+    vcpkg_list(APPEND CONFIGURE_OPTIONS no-autoload-config)
+endif()
+
+if(VCPKG_TARGET_IS_WINDOWS AND NOT VCPKG_TARGET_IS_MINGW)
+    include("${CMAKE_CURRENT_LIST_DIR}/windows/portfile.cmake")
+    include("${CMAKE_CURRENT_LIST_DIR}/install-pc-files.cmake")
+else()
+    include("${CMAKE_CURRENT_LIST_DIR}/unix/portfile.cmake")
+endif()
+
 file(INSTALL "${CMAKE_CURRENT_LIST_DIR}/usage" DESTINATION "${CURRENT_PACKAGES_DIR}/share/${PORT}")
+file(INSTALL "${SOURCE_PATH}/LICENSE.txt" DESTINATION "${CURRENT_PACKAGES_DIR}/share/${PORT}" RENAME copyright)
diff --git a/ports/openssl/script-prefix.patch b/ports/openssl/script-prefix.patch
new file mode 100644
index 0000000000..70f0859ca8
--- /dev/null
+++ b/ports/openssl/script-prefix.patch
@@ -0,0 +1,22 @@
+diff --git a/tools/c_rehash.in b/tools/c_rehash.in
+index 343cdc1..e48038e 100644
+--- a/tools/c_rehash.in
++++ b/tools/c_rehash.in
+@@ -12,7 +12,7 @@
+ # and add symbolic links to their hash values.
+ 
+ my $dir = {- quotify1($config{openssldir}) -};
+-my $prefix = {- quotify1($config{prefix}) -};
++use FindBin;
+ 
+ my $errorcount = 0;
+ my $openssl = $ENV{OPENSSL} || "openssl";
+@@ -61,7 +61,7 @@ if (defined(&Cwd::getcwd)) {
+ 
+ # DOS/Win32 or Unix delimiter?  Prefix our installdir, then search.
+ my $path_delim = ($pwd =~ /^[a-z]\:/i) ? ';' : ':';
+-$ENV{PATH} = "$prefix/bin" . ($ENV{PATH} ? $path_delim . $ENV{PATH} : "");
++$ENV{PATH} = "$FindBin::Bin" . ($ENV{PATH} ? $path_delim . $ENV{PATH} : "");
+ 
+ if (! -x $openssl) {
+     my $found = 0;
diff --git a/ports/openssl/unix/CMakeLists.txt b/ports/openssl/unix/CMakeLists.txt
deleted file mode 100644
index 75c21805ac..0000000000
--- a/ports/openssl/unix/CMakeLists.txt
+++ /dev/null
@@ -1,281 +0,0 @@
-cmake_minimum_required(VERSION 3.9)
-project(openssl C)
-
-if(NOT SOURCE_PATH)
-    message(FATAL_ERROR "Requires SOURCE_PATH")
-endif()
-
-if(CMAKE_SYSTEM_NAME STREQUAL "Android" OR CMAKE_SYSTEM_NAME STREQUAL "Linux")
-    if(CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64")
-        set(PLATFORM linux-x86_64)
-    else()
-        set(PLATFORM linux-generic32)
-    endif()
-elseif(CMAKE_SYSTEM_NAME STREQUAL "iOS")
-    if(VCPKG_TARGET_ARCHITECTURE MATCHES "arm64")
-        set(PLATFORM ios64-xcrun)
-    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "arm")
-        set(PLATFORM ios-xcrun)
-    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "x86" OR
-           VCPKG_TARGET_ARCHITECTURE MATCHES "x64")
-        set(PLATFORM iossimulator-xcrun)
-    else()
-        message(FATAL_ERROR "Unknown iOS target architecture: ${VCPKG_TARGET_ARCHITECTURE}")
-    endif()
-    # disable that makes linkage error (e.g. require stderr usage)
-    list(APPEND DISABLES no-ui no-asm)
-elseif(CMAKE_SYSTEM_NAME STREQUAL "Darwin")
-    if(VCPKG_TARGET_ARCHITECTURE MATCHES "arm64")
-        set(PLATFORM darwin64-arm64-cc)
-    else()
-        set(PLATFORM darwin64-x86_64-cc)
-    endif()
-elseif(CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
-    set(PLATFORM BSD-generic64)
-elseif(CMAKE_SYSTEM_NAME STREQUAL "OpenBSD")
-    set(PLATFORM BSD-generic64)
-elseif(MINGW)
-    if(CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64")
