diff --git a/.github/workflows/ci-scripts-build.yml b/.github/workflows/ci-scripts-build.yml
index 8a7f81c0..aa07a1b2 100644
--- a/.github/workflows/ci-scripts-build.yml
+++ b/.github/workflows/ci-scripts-build.yml
@@ -143,8 +143,10 @@ jobs:
     - name: "apt-get install"
       run: |
         sudo apt-get update
-        sudo apt-get -y install g++-mingw-w64-x86-64 cmake gdb qemu-system-x86
+        sudo apt-get -y install g++-mingw-w64-x86-64 cmake gdb qemu-system-x86 libssl-dev
       if: runner.os == 'Linux'
+    - name: Host Info
+      run: openssl version -a
     - name: Automatic core dumper analysis
       uses: mdavidsaver/ci-core-dumper@master
     - name: Prepare and compile dependencies
diff --git a/Makefile b/Makefile
index 5def74da..a9518df9 100644
--- a/Makefile
+++ b/Makefile
@@ -5,8 +5,11 @@ include $(TOP)/configure/CONFIG
 # Directories to build, any order
 DIRS += configure
 
+DIRS += setup
+setup_DEPEND_DIRS = configure
+
 DIRS += src
-src_DEPEND_DIRS = configure
+src_DEPEND_DIRS = setup
 
 DIRS += tools
 tools_DEPEND_DIRS = src
diff --git a/bundle/Makefile b/bundle/Makefile
index 3292ee27..f404c425 100644
--- a/bundle/Makefile
+++ b/bundle/Makefile
@@ -1,5 +1,7 @@
 TOP=..
 
+_PVXS_BOOTSTRAP = YES
+
 include $(TOP)/configure/CONFIG
 
 CMAKE ?= cmake
diff --git a/configure/CONFIG b/configure/CONFIG
index c1a47032..adcbbdba 100644
--- a/configure/CONFIG
+++ b/configure/CONFIG
@@ -25,5 +25,6 @@ include $(TOP)/configure/CONFIG_SITE
 ifdef T_A
  -include $(TOP)/configure/CONFIG_SITE.Common.$(T_A)
  -include $(TOP)/configure/CONFIG_SITE.$(EPICS_HOST_ARCH).$(T_A)
+ -include $(TOP)/configure/O.$(T_A)/TOOLCHAIN
 endif
 
diff --git a/configure/CONFIG_PVXS_MODULE b/configure/CONFIG_PVXS_MODULE
deleted file mode 100644
index 3eda048b..00000000
--- a/configure/CONFIG_PVXS_MODULE
+++ /dev/null
@@ -1,41 +0,0 @@
-# auto-compute location of this file.
-# avoid need to standardize configure/RELEASE name
-_PVXS := $(dir $(lastword $(MAKEFILE_LIST)))
-
-# we're appending so must be idempotent
-ifeq (,$(_PVXS_CONF_INCLUDED))
-_PVXS_CONF_INCLUDED := YES
-
-ifdef T_A
-
-# use custom libevent2 install prefix by:
-#   setting LIBEVENT only for single arch build
-#   setting LIBEVENT_$(T_A) for each arch
-#   leave unset to use implicit system search path
-# NOTE: only needed if not present in default search paths
-LIBEVENT ?= $(LIBEVENT_$(T_A))
-
-# default to bundled location if it exists
-LIBEVENT_$(T_A) ?= $(wildcard $(abspath $(_PVXS)/../bundle/usr/$(T_A)))
-
-# apply to include search paths
-INCLUDES += $(if $(LIBEVENT),-I$(LIBEVENT)/include)
-
-LIBEVENT_BUNDLE_LIBS += event_core
-LIBEVENT_BUNDLE_LIBS_POSIX_YES = event_pthreads
-LIBEVENT_BUNDLE_LIBS += $(LIBEVENT_BUNDLE_LIBS_POSIX_$(POSIX))
-
-LIBEVENT_SYS_LIBS_WIN32 = bcrypt iphlpapi netapi32 ws2_32
-LIBEVENT_SYS_LIBS += $(LIBEVENT_SYS_LIBS_$(OS_CLASS))
-
-LIBEVENT_BUNDLE_LDFLAGS_Darwin_NO = -Wl,-rpath,$(LIBEVENT)/lib
-LIBEVENT_BUNDLE_LDFLAGS += $(LIBEVENT_BUNDLE_LDFLAGS_$(OS_CLASS)_$(STATIC_BUILD))
-
-event_core_DIR = $(LIBEVENT)/lib
-event_pthreads_DIR = $(LIBEVENT)/lib
-
-endif # T_A
-
-endif # _PVXS_CONF_INCLUDED
-
-# logic continues in RULES_PVXS_MODULE
diff --git a/configure/Makefile b/configure/Makefile
index 0e3ee92b..d3fce6f4 100644
--- a/configure/Makefile
+++ b/configure/Makefile
@@ -1,22 +1,35 @@
 TOP=..
 
