Index: Makefile.inc1
===================================================================
--- Makefile.inc1	(revision 313713)
+++ Makefile.inc1	(working copy)
@@ -690,6 +690,8 @@
 	mtree -deU -f ${.CURDIR}/etc/mtree/BSD.usr.dist \
 	    -p ${WORLDTMP}/usr >/dev/null
 	mtree -deU -f ${.CURDIR}/etc/mtree/BSD.include.dist \
+	    -p ${WORLDTMP}/legacy/usr/include >/dev/null
+	mtree -deU -f ${.CURDIR}/etc/mtree/BSD.include.dist \
 	    -p ${WORLDTMP}/usr/include >/dev/null
 	ln -sf ${.CURDIR}/sys ${WORLDTMP}
 .if ${MK_DEBUG_FILES} != "no"
@@ -1550,6 +1552,16 @@
 # build-tools or cross-tools.
 #
 
+# libcrypto is now private, needed by libarchive, which is needed by elfcopy
+.if ${BOOTSTRAPPING} < 1200099
+.if ${MK_CRYPT} != "no"
+.if ${MK_OPENSSL} != "no"
+_secure_lib_libcrypto= secure/lib/libcrypto
+_secure_lib_libssl= secure/lib/libssl
+.endif
+.endif
+.endif
+
 # ELF Tool Chain libraries are needed for ELF tools and dtrace tools.
 # r296685 fix cross-endian objcopy
 .if ${BOOTSTRAPPING} < 1100102
@@ -1574,7 +1586,7 @@
 	false
 .endif
 
-.for _tool in tools/build ${_elftoolchain_libs}
+.for _tool in tools/build ${_secure_lib_libcrypto} ${_elftoolchain_libs}
 	${_+_}@${ECHODIR} "===> ${_tool} (obj,includes,all,install)"; \
 	    cd ${.CURDIR}/${_tool}; \
 	    ${MAKE} DIRPRFX=${_tool}/ obj; \
Index: ObsoleteFiles.inc
===================================================================
--- ObsoleteFiles.inc	(revision 313713)
+++ ObsoleteFiles.inc	(working copy)
@@ -38,6 +38,19 @@
 #   xargs -n1 | sort | uniq -d;
 # done
 
+# 20170210: Update for making ssl libs private
+OLD_FILES+=lib/libcrypto.a
+OLD_FILES+=lib/libcrypto.so
+OLD_LIBS+=lib/libcrypto.so.8
+OLD_FILES+=usr/lib/libssl.a
+OLD_FILES+=usr/lib/libssl.so
+OLD_LIBS+=usr/lib/libssl.so.8
+OLD_FILES+=usr/lib32/libcrypto.a
+OLD_FILES+=usr/lib32/libcrypto.so
+OLD_LIBS+=usr/lib32/libcrypto.so.8
+OLD_FILES+=usr/lib32/libssl.a
+OLD_FILES+=usr/lib32/libssl.so
+OLD_LIBS+=usr/lib32/libssl.so.8
 # 20170206: remove bdes(1)
 OLD_FILES+=usr/bin/bdes
 OLD_FILES+=usr/lib/debug/usr/bin/bdes.debug
Index: kerberos5/usr.bin/krb5-config/Makefile
===================================================================
--- kerberos5/usr.bin/krb5-config/Makefile	(revision 313713)
+++ kerberos5/usr.bin/krb5-config/Makefile	(working copy)
@@ -14,7 +14,7 @@
 	    -e "s,@includedir\@,${INCLUDEDIR},g" \
 	    -e "s,@LIB_crypt\@,-lcrypt,g" \
 	    -e "s,@LIB_dbopen\@,,g" \
-	    -e "s,@LIB_hcrypto_appl\@,-lcrypto,g" \
+	    -e "s,@LIB_hcrypto_appl\@,-lprivatecrypto,g" \
 	    -e "s,@LIB_pkinit\@,-lhx509,g" \
 	    -e "s,@LIB_dlopen\@,,g" \
 	    -e "s,@LIB_door_create\@,,g" \
Index: rescue/rescue/Makefile
===================================================================
--- rescue/rescue/Makefile	(revision 313713)
+++ rescue/rescue/Makefile	(working copy)
@@ -194,7 +194,7 @@
 CRUNCH_PROGS_usr.bin+= tar
 CRUNCH_LIBS+= -larchive
 .if ${MK_OPENSSL} != "no"
-CRUNCH_LIBS+= -lcrypto
+CRUNCH_LIBS+= -lprivatecrypto
 .endif
 CRUNCH_LIBS+= -lmd
 