-        set(PLATFORM mingw64)
-    else()
-        set(PLATFORM mingw)
-    endif()
-elseif(EMSCRIPTEN)
-    set(MAKE $ENV{EMSDK}/upstream/emscripten/emmake)
-    set(ENV{MAKE} $ENV{EMSDK}/upstream/emscripten/emmake)
-else()
-    message(FATAL_ERROR "Unknown platform")
-endif()
-
-get_filename_component(COMPILER_ROOT "${CMAKE_C_COMPILER}" DIRECTORY)
-
-message("CMAKE_C_COMPILER=${CMAKE_C_COMPILER}")
-message("COMPILER_ROOT=${COMPILER_ROOT}")
-message("CMAKE_SYSROOT=${CMAKE_SYSROOT}")
-message("CMAKE_OSX_SYSROOT=${CMAKE_OSX_SYSROOT}")
-message("CMAKE_OSX_DEPLOYMENT_TARGET=${CMAKE_OSX_DEPLOYMENT_TARGET}")
-message("CMAKE_C_FLAGS=${CMAKE_C_FLAGS}")
-message("CMAKE_C_FLAGS_RELEASE=${CMAKE_C_FLAGS_RELEASE}")
-message("CMAKE_C_FLAGS_DEBUG=${CMAKE_C_FLAGS_DEBUG}")
-message("CMAKE_INCLUDE_SYSTEM_FLAG_C=${CMAKE_INCLUDE_SYSTEM_FLAG_C}")
-message("CMAKE_C_OSX_DEPLOYMENT_TARGET_FLAG=${CMAKE_C_OSX_DEPLOYMENT_TARGET_FLAG}")
-
-string(TOUPPER "${CMAKE_BUILD_TYPE}" BUILD_TYPE)
-set(CFLAGS "${CMAKE_C_FLAGS} ${CMAKE_C_FLAGS_${BUILD_TYPE}}")
-if(CMAKE_C_COMPILER_ID STREQUAL "Clang")
-    set(CFLAGS "${CFLAGS} -Wno-error=unused-command-line-argument")
-endif()
-if(CMAKE_C_COMPILER_TARGET AND CMAKE_C_COMPILE_OPTIONS_TARGET)
-    set(CFLAGS "${CFLAGS} ${CMAKE_C_COMPILE_OPTIONS_TARGET}${CMAKE_C_COMPILER_TARGET}")
-endif()
-if(CMAKE_C_COMPILER_EXTERNAL_TOOLCHAIN AND CMAKE_C_COMPILE_OPTIONS_EXTERNAL_TOOLCHAIN)
-    set(CFLAGS "${CFLAGS} ${CMAKE_C_COMPILE_OPTIONS_EXTERNAL_TOOLCHAIN}${CMAKE_C_COMPILER_EXTERNAL_TOOLCHAIN}")
-endif()
-if(CMAKE_SYSROOT AND CMAKE_C_COMPILE_OPTIONS_SYSROOT)
-    set(CFLAGS "${CFLAGS} ${CMAKE_C_COMPILE_OPTIONS_SYSROOT}${CMAKE_SYSROOT}")
-elseif(CMAKE_OSX_SYSROOT AND CMAKE_C_COMPILE_OPTIONS_SYSROOT)
-    set(CFLAGS "${CFLAGS} ${CMAKE_C_COMPILE_OPTIONS_SYSROOT}${CMAKE_OSX_SYSROOT}")
-endif()
-if (CMAKE_OSX_DEPLOYMENT_TARGET AND CMAKE_C_OSX_DEPLOYMENT_TARGET_FLAG)
-  set(CFLAGS "${CFLAGS} ${CMAKE_C_OSX_DEPLOYMENT_TARGET_FLAG}${CMAKE_OSX_DEPLOYMENT_TARGET}")
-elseif((CMAKE_SYSTEM_NAME STREQUAL "Darwin") AND (VCPKG_TARGET_ARCHITECTURE MATCHES "arm64"))
-  set(CFLAGS "${CFLAGS} -mmacosx-version-min=11.0")
-endif()
-
-string(REGEX REPLACE "^ " "" CFLAGS "${CFLAGS}")
-
-set(ENV{ANDROID_DEV} "${CMAKE_SYSROOT}/usr")
-
-if(NOT IOS)
-    set(ENV{CC} "${CMAKE_C_COMPILER}")
-endif()
-
-message("ENV{ANDROID_DEV}=$ENV{ANDROID_DEV}")
-
-get_filename_component(SOURCE_PATH_NAME "${SOURCE_PATH}" NAME)
-set(BUILDDIR "${CMAKE_CURRENT_BINARY_DIR}/${SOURCE_PATH_NAME}")
-
-if(NOT EXISTS "${BUILDDIR}")
-    file(COPY ${SOURCE_PATH} DESTINATION ${CMAKE_CURRENT_BINARY_DIR})
-endif()
-
-get_filename_component(MSYS_BIN_DIR "${MAKE}" DIRECTORY)
-
-if(BUILD_SHARED_LIBS)
-    set(SHARED shared)
-    file(STRINGS "${BUILDDIR}/VERSION.dat" SHLIB_VERSION
-        REGEX "^SHLIB_VERSION=.*")
-    string(REGEX REPLACE "^(SHLIB_VERSION=)(.*)$" "\\2"
-        SHLIB_VERSION "${SHLIB_VERSION}")
-
-    if(CMAKE_SYSTEM_NAME STREQUAL "Darwin" OR CMAKE_SYSTEM_NAME STREQUAL "iOS")
-        set(LIB_EXT dylib)
-        set(LIB_EXTS ${SHLIB_VERSION}.${LIB_EXT})
-    elseif(MINGW)
-        string(REPLACE "." "_" SHLIB_VERSION "${SHLIB_VERSION}")