+# step 1.  Use -I... to test event-config.h
+#          produce configure/O.$(T_A)/TOOLCHAIN
+# step 2 in setup/Makefile
+_PVXS_BOOTSTRAP = YES
+
 include $(TOP)/configure/CONFIG
 
+# use custom libevent2 install prefix by:
+#   setting LIBEVENT only for single arch build
+#   setting LIBEVENT_$(T_A) for each arch
+#   leave unset to use implicit system search path
+# NOTE: only needed if not present in default search paths
+LIBEVENT ?= $(LIBEVENT_$(T_A))
+LIBEVENT_$(T_A) ?= $(wildcard $(abspath $(TOP)/bundle/usr/$(T_A)))
+
+INCLUDES += $(if $(LIBEVENT),-I$(LIBEVENT)/include)
+
 TARGETS = $(CONFIG_TARGETS)
 CONFIGS += $(subst ../,,$(wildcard $(CONFIG_INSTALLS)))
 
 CFG += CONFIG_PVXS_VERSION
-CFG += CONFIG_PVXS_MODULE
-CFG += RULES_PVXS_MODULE
 
 include $(TOP)/configure/RULES
 
 ifdef T_A
-install: $(TOP)/configure/CONFIG_SITE.Common.$(T_A)
-
-$(TOP)/configure/CONFIG_SITE.Common.$(T_A): toolchain.c
-	$(PREPROCESS.cpp)
+install: TOOLCHAIN
 
-CLEANS += ../CONFIG_SITE.Common.$(T_A)
+TOOLCHAIN: toolchain.c
+	$(CPP) $(CPPFLAGS) $(INCLUDES) ../toolchain.c > $@.tmp
+	$(CPP) $(CPPFLAGS) $(INCLUDES) ../probe-openssl.c > probe-openssl.out && echo "EVENT2_HAS_OPENSSL = YES" >> $@.tmp || echo "No OpenSSL"
+	$(MV) $@.tmp $@
 
 endif
diff --git a/configure/probe-openssl.c b/configure/probe-openssl.c
new file mode 100644
index 00000000..0dd8b72c
--- /dev/null
+++ b/configure/probe-openssl.c
@@ -0,0 +1,17 @@
+
+#include <openssl/opensslv.h>
+
+#ifndef OPENSSL_VERSION_NUMBER
+#  error Some antique OpenSSL version?
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x30000000
+#  error Minimum OpenSSL 3.0
+#endif
+
+#include <event2/event-config.h>
+
+#ifndef EVENT__HAVE_OPENSSL
+#  error libevent not built with OpenSSL support
+#endif
+
+#include <event2/bufferevent_ssl.h>
diff --git a/configure/toolchain.c b/configure/toolchain.c
index f503a301..cecba730 100644
--- a/configure/toolchain.c
+++ b/configure/toolchain.c
@@ -7,6 +7,9 @@
  * MSVC preprocessor emits C comments in output
  */
 #endif
+#ifndef __has_include
+#  define __has_include(X) (0)
+#endif
 #define VERSION_INT(V,R,M,P) ( ((V)<<24) | ((R)<<16) | ((M)<<8) | (P))
 
