···130130 "-DUSE_CRYPTODEV_DIGESTS"
131131 ] ++ lib.optional enableSSL2 "enable-ssl2"
132132 ++ lib.optional enableSSL3 "enable-ssl3"
133133- ++ lib.optional (lib.versionAtLeast version "3.0.0") "enable-ktls"
133133+ # We select KTLS here instead of the configure-time detection (which we patch out).
134134+ # KTLS should work on FreeBSD 13+ as well, so we could enable it if someone tests it.
135135+ ++ lib.optional (stdenv.isLinux && lib.versionAtLeast version "3.0.0") "enable-ktls"
134136 ++ lib.optional (lib.versionAtLeast version "1.1.1" && stdenv.hostPlatform.isAarch64) "no-afalgeng"
135137 # OpenSSL needs a specific `no-shared` configure flag.
136138 # See https://wiki.openssl.org/index.php/Compilation_and_Installation#Configure_Options