-        set(BIN_EXT dll)
-        set(LIB_EXT dll.a)
-    else()
-        set(LIB_EXT so)
-        set(LIB_EXTS ${LIB_EXT}.${SHLIB_VERSION})
-    endif()
-    list(APPEND BIN_EXTS ${BIN_EXT})
-    list(APPEND LIB_EXTS ${LIB_EXT})
-else()
-    set(SHARED no-shared no-module)
-    set(LIB_EXTS a)
-endif()
-set(INSTALL_PKG_CONFIGS "${BUILDDIR}/openssl.pc")
-foreach(lib ssl crypto)
-    foreach(ext ${LIB_EXTS})
-        list(APPEND INSTALL_LIBS "${BUILDDIR}/lib${lib}.${ext}")
-        list(APPEND INSTALL_PKG_CONFIGS "${BUILDDIR}/lib${lib}.pc")
-    endforeach()
-    foreach(ext ${BIN_EXTS})
-    # This might be wrong for targets which don't follow this naming scheme, but I'm not aware of any
-        if(CMAKE_SYSTEM_PROCESSOR STREQUAL "x86_64")
-            list(APPEND INSTALL_BINS "${BUILDDIR}/lib${lib}-${SHLIB_VERSION}-x64.${ext}")
-        else()
-            list(APPEND INSTALL_BINS "${BUILDDIR}/lib${lib}-${SHLIB_VERSION}.${ext}")
-        endif()
-    endforeach()
-endforeach()
-
-if(CMAKE_HOST_WIN32)
-    set(ENV_COMMAND set)
-    set(PATH_VAR ";%PATH%")
-else()
-    set(ENV_COMMAND export)
-    set(PATH_VAR ":$ENV{PATH}")
-endif()
-
-add_custom_command(
-        OUTPUT "${BUILDDIR}/Makefile"
-        COMMAND ${ENV_COMMAND} "PATH=${MSYS_BIN_DIR}${PATH_VAR}"
-        VERBATIM
-        WORKING_DIRECTORY "${BUILDDIR}"
-)
-
-if(NOT IOS)
-    add_custom_command(
-        OUTPUT "${BUILDDIR}/Makefile"
-        COMMAND ${ENV_COMMAND} CC=${CMAKE_C_COMPILER}
-        COMMAND ${ENV_COMMAND} AR=${CMAKE_AR}
-        COMMAND ${ENV_COMMAND} LD=${CMAKE_LINKER}
-        COMMAND ${ENV_COMMAND} RANLIB=${CMAKE_RANLIB}
-        COMMAND ${ENV_COMMAND} MAKE=${MAKE}
-        COMMAND ${ENV_COMMAND} MAKEDEPPROG=${CMAKE_C_COMPILER}
-        COMMAND ${ENV_COMMAND} WINDRES=${CMAKE_RC_COMPILER}
-        VERBATIM
-        APPEND
-    )
-    if(EMSCRIPTEN)
-        list(APPEND DISABLES
-                threads
-                no-engine
-                no-dso
-                no-asm
-                no-shared
-                no-sse2
-                no-srtp
-                )
-    else()
-        list(APPEND DISABLES
-                enable-static-engine
-                no-zlib
-                no-ssl2
-                no-idea
-                no-cast
-                no-seed
-                no-md2
-                no-tests)
-    endif()
-endif()
-
-if(EMSCRIPTEN)
-    add_custom_command(
-            OUTPUT "${BUILDDIR}/Makefile"
-            COMMAND "$ENV{EMSDK}/upstream/emscripten/emconfigure" ./config
-            ${SHARED}
-            ${DISABLES}
-            "--prefix=${CMAKE_INSTALL_PREFIX}"
-            "--openssldir=/etc/ssl"
-            "--cross-compile-prefix=\"/\""
-            VERBATIM
-            APPEND
-    )
-
-    add_custom_target(build_libs ALL
-            COMMAND ${ENV_COMMAND} "PATH=${MSYS_BIN_DIR}${PATH_VAR}"
-            COMMAND "${CMAKE_COMMAND}" -E touch "${BUILDDIR}/krb5.h"
-            COMMAND "${MAKE}" make build_libs
-            VERBATIM
-            WORKING_DIRECTORY "${BUILDDIR}"
-            DEPENDS "${BUILDDIR}/Makefile"
-            BYPRODUCTS ${INSTALL_LIBS}
-            )