 CONFIG_LOADED=YES
diff --git a/example/Makefile b/example/Makefile
index 44782327..04ecb529 100644
--- a/example/Makefile
+++ b/example/Makefile
@@ -3,8 +3,7 @@ TOP=..
 include $(TOP)/configure/CONFIG
 # cfg/ sometimes isn't correctly included due to a Base bug
 # so we do here (maybe again) as workaround
-include $(TOP)/configure/CONFIG_PVXS_MODULE
-include $(TOP)/configure/CONFIG_PVXS_VERSION
+-include $(wildcard $(TOP)/cfg/CONFIG*))
 #----------------------------------------
 #  ADD MACRO DEFINITIONS AFTER THIS LINE
 #=============================
@@ -35,7 +34,7 @@ rpc_client_SRCS += rpc_client.cpp
 #===========================
 
 include $(TOP)/configure/RULES
-include $(TOP)/configure/RULES_PVXS_MODULE
+-include $(wildcard $(TOP)/cfg/RULES*))
 #----------------------------------------
 #  ADD RULES AFTER THIS LINE
 
diff --git a/ioc/Makefile b/ioc/Makefile
index 4c0cea82..fb5e6efc 100644
--- a/ioc/Makefile
+++ b/ioc/Makefile
@@ -11,8 +11,7 @@ TOP=..
 include $(TOP)/configure/CONFIG
 # cfg/ sometimes isn't correctly included due to an issue in epics-base
 # so we do here (maybe again) as workaround
-include $(TOP)/configure/CONFIG_PVXS_MODULE
-include $(TOP)/configure/CONFIG_PVXS_VERSION
+-include $(wildcard $(TOP)/cfg/CONFIG*))
 #----------------------------------------
 #  ADD MACRO DEFINITIONS AFTER THIS LINE
 #=============================
@@ -80,7 +79,7 @@ LIB_LIBS += $(EPICS_BASE_IOC_LIBS)
 #===========================
 
 include $(TOP)/configure/RULES
-include $(TOP)/configure/RULES_PVXS_MODULE
+-include $(wildcard $(TOP)/cfg/RULES*))
 #----------------------------------------
 #  ADD RULES AFTER THIS LINE
 
diff --git a/qsrv/Makefile b/qsrv/Makefile
index 6faf9274..7aa87ea3 100644
--- a/qsrv/Makefile
+++ b/qsrv/Makefile
@@ -3,8 +3,7 @@ TOP=..
 include $(TOP)/configure/CONFIG
 # cfg/ sometimes isn't correctly included due to a Base bug
 # so we do here (maybe again) as workaround
-include $(TOP)/configure/CONFIG_PVXS_MODULE
-include $(TOP)/configure/CONFIG_PVXS_VERSION
+-include $(wildcard $(TOP)/cfg/CONFIG*))
 #----------------------------------------
 #  ADD MACRO DEFINITIONS AFTER THIS LINE
 #=============================
@@ -31,7 +30,7 @@ FINAL_LOCATION ?= $(shell $(PERL) $(TOOLS)/fullPathName.pl $(INSTALL_LOCATION))
 #===========================
 
 include $(TOP)/configure/RULES
-include $(TOP)/configure/RULES_PVXS_MODULE
+-include $(wildcard $(TOP)/cfg/RULES*))
 #----------------------------------------
 #  ADD RULES AFTER THIS LINE
 
