Index: Makefile.inc1
===================================================================
--- Makefile.inc1	(revision 294227)
+++ Makefile.inc1	(working copy)
@@ -586,6 +586,8 @@
 	mtree -deU -f ${.CURDIR}/etc/mtree/BSD.usr.dist \
 	    -p ${WORLDTMP}/usr >/dev/null
 	mtree -deU -f ${.CURDIR}/etc/mtree/BSD.include.dist \
+	    -p ${WORLDTMP}/legacy/usr/include >/dev/null
+	mtree -deU -f ${.CURDIR}/etc/mtree/BSD.include.dist \
 	    -p ${WORLDTMP}/usr/include >/dev/null
 	ln -sf ${.CURDIR}/sys ${WORLDTMP}
 .if ${MK_DEBUG_FILES} != "no"
@@ -1455,6 +1457,15 @@
 _awk=		usr.bin/awk
 .endif
 
+# libcrypto is now private, needed by libarchive, which is needed by elfcopy
+.if ${BOOTSTRAPPING} < 1100090
+.if ${MK_CRYPT} != "no"
+.if ${MK_OPENSSL} != "no"
+_secure_lib_libcrypto= secure/lib/libcrypto
+.endif
+.endif
+.endif
+
 _yacc=		lib/liby \
 		usr.bin/yacc
 
@@ -1512,6 +1523,7 @@
 #	FreeBSD versions that need the tool built at this stage of the build.
 .for _tool in \
     ${_clang_tblgen} \
+    ${_secure_lib_libcrypto} \
     ${_kerberos5_bootstrap_tools} \
     ${_strfile} \
     ${_gperf} \
Index: ObsoleteFiles.inc
===================================================================
--- ObsoleteFiles.inc	(revision 294227)
+++ ObsoleteFiles.inc	(working copy)
@@ -38,6 +38,19 @@
 #   xargs -n1 | sort | uniq -d;
 # done
 
+# 20160117: Update for making ssl libs private
+OLD_FILES+=lib/libcrypto.a
+OLD_FILES+=lib/libcrypto.so
+OLD_LIBS+=lib/libcrypto.so.8
+OLD_FILES+=usr/lib/libssl.a
+OLD_FILES+=usr/lib/libssl.so
+OLD_LIBS+=usr/lib/libssl.so.8
+OLD_FILES+=usr/lib32/libcrypto.a
+OLD_FILES+=usr/lib32/libcrypto.so
+OLD_LIBS+=usr/lib32/libcrypto.so.8
+OLD_FILES+=usr/lib32/libssl.a
+OLD_FILES+=usr/lib32/libssl.so
+OLD_LIBS+=usr/lib32/libssl.so.8
 # 20160116: Update mandoc to cvs snapshot 20160116
 OLD_FILES+=usr/share/mdocml/example.style.css
 OLD_FILES+=usr/share/mdocml/style.css
Index: kerberos5/usr.bin/krb5-config/Makefile
===================================================================
--- kerberos5/usr.bin/krb5-config/Makefile	(revision 294227)
+++ kerberos5/usr.bin/krb5-config/Makefile	(working copy)
@@ -14,7 +14,7 @@
 	    -e "s,@includedir\@,${INCLUDEDIR},g" \
 	    -e "s,@LIB_crypt\@,-lcrypt,g" \
 	    -e "s,@LIB_dbopen\@,,g" \
-	    -e "s,@LIB_hcrypto_appl\@,-lcrypto,g" \
+	    -e "s,@LIB_hcrypto_appl\@,-lprivatecrypto,g" \
 	    -e "s,@LIB_pkinit\@,-lhx509,g" \
 	    -e "s,@LIB_dlopen\@,,g" \
 	    -e "s,@LIB_door_create\@,,g" \
Index: rescue/rescue/Makefile
===================================================================
--- rescue/rescue/Makefile	(revision 294227)
+++ rescue/rescue/Makefile	(working copy)
@@ -197,7 +197,7 @@
 CRUNCH_PROGS_usr.bin+= tar
 CRUNCH_LIBS+= -larchive
 .if ${MK_OPENSSL} != "no"
-CRUNCH_LIBS+= -lcrypto
+CRUNCH_LIBS+= -lprivatecrypto
 .endif
 CRUNCH_LIBS+= -lmd
 