-else()
-    add_custom_command(
-            OUTPUT "${BUILDDIR}/Makefile"
-            COMMAND "${PERL}" Configure
-            ${SHARED}
-            ${DISABLES}
-            ${PLATFORM}
-            "--prefix=${CMAKE_INSTALL_PREFIX}"
-            "--libdir=${CMAKE_INSTALL_PREFIX}/lib"
-            "--openssldir=/etc/ssl"
-            ${CFLAGS}
-            VERBATIM
-            APPEND
-    )
-
-    add_custom_target(build_libs ALL
-            COMMAND ${ENV_COMMAND} "PATH=${MSYS_BIN_DIR}${PATH_VAR}"
-            COMMAND "${CMAKE_COMMAND}" -E touch "${BUILDDIR}/krb5.h"
-            COMMAND "${MAKE}" -j ${VCPKG_CONCURRENCY} build_libs
-            VERBATIM
-            WORKING_DIRECTORY "${BUILDDIR}"
-            DEPENDS "${BUILDDIR}/Makefile"
-            BYPRODUCTS ${INSTALL_LIBS}
-            )
-endif()
-
-add_custom_command(
-        OUTPUT "${BUILDDIR}/Makefile"
-        COMMAND "${CMAKE_COMMAND}" "-DDIR=${BUILDDIR}" -P "${CMAKE_CURRENT_LIST_DIR}/remove-deps.cmake"
-        VERBATIM
-        APPEND
-)
-
-if((CMAKE_SYSTEM_NAME STREQUAL "Darwin" OR CMAKE_SYSTEM_NAME STREQUAL "iOS") AND BUILD_SHARED_LIBS)
-    if(DEFINED CMAKE_INSTALL_NAME_DIR)
-        set(ID_PREFIX "${CMAKE_INSTALL_NAME_DIR}")
-    else()
-        set(ID_PREFIX "@rpath")
-    endif()
-
-    add_custom_command(
-        TARGET build_libs
-        COMMAND /usr/bin/install_name_tool -id "${ID_PREFIX}/libssl.${SHLIB_VERSION}.dylib"
-                                               "${BUILDDIR}/libssl.${SHLIB_VERSION}.dylib"
-        COMMAND /usr/bin/install_name_tool -id "${ID_PREFIX}/libcrypto.${SHLIB_VERSION}.dylib"
-                                               "${BUILDDIR}/libcrypto.${SHLIB_VERSION}.dylib"
-        COMMAND /usr/bin/install_name_tool -change "${CMAKE_INSTALL_PREFIX}/lib/libcrypto.${SHLIB_VERSION}.dylib"
-                                                   "${ID_PREFIX}/libcrypto.${SHLIB_VERSION}.dylib"
-                                                   "${BUILDDIR}/libssl.${SHLIB_VERSION}.dylib"
-        VERBATIM
-    )
-endif()
-
-install(
-    FILES ${INSTALL_LIBS}
-    DESTINATION lib
-)
-install(
-    FILES ${INSTALL_BINS}
-    DESTINATION bin
-)
-install(
-    FILES ${INSTALL_PKG_CONFIGS}
-    DESTINATION lib/pkgconfig
-)
diff --git a/ports/openssl/unix/configure b/ports/openssl/unix/configure
new file mode 100755
index 0000000000..c49aa7a935
--- /dev/null
+++ b/ports/openssl/unix/configure
@@ -0,0 +1,31 @@
+#!/bin/bash
+
+set -e
+
+declare -a OUT_OPTIONS
+
+INTERPRETER=perl
+
+LAST_SEEN=
+COPY_OPTIONS=no
+for OPTION; do
+    case "${OPTION},${COPY_OPTIONS}" in
+    */Configure,no)
+        OUT_OPTIONS+=("${OPTION}")
+        INTERPRETER="${LAST_SEEN}"
+        COPY_OPTIONS=yes
+        ;;
+    --prefix=*|--openssldir=*|--libdir=*|--debug,*)
+        OUT_OPTIONS+=("${OPTION}")
+        ;;
+    -*|*=*)
+        ;;
+    *,yes)
+        OUT_OPTIONS+=("${OPTION}")
+        ;;
+    esac
+    LAST_SEEN="${OPTION}"
+done
+
+set -x
+"${INTERPRETER}" ${OUT_OPTIONS[@]}
diff --git a/ports/openssl/unix/move-openssldir.patch b/ports/openssl/unix/move-openssldir.patch
new file mode 100644
index 0000000000..44e0183efe
--- /dev/null