diff --git a/setup/CONFIG_PVXS_MODULE b/setup/CONFIG_PVXS_MODULE
new file mode 100644
index 00000000..9dcfd8a1
--- /dev/null
+++ b/setup/CONFIG_PVXS_MODULE
@@ -0,0 +1,35 @@
+# auto-compute location of this file.
+# avoid need to standardize configure/RELEASE name
+_PVXS := $(dir $(lastword $(MAKEFILE_LIST)))
+
+# we're appending so must be idempotent
+ifeq (,$(_PVXS_CONF_INCLUDED))
+_PVXS_CONF_INCLUDED := YES
+
+ifdef T_A
+
+ifneq (YES,$(_PVXS_BOOTSTRAP))
+include $(_PVXS)/TOOLCHAIN_PVXS.$(T_A)
+endif
+
+# from generated cfg/TOOLCHAIN_PVXS.$(T_A)
+LIBEVENT_PREFIX = $(LIBEVENT_PREFIX_$(T_A))
+LIBEVENT_BUNDLE_LIBS = $(LIBEVENT_BUNDLE_LIBS_$(T_A))
+LIBEVENT_SYS_LIBS = $(LIBEVENT_SYS_LIBS_$(T_A))
+
+# apply to include search paths
+INCLUDES += $(if $(LIBEVENT_PREFIX),-I$(LIBEVENT_PREFIX)/include)
+
+LIBEVENT_BUNDLE_LDFLAGS__RPATH=-Wl,-rpath,$(LIBEVENT_PREFIX)/lib
+LIBEVENT_BUNDLE_LDFLAGS_Darwin_NO = $(if $(LIBEVENT_PREFIX),$(LIBEVENT_BUNDLE_LDFLAGS__RPATH))
+LIBEVENT_BUNDLE_LDFLAGS += $(LIBEVENT_BUNDLE_LDFLAGS_$(OS_CLASS)_$(STATIC_BUILD))
+
+event_core_DIR = $(LIBEVENT_PREFIX)/lib
+event_openssl_DIR = $(LIBEVENT_PREFIX)/lib
+event_pthreads_DIR = $(LIBEVENT_PREFIX)/lib
+
+endif # T_A
+
+endif # _PVXS_CONF_INCLUDED
+
+# logic continues in RULES_PVXS_MODULE
diff --git a/setup/Makefile b/setup/Makefile
new file mode 100644
index 00000000..b8abdf94
--- /dev/null
+++ b/setup/Makefile
@@ -0,0 +1,50 @@
+TOP=..
+
+# step 1 in configure/Makefile
+# step 2. generate cfg/TOOLCHAIN_PVXS.$(T_A)
+#         install cfg/*
+# remaining TOP directories will include generated files
+_PVXS_BOOTSTRAP = YES
+
+include $(TOP)/configure/CONFIG
+
+LIBEVENT ?= $(LIBEVENT_$(T_A))
+LIBEVENT_$(T_A) ?= $(wildcard $(abspath $(TOP)/bundle/usr/$(T_A)))
+
+_LIBEVENT_BUNDLE_LIBS_YES = event_openssl
+_LIBEVENT_SYS_LIBS_YES += ssl crypto
+
+_LIBEVENT_BUNDLE_LIBS += $(_LIBEVENT_BUNDLE_LIBS_$(EVENT2_HAS_OPENSSL))
+_LIBEVENT_BUNDLE_LIBS += event_core
+
+_LIBEVENT_SYS_LIBS += $(_LIBEVENT_SYS_LIBS_$(EVENT2_HAS_OPENSSL))
+
+ifeq (WIN32,$(OS_CLASS))
+_LIBEVENT_SYS_LIBS += bcrypt iphlpapi netapi32 ws2_32
+else
+_LIBEVENT_BUNDLE_LIBS += event_pthreads
+endif
+
+# at this point we have included the generated O.$(T_A)/TOOLCHAIN
+# and use this to generated CONFIG_PVXS_MODULE
+
+CFG += CONFIG_PVXS_MODULE
+CFG += RULES_PVXS_MODULE
+
+ifdef T_A
+CFG += TOOLCHAIN_PVXS.$(T_A)
+endif
+
+include $(TOP)/configure/RULES
+
+ifdef T_A
+
+EXPAND_ARGS = -a $(T_A) -t "$(INSTALL_LOCATION)"
+EXPAND_ARGS += "-DLIBEVENT=$(LIBEVENT)"
+EXPAND_ARGS += "-DLIBEVENT_BUNDLE_LIBS=$(_LIBEVENT_BUNDLE_LIBS)"
+EXPAND_ARGS += "-DLIBEVENT_SYS_LIBS=$(_LIBEVENT_SYS_LIBS)"
+
+TOOLCHAIN_PVXS.$(T_A): ../TOOLCHAIN_PVXS.target@
+	$(EXPAND_TOOL) $(EXPAND_ARGS) $< $@
+
+endif
diff --git a/configure/RULES_PVXS_MODULE b/setup/RULES_PVXS_MODULE
similarity index 97%
rename from configure/RULES_PVXS_MODULE
rename to setup/RULES_PVXS_MODULE
index a3738285..0348f5c6 100644
--- a/configure/RULES_PVXS_MODULE
+++ b/setup/RULES_PVXS_MODULE
@@ -11,7 +11,7 @@ endif
 
 _PVXS_CHECK_VARS := PROD TESTPROD LIB $(PROD) $(TESTPROD) $(LIBRARY)
 
-ifeq (,$(LIBEVENT))
+ifeq (,$(LIBEVENT_PREFIX))
 # libevent in default search path
 