Index: secure/lib/libcrypto/Makefile
===================================================================
--- secure/lib/libcrypto/Makefile	(revision 294227)
+++ secure/lib/libcrypto/Makefile	(working copy)
@@ -9,6 +9,8 @@
 SHLIB_MAJOR=	8
 ALLOW_SHARED_TEXTREL=
 
+PRIVATELIB=	true
+
 NO_LINT=
 
 .if exists(Makefile.man)
Index: secure/lib/libssl/Makefile
===================================================================
--- secure/lib/libssl/Makefile	(revision 294227)
+++ secure/lib/libssl/Makefile	(working copy)
@@ -3,6 +3,8 @@
 LIB=		ssl
 SHLIB_MAJOR=	8
 
+PRIVATELIB=	true
+
 NO_LINT=
 
 .if exists(Makefile.man)
Index: share/mk/bsd.libnames.mk
===================================================================
--- share/mk/bsd.libnames.mk	(revision 294227)
+++ share/mk/bsd.libnames.mk	(working copy)
@@ -37,7 +37,6 @@
 LIBCOM_ERR?=	${DESTDIR}${LIBDIR}/libcom_err.a
 LIBCPLUSPLUS?=	${DESTDIR}${LIBDIR}/libc++.a
 LIBCRYPT?=	${DESTDIR}${LIBDIR}/libcrypt.a
-LIBCRYPTO?=	${DESTDIR}${LIBDIR}/libcrypto.a
 LIBCTF?=	${DESTDIR}${LIBDIR}/libctf.a
 LIBCURSES?=	${DESTDIR}${LIBDIR}/libcurses.a
 LIBCUSE?=	${DESTDIR}${LIBDIR}/libcuse.a
@@ -129,7 +128,6 @@
 LIBSBUF?=	${DESTDIR}${LIBDIR}/libsbuf.a
 LIBSDP?=	${DESTDIR}${LIBDIR}/libsdp.a
 LIBSMB?=	${DESTDIR}${LIBDIR}/libsmb.a
-LIBSSL?=	${DESTDIR}${LIBDIR}/libssl.a
 LIBSSP_NONSHARED?=	${DESTDIR}${LIBDIR}/libssp_nonshared.a
 LIBSTAND?=	${DESTDIR}${LIBDIR}/libstand.a
 LIBSTDCPLUSPLUS?= ${DESTDIR}${LIBDIR}/libstdc++.a
Index: share/mk/src.libnames.mk
===================================================================
--- share/mk/src.libnames.mk	(revision 294227)
+++ share/mk/src.libnames.mk	(working copy)
@@ -16,6 +16,7 @@
 		atf_c \
 		atf_cxx \
 		bsdstat \
+		crypto \
 		event \
 		heimipcc \
 		heimipcs \
@@ -22,6 +23,7 @@
 		ldns \
 		sqlite3 \
 		ssh \
+		ssl \
 		ucl \
 		unbound
 
@@ -72,7 +74,6 @@
 		com_err \
 		compiler_rt \
 		crypt \
-		crypto \
 		ctf \
 		cuse \
 		cxxrt \
@@ -144,7 +145,6 @@
 		sdp \
 		sm \
 		smb \
-		ssl \
 		ssp_nonshared \
 		stdthreads \
 		supcplusplus \
Index: tools/bsdbox/Makefile
===================================================================
--- tools/bsdbox/Makefile	(revision 294227)
+++ tools/bsdbox/Makefile	(working copy)
@@ -103,7 +103,7 @@
 # .include "Makefile.telnetd"
 .include "Makefile.fs"
 
-CRUNCH_LIBS+= -lcrypto -lssl -lz
+CRUNCH_LIBS+= -lprivatecrypto -lprivatessl -lz
 
 # the crunchgen build environment
 .include <bsd.crunchgen.mk>