+++ b/ports/openssl/unix/move-openssldir.patch
@@ -0,0 +1,15 @@
+diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
+index dd96254..c4458ca 100644
+--- a/Configurations/unix-Makefile.tmpl
++++ b/Configurations/unix-Makefile.tmpl
+@@ -689,6 +689,10 @@ install_ssldirs:
+ 		cp $(SRCDIR)/apps/ct_log_list.cnf $(DESTDIR)$(OPENSSLDIR)/ct_log_list.cnf; \
+ 		chmod 644 $(DESTDIR)$(OPENSSLDIR)/ct_log_list.cnf; \
+ 	fi
++	$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(INSTALLTOP)$(OPENSSLDIR)
++	for I in $(DESTDIR)$(OPENSSLDIR)/*; do \
++		mv $$I $(DESTDIR)$(INSTALLTOP)$(OPENSSLDIR)/; \
++	done
+ 
+ install_dev: install_runtime_libs
+ 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
diff --git a/ports/openssl/unix/no-empty-dirs.patch b/ports/openssl/unix/no-empty-dirs.patch
new file mode 100644
index 0000000000..4c59d9eaca
--- /dev/null
+++ b/ports/openssl/unix/no-empty-dirs.patch
@@ -0,0 +1,22 @@
+diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
+index 5b6b1c7..4c8c916 100644
+--- a/Configurations/unix-Makefile.tmpl
++++ b/Configurations/unix-Makefile.tmpl
+@@ -818,7 +818,7 @@ _install_modules_deps: install_runtime_libs build_modules
+ 
+ install_engines: _install_modules_deps
+ 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
+-	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(ENGINESDIR)/
++	@[ -z "$(INSTALL_ENGINES)" ] || $(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(ENGINESDIR)/
+ 	@$(ECHO) "*** Installing engines"
+ 	@set -e; for e in dummy $(INSTALL_ENGINES); do \
+ 		if [ "$$e" = "dummy" ]; then continue; fi; \
+@@ -842,7 +842,7 @@ uninstall_engines:
+ 
+ install_modules: _install_modules_deps
+ 	@[ -n "$(INSTALLTOP)" ] || (echo INSTALLTOP should not be empty; exit 1)
+-	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(MODULESDIR)/
++	@[ -z "$(INSTALL_MODULES)" ] || $(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(MODULESDIR)/
+ 	@$(ECHO) "*** Installing modules"
+ 	@set -e; for e in dummy $(INSTALL_MODULES); do \
+ 		if [ "$$e" = "dummy" ]; then continue; fi; \
diff --git a/ports/openssl/unix/no-static-libs-for-shared.patch b/ports/openssl/unix/no-static-libs-for-shared.patch
new file mode 100644
index 0000000000..868e682a32
--- /dev/null
+++ b/ports/openssl/unix/no-static-libs-for-shared.patch
@@ -0,0 +1,12 @@
+diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
+index 4c8c916..dd96254 100644
+--- a/Configurations/unix-Makefile.tmpl
++++ b/Configurations/unix-Makefile.tmpl
+@@ -708,6 +708,7 @@ install_dev: install_runtime_libs
+ 	done
+ 	@$(PERL) $(SRCDIR)/util/mkdir-p.pl $(DESTDIR)$(libdir)
+ 	@set -e; for l in $(INSTALL_LIBS); do \
++		if [ -n "$(INSTALL_SHLIBS)" ] ; then continue ; fi ; \
+ 		fn=`basename $$l`; \
+ 		$(ECHO) "install $$l -> $(DESTDIR)$(libdir)/$$fn"; \
+ 		cp $$l $(DESTDIR)$(libdir)/$$fn.new; \
diff --git a/ports/openssl/unix/portfile.cmake b/ports/openssl/unix/portfile.cmake
index 319b7e3905..414da82d8f 100644
--- a/ports/openssl/unix/portfile.cmake
+++ b/ports/openssl/unix/portfile.cmake
@@ -1,3 +1,11 @@
+if (VCPKG_TARGET_IS_LINUX)
+    message(NOTICE [[
+openssl requires Linux kernel headers from the system package manager.