 # $(1) is PROD or LIBRARY name
diff --git a/setup/TOOLCHAIN_PVXS.target@ b/setup/TOOLCHAIN_PVXS.target@
new file mode 100644
index 00000000..2dae3f25
--- /dev/null
+++ b/setup/TOOLCHAIN_PVXS.target@
@@ -0,0 +1,3 @@
+LIBEVENT_PREFIX_@ARCH@ = @LIBEVENT@
+LIBEVENT_BUNDLE_LIBS_@ARCH@ = @LIBEVENT_BUNDLE_LIBS@
+LIBEVENT_SYS_LIBS_@ARCH@ = @LIBEVENT_SYS_LIBS@
diff --git a/src/Makefile b/src/Makefile
index 4a885d52..7dc2a03e 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -3,8 +3,7 @@ TOP=..
 include $(TOP)/configure/CONFIG
 # cfg/ sometimes isn't correctly included due to a Base bug
 # so we do here (maybe again) as workaround
-include $(TOP)/configure/CONFIG_PVXS_MODULE
-include $(TOP)/configure/CONFIG_PVXS_VERSION
+-include $(wildcard $(TOP)/cfg/CONFIG*))
 #----------------------------------------
 #  ADD MACRO DEFINITIONS AFTER THIS LINE
 #=============================
@@ -12,6 +11,10 @@ include $(TOP)/configure/CONFIG_PVXS_VERSION
 USR_CPPFLAGS += -DPVXS_API_BUILDING
 USR_CPPFLAGS += -DPVXS_ENABLE_EXPERT_API
 
+ifeq (YES,$(EVENT2_HAS_OPENSSL))
+USR_CPPFLAGS += -DPVXS_ENABLE_OPENSSL
+endif
+
 ifdef T_A
 ifneq ($(CONFIG_LOADED),YES)
 $(error Toolchain inspection failed $(MAKEFILE_LIST))
@@ -111,7 +114,7 @@ LIB_SRCS += clientdiscover.cpp
 LIB_LIBS += Com
 
 # special case matching configure/RULES_PVXS_MODULE
-ifeq (,$(LIBEVENT))
+ifeq (,$(LIBEVENT_PREFIX))
 LIB_SYS_LIBS += $(LIBEVENT_BUNDLE_LIBS)
 else
 LIB_LIBS += $(LIBEVENT_BUNDLE_LIBS)
@@ -122,7 +125,7 @@ LIB_SYS_LIBS += $(LIBEVENT_SYS_LIBS)
 #===========================
 
 include $(TOP)/configure/RULES
-include $(TOP)/configure/RULES_PVXS_MODULE
+-include $(wildcard $(TOP)/cfg/RULES*))
 #----------------------------------------
 #  ADD RULES AFTER THIS LINE
 
diff --git a/test/Makefile b/test/Makefile
index 2abca671..66debbdc 100644
--- a/test/Makefile
+++ b/test/Makefile
@@ -3,8 +3,7 @@ TOP=..
 include $(TOP)/configure/CONFIG
 # cfg/ sometimes isn't correctly included due to a Base bug
 # so we do here (maybe again) as workaround
-include $(TOP)/configure/CONFIG_PVXS_MODULE
-include $(TOP)/configure/CONFIG_PVXS_VERSION
+-include $(wildcard $(TOP)/cfg/CONFIG*))
 #----------------------------------------
 #  ADD MACRO DEFINITIONS AFTER THIS LINE
 #=============================
@@ -181,7 +180,7 @@ endif
 #===========================
 
 include $(TOP)/configure/RULES
-include $(TOP)/configure/RULES_PVXS_MODULE
+-include $(wildcard $(TOP)/cfg/RULES*))
 #----------------------------------------
 #  ADD RULES AFTER THIS LINE
 
diff --git a/tools/Makefile b/tools/Makefile
index 4e3eef48..b8b1c9af 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -3,8 +3,7 @@ TOP=..
 include $(TOP)/configure/CONFIG
 # cfg/ sometimes isn't correctly included due to a Base bug
 # so we do here (maybe again) as workaround
-include $(TOP)/configure/CONFIG_PVXS_MODULE
-include $(TOP)/configure/CONFIG_PVXS_VERSION
+-include $(wildcard $(TOP)/cfg/CONFIG*))
 #----------------------------------------
 #  ADD MACRO DEFINITIONS AFTER THIS LINE
 #=============================
@@ -41,7 +40,7 @@ pvxmshim_SRCS += mshim.cpp
 #===========================
 
 include $(TOP)/configure/RULES
-include $(TOP)/configure/RULES_PVXS_MODULE
+-include $(wildcard $(TOP)/cfg/RULES*))
 #----------------------------------------
 #  ADD RULES AFTER THIS LINE