Index: secure/lib/libcrypto/Makefile
===================================================================
--- secure/lib/libcrypto/Makefile	(revision 313713)
+++ secure/lib/libcrypto/Makefile	(working copy)
@@ -8,6 +8,8 @@
 LIB=		crypto
 SHLIB_MAJOR=	8
 
+PRIVATELIB=	true
+
 NO_LINT=
 
 .if exists(Makefile.man)
Index: secure/lib/libssl/Makefile
===================================================================
--- secure/lib/libssl/Makefile	(revision 313713)
+++ secure/lib/libssl/Makefile	(working copy)
@@ -3,6 +3,8 @@
 LIB=		ssl
 SHLIB_MAJOR=	8
 
+PRIVATELIB=	true
+
 NO_LINT=
 
 .if exists(Makefile.man)
Index: share/mk/bsd.libnames.mk
===================================================================
--- share/mk/bsd.libnames.mk	(revision 313713)
+++ share/mk/bsd.libnames.mk	(working copy)
@@ -42,7 +42,6 @@
 LIBCOM_ERR?=	${DESTDIR}${LIBDIR}/libcom_err.a
 LIBCPLUSPLUS?=	${DESTDIR}${LIBDIR}/libc++.a
 LIBCRYPT?=	${DESTDIR}${LIBDIR}/libcrypt.a
-LIBCRYPTO?=	${DESTDIR}${LIBDIR}/libcrypto.a
 LIBCTF?=	${DESTDIR}${LIBDIR}/libctf.a
 LIBCURSES?=	${DESTDIR}${LIBDIR}/libcurses.a
 LIBCUSE?=	${DESTDIR}${LIBDIR}/libcuse.a
@@ -137,7 +136,6 @@
 LIBSBUF?=	${DESTDIR}${LIBDIR}/libsbuf.a
 LIBSDP?=	${DESTDIR}${LIBDIR}/libsdp.a
 LIBSMB?=	${DESTDIR}${LIBDIR}/libsmb.a
-LIBSSL?=	${DESTDIR}${LIBDIR}/libssl.a
 LIBSSP_NONSHARED?=	${DESTDIR}${LIBDIR}/libssp_nonshared.a
 LIBSTAND?=	${DESTDIR}${LIBDIR}/libstand.a
 LIBSTDCPLUSPLUS?= ${DESTDIR}${LIBDIR}/libstdc++.a
Index: share/mk/src.libnames.mk
===================================================================
--- share/mk/src.libnames.mk	(revision 313713)
+++ share/mk/src.libnames.mk	(working copy)
@@ -23,6 +23,8 @@
 		ldns \
 		sqlite3 \
 		ssh \
+		ssl \
+		crypto \
 		ucl \
 		unbound
 
@@ -78,7 +80,6 @@
 		com_err \
 		compiler_rt \
 		crypt \
-		crypto \
 		ctf \
 		cuse \
 		cxxrt \
@@ -153,7 +154,6 @@
 		sdp \
 		sm \
 		smb \
-		ssl \
 		ssp_nonshared \
 		stdthreads \
 		supcplusplus \
Index: tools/bsdbox/Makefile
===================================================================
--- tools/bsdbox/Makefile	(revision 313713)
+++ tools/bsdbox/Makefile	(working copy)
@@ -103,7 +103,7 @@
 # .include "Makefile.telnetd"
 .include "Makefile.fs"
 
-CRUNCH_LIBS+= -lcrypto -lssl -lz
+CRUNCH_LIBS+= -lprivatecrypto -lprivatessl -lz
 
 # the crunchgen build environment
 .include <bsd.crunchgen.mk>