+   They can be installed on Alpine systems via `apk add linux-headers`.
+   They can be installed on Ubuntu systems via `apt install linux-libc-dev`.
+]])
+endif()
+
 if(CMAKE_HOST_WIN32)
     vcpkg_acquire_msys(MSYS_ROOT PACKAGES make perl)
     set(MAKE "${MSYS_ROOT}/usr/bin/make.exe")
@@ -7,26 +15,125 @@ else()
     if(NOT MAKE)
         message(FATAL_ERROR "Could not find make. Please install it through your package manager.")
     endif()
+    vcpkg_find_acquire_program(PERL)
+endif()
+set(INTERPRETER "${PERL}")
+
+execute_process(
+    COMMAND "${PERL}" -e "use IPC::Cmd;"
+    RESULT_VARIABLE perl_ipc_cmd_result
+)
+if(NOT perl_ipc_cmd_result STREQUAL "0")
+    message(FATAL_ERROR "\nPerl cannot find IPC::Cmd. Please install it through your system package manager.\n")
 endif()
 
-vcpkg_cmake_configure(
-    SOURCE_PATH "${CMAKE_CURRENT_LIST_DIR}"
-    OPTIONS
-        -DSOURCE_PATH=${SOURCE_PATH}
-        -DPERL=${PERL}
-        -DMAKE=${MAKE}
-        -DVCPKG_CONCURRENCY=${VCPKG_CONCURRENCY}
-)
+if(VCPKG_TARGET_IS_ANDROID)
+    if(VCPKG_TARGET_ARCHITECTURE MATCHES "arm64")
+        set(OPENSSL_ARCH android-arm64)
+    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "arm")
+        set(OPENSSL_ARCH android-arm)
+    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "x64")
+        set(OPENSSL_ARCH android-x86_64)
+    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "x86")
+        set(OPENSSL_ARCH android-x86)
+    else()
+        message(FATAL_ERROR "Unknown iOS target architecture: ${VCPKG_TARGET_ARCHITECTURE}")
+    endif()
+elseif(VCPKG_TARGET_IS_LINUX)
+    if(VCPKG_TARGET_ARCHITECTURE MATCHES "arm64")
+        set(OPENSSL_ARCH linux-aarch64)
+    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "arm")
+        set(OPENSSL_ARCH linux-armv4)
+    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "x64")
+        set(OPENSSL_ARCH linux-x86_64)
+    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "x86")
+        set(OPENSSL_ARCH linux-x86)
+    else()
+        set(OPENSSL_ARCH linux-generic32)
+    endif()
+elseif(VCPKG_TARGET_IS_IOS)
+    if(VCPKG_TARGET_ARCHITECTURE MATCHES "arm64")
+        set(OPENSSL_ARCH ios64-xcrun)
+    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "arm")
+        set(OPENSSL_ARCH ios-xcrun)
+    elseif(VCPKG_TARGET_ARCHITECTURE MATCHES "x86" OR VCPKG_TARGET_ARCHITECTURE MATCHES "x64")
+        set(OPENSSL_ARCH iossimulator-xcrun)
+    else()
+        message(FATAL_ERROR "Unknown iOS target architecture: ${VCPKG_TARGET_ARCHITECTURE}")
+    endif()
+    # disable that makes linkage error (e.g. require stderr usage)
+    list(APPEND CONFIGURE_OPTIONS no-ui no-asm)
+elseif(VCPKG_TARGET_IS_OSX)
+    if(VCPKG_TARGET_ARCHITECTURE MATCHES "arm64")
+        set(OPENSSL_ARCH darwin64-arm64)
+    else()
+        set(OPENSSL_ARCH darwin64-x86_64)
+    endif()
+elseif(VCPKG_TARGET_IS_FREEBSD OR VCPKG_TARGET_IS_OPENBSD)
