diff --git a/usr.sbin/wpa/Makefile.inc b/usr.sbin/wpa/Makefile.inc
index 915b5312f02..5c5a6b40322 100644
--- a/usr.sbin/wpa/Makefile.inc
+++ b/usr.sbin/wpa/Makefile.inc
@@ -56,7 +56,6 @@ CFLAGS+=-DCONFIG_TDLS
 CFLAGS+=-DCONFIG_TERMINATE_ONLASTIF
 CFLAGS+=-DCONFIG_TLS=openssl
 CFLAGS+=-DCONFIG_MATCH_IFACE
-CFLAGS+=-DCONFIG_PASN
 CFLAGS+=-DCONFIG_PTKSA_CACHE
 CFLAGS+=-DEAP_SERVER
 CFLAGS+=-DEAP_SERVER_GTC
@@ -91,6 +90,10 @@ NEED_AES_ENCBLOCK=y
 NEED_AES_OMAC1=y
 .endif
 
+.if ${MK_OPENSSL} != "no"
+CFLAGS+=-DCONFIG_PASN
+.endif
+
 .if !empty(CFLAGS:M*-DEAP_AKA)
 NEED_SIM_COMMON=y
 NEED_AES_CBC=y
diff --git a/usr.sbin/wpa/src/tls/Makefile b/usr.sbin/wpa/src/tls/Makefile
index e5fdf96444d..fbb57b9c4c1 100644
--- a/usr.sbin/wpa/src/tls/Makefile
+++ b/usr.sbin/wpa/src/tls/Makefile
@@ -29,13 +29,14 @@ SRCS+=	asn1.c \
 	tlsv1_server_read.c \
 	tlsv1_server_write.c \
 	x509v3.c
-.endif
-.endif
 
 CFLAGS+=-DCONFIG_INTERNAL_LIBTOMMATH \
-	-DCONFIG_CRYPTO_INTERNAL \
-	-DCONFIG_TLSV11 \
+	-DCONFIG_CRYPTO_INTERNAL
+.else
+CFLAGS+=-DCONFIG_TLSV11 \
 	-DCONFIG_TLSV12
+.endif
+.endif
 
 # We are only interested in includes at this point. Not libraries.
 LIBADD=
diff --git a/usr.sbin/wpa/wpa_supplicant/Makefile b/usr.sbin/wpa/wpa_supplicant/Makefile
index 8e7edfcf772..fb045f80497 100644
--- a/usr.sbin/wpa/wpa_supplicant/Makefile
+++ b/usr.sbin/wpa/wpa_supplicant/Makefile
@@ -27,7 +27,6 @@ SRCS=	bss.c \
 	notify.c \
 	op_classes.c \
 	offchannel.c \
-	pasn_supplicant.c \
 	robust_av.c \
 	rrm.c \
 	scan.c \
@@ -37,6 +36,10 @@ SRCS=	bss.c \
 	wpa_supplicant.c \
 	wpas_glue.c
 
+.if ${MK_OPENSSL} != "no"
+SRCS+=	pasn_supplicant.c
+.endif
+
 MAN=	wpa_supplicant.8 wpa_supplicant.conf.5
 
 .if ${MK_EXAMPLES} != "no"