+    set(OPENSSL_ARCH BSD-generic64)
+elseif(VCPKG_TARGET_IS_MINGW)
+    if(VCPKG_TARGET_ARCHITECTURE STREQUAL "x64")
+        set(OPENSSL_ARCH mingw64)
+    else()
+        set(OPENSSL_ARCH mingw)
+    endif()
+elseif(VCPKG_TARGET_IS_EMSCRIPTEN)
+    set(INTERPRETER "$ENV{EMSDK}/upstream/emscripten/emconfigure")
+    set(MAKE "$ENV{EMSDK}/upstream/emscripten/emmake")
+    set(ENV{MAKE} "${MAKE}")
+    vcpkg_list(APPEND CONFIGURE_OPTIONS
+        threads
+        no-engine
+        no-asm
+        no-sse2
+        no-srtp
+        --cross-compile-prefix=
+    )
+else()
+    message(FATAL_ERROR "Unknown platform")
+endif()
 
-vcpkg_cmake_install()
+file(MAKE_DIRECTORY "${SOURCE_PATH}/vcpkg")
+file(COPY "${CMAKE_CURRENT_LIST_DIR}/configure" DESTINATION "${SOURCE_PATH}/vcpkg")
+vcpkg_configure_make(
+    SOURCE_PATH "${SOURCE_PATH}"
+    PROJECT_SUBPATH "vcpkg"
+    NO_ADDITIONAL_PATHS
+    OPTIONS
+        "${INTERPRETER}"
+        "${SOURCE_PATH}/Configure"
+        ${OPENSSL_ARCH}
+        ${CONFIGURE_OPTIONS}
+        "--openssldir=/etc/ssl"
+        "--libdir=lib"
+    OPTIONS_DEBUG
+        --debug
+)
+vcpkg_install_make(BUILD_TARGET build_sw)
 vcpkg_fixup_pkgconfig()
 
-file(GLOB HEADERS "${CURRENT_BUILDTREES_DIR}/${TARGET_TRIPLET}-rel/*/include/openssl/*.h")
-set(RESOLVED_HEADERS)
-foreach(HEADER ${HEADERS})
-    get_filename_component(X "${HEADER}" REALPATH)
-    list(APPEND RESOLVED_HEADERS "${X}")
-endforeach()
+file(MAKE_DIRECTORY "${CURRENT_PACKAGES_DIR}/tools/${PORT}")
+file(RENAME "${CURRENT_PACKAGES_DIR}/bin/c_rehash" "${CURRENT_PACKAGES_DIR}/tools/${PORT}/c_rehash")
+file(REMOVE "${CURRENT_PACKAGES_DIR}/debug/bin/c_rehash")
+vcpkg_copy_tools(TOOL_NAMES openssl AUTO_CLEAN)
 
-file(INSTALL ${RESOLVED_HEADERS} DESTINATION "${CURRENT_PACKAGES_DIR}/include/openssl")
-file(INSTALL "${SOURCE_PATH}/LICENSE.txt" DESTINATION "${CURRENT_PACKAGES_DIR}/share/${PORT}" RENAME copyright)
+file(TOUCH "${CURRENT_PACKAGES_DIR}/etc/ssl/certs/.keep")
+file(TOUCH "${CURRENT_PACKAGES_DIR}/etc/ssl/private/.keep")
+
+file(REMOVE_RECURSE
+    "${CURRENT_PACKAGES_DIR}/debug/etc"
+    "${CURRENT_PACKAGES_DIR}/debug/include"
+    "${CURRENT_PACKAGES_DIR}/debug/share"
+)
+
+# For consistency of mingw build with nmake build
+file(GLOB engines "${CURRENT_PACKAGES_DIR}/lib/ossl-modules/*.dll")
+if(NOT engines STREQUAL "")
+    file(COPY ${engines} DESTINATION "${CURRENT_PACKAGES_DIR}/bin")
+    file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/lib/ossl-modules")
+endif()
+file(GLOB engines "${CURRENT_PACKAGES_DIR}/debug/lib/ossl-modules/*.dll")
+if(NOT engines STREQUAL "")
+    file(COPY ${engines} DESTINATION "${CURRENT_PACKAGES_DIR}/debug/bin")
+    file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/lib/ossl-modules")
+endif()
diff --git a/ports/openssl/vcpkg.json b/ports/openssl/vcpkg.json
index 0d72b6dca8..790c240aea 100644
--- a/ports/openssl/vcpkg.json
+++ b/ports/openssl/vcpkg.json
@@ -1,6 +1,7 @@
 {
   "name": "openssl",
   "version": "3.0.8",
+  "port-version": 1,
   "description": "OpenSSL is an open source project that provides a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security (TLS) and Secure Sockets Layer (SSL) protocols. It is also a general-purpose cryptography library.",
   "homepage": "https://www.openssl.org",
   "license": "Apache-2.0",
diff --git a/ports/openssl/windows/portfile.cmake b/ports/openssl/windows/portfile.cmake
index cd1c31152e..3b7d6202ae 100644
--- a/ports/openssl/windows/portfile.cmake
+++ b/ports/openssl/windows/portfile.cmake
@@ -2,28 +2,9 @@ vcpkg_find_acquire_program(NASM)
 get_filename_component(NASM_EXE_PATH "${NASM}" DIRECTORY)
 vcpkg_add_to_path(PREPEND "${NASM_EXE_PATH}")
 
-vcpkg_list(SET CONFIGURE_OPTIONS
-    enable-static-engine
-    enable-capieng
-    no-ssl2
-    no-ssl3
-    no-weak-ssl-ciphers
-    no-tests
-)
-
-if(VCPKG_LIBRARY_LINKAGE STREQUAL "dynamic")
-    vcpkg_list(APPEND CONFIGURE_OPTIONS shared)
-else()
-    vcpkg_list(APPEND CONFIGURE_OPTIONS no-shared no-module)
-endif()
-
-if(DEFINED OPENSSL_USE_NOPINSHARED)
-    vcpkg_list(APPEND CONFIGURE_OPTIONS no-pinshared)
-endif()
-
-if(OPENSSL_NO_AUTOLOAD_CONFIG)
-    vcpkg_list(APPEND CONFIGURE_OPTIONS no-autoload-config)
-endif()
+vcpkg_find_acquire_program(PERL)
+get_filename_component(PERL_EXE_PATH "${PERL}" DIRECTORY)
+vcpkg_add_to_path("${PERL_EXE_PATH}")
 
 if(VCPKG_TARGET_ARCHITECTURE STREQUAL "x86")
     set(OPENSSL_ARCH VC-WIN32)
@@ -84,7 +65,8 @@ vcpkg_build_nmake(
         "LDFLAGS=${VCPKG_COMBINED_SHARED_LINKER_FLAGS_RELEASE}"
     PRERUN_SHELL_DEBUG "${PERL}" Configure
         ${CONFIGURE_OPTIONS}
-        debug-${OPENSSL_ARCH}
+        ${OPENSSL_ARCH}
+        --debug
         "--prefix=${install_dir_native}\\debug"
         "--openssldir=${install_dir_native}\\debug"
         "AS=${as}"
@@ -135,5 +117,3 @@ file(REMOVE
     "${CURRENT_PACKAGES_DIR}/debug/openssl.cnf"
     "${CURRENT_PACKAGES_DIR}/debug/openssl.cnf.dist"
 )
-
-file(INSTALL "${SOURCE_PATH}/LICENSE.txt" DESTINATION "${CURRENT_PACKAGES_DIR}/share/${PORT}" RENAME copyright)
diff --git a/versions/baseline.json b/versions/baseline.json
index e581e2fbb5..942599688e 100644
--- a/versions/baseline.json
+++ b/versions/baseline.json
@@ -5762,7 +5762,7 @@
     },
     "openssl": {
       "baseline": "3.0.8",
-      "port-version": 0
+      "port-version": 1
     },
     "openssl-unix": {
       "baseline": "deprecated",
diff --git a/versions/o-/openssl.json b/versions/o-/openssl.json
index 0dc5f1d47b..4d0005e41a 100644
--- a/versions/o-/openssl.json
+++ b/versions/o-/openssl.json
@@ -1,5 +1,10 @@
 {
   "versions": [
+    {
+      "git-tree": "17ce011827417025d6a29924ace0a474f1689c65",
+      "version": "3.0.8",
+      "port-version": 1
+    },
     {
       "git-tree": "9cd36489fc65db87c4cd94ac606abd05c1db8f2d",
       "version": "3.0.8",