diff --git a/www/hiawatha/Makefile b/www/hiawatha/Makefile
index 4e2ec5398407..334e8a9cb649 100644
--- a/www/hiawatha/Makefile
+++ b/www/hiawatha/Makefile
@@ -1,70 +1,71 @@
 PORTNAME=	hiawatha
 PORTVERSION=	11.2
+PORTREVISION=	1
 CATEGORIES=	www
 MASTER_SITES=	https://www.hiawatha-webserver.org/files/
 
 MAINTAINER=	ports@FreeBSD.org
 COMMENT=	Advanced and secure webserver for Unix
 WWW=		https://www.hiawatha-webserver.org/
 
 LICENSE=	GPLv2
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 LIB_DEPENDS=	libmbedtls.so:security/mbedtls
 
 USES=		cmake:insource compiler:c11 cpe localbase:ldflags shebangfix
 CPE_VENDOR=	${PORTNAME}-webserver
 USE_RC_SUBR=	hiawatha
 SHEBANG_FILES=	extra/letsencrypt/lefh.in
 
 CMAKE_ARGS=	-DCMAKE_INSTALL_LOCALSTATEDIR=/var \
 		-DWEBROOT_DIR=${WWWDIR} \
 		-DWORK_DIR=/var/db/${PORTNAME}
 CMAKE_ON=	USE_SYSTEM_MBEDTLS
 
 OPTIONS_DEFINE=		CACHE CGIWRAPPER LEFH LOADCHECK MONITOR RPROXY TOMAHAWK \
 			TOOLKIT XSLT
 OPTIONS_DEFAULT=	CACHE CGIWRAPPER RPROXY TOOLKIT XSLT
 OPTIONS_SUB=		yes
 
 CACHE_DESC=		Caching support
 CGIWRAPPER_DESC=	Install cgi-wrapper(1) (needs setuid bit)
 LEFH_DESC=		Install Let's Encrypt For Hiawatha script
 LOADCHECK_DESC=		Load check support (experimental)
 MONITOR_DESC=		Hiawatha Monitor support
 RPROXY_DESC=		Reverse proxy support
 TOMAHAWK_DESC=		Tomahawk command shell support
 TOOLKIT_DESC=		URL toolkit support
 XSLT_DESC=		XSLT support
 
 CACHE_CMAKE_BOOL=	ENABLE_CACHE
 LEFH_USES=		php:cli
 LOADCHECK_CMAKE_BOOL=	ENABLE_LOADCHECK
 MONITOR_CMAKE_BOOL=	ENABLE_MONITOR
 RPROXY_CMAKE_BOOL=	ENABLE_RPROXY
 TOMAHAWK_CMAKE_BOOL=	ENABLE_TOMAHAWK
 TOOLKIT_CMAKE_BOOL=	ENABLE_TOOLKIT
 XSLT_USES=		gnome
 XSLT_USE=		GNOME=libxslt
 XSLT_CMAKE_BOOL=	ENABLE_XSLT
 
 post-patch:
 	@${REINPLACE_CMD} -e 's|/usr/bin/ssi-cgi|${PREFIX}/bin/ssi-cgi|g' \
 		-e 's|/usr/bin|${LOCALBASE}/bin|g' \
 		${WRKSRC}/config/cgi-wrapper.conf \
 		${WRKSRC}/config/hiawatha.conf.in
 	@${REINPLACE_CMD} -e 's|/usr/sbin|${PREFIX}/sbin|g' \
 		-e 's|/etc/hiawatha|${ETCDIR}|g' \
 		${WRKSRC}/man/hiawatha.1.in
 
 post-install:
 .for f in hiawatha.conf mimetype.conf cgi-wrapper.conf toolkit.conf error.xslt \
 	index.xslt
 	${INSTALL_DATA} ${WRKSRC}/config/${f} \
 		${STAGEDIR}${PREFIX}/etc/hiawatha/${f}.sample
 .endfor
 	@${MKDIR} ${STAGEDIR}${WWWDIR}
 	${INSTALL_DATA} ${WRKSRC}/extra/index.html \
 		${STAGEDIR}${WWWDIR}/index.html.sample
 
 .include <bsd.port.mk>
diff --git a/www/hiawatha/files/patch-src_tls.c b/www/hiawatha/files/patch-src_tls.c
index e7723e37d069..d549f8bc366c 100644
--- a/www/hiawatha/files/patch-src_tls.c
+++ b/www/hiawatha/files/patch-src_tls.c
@@ -1,25 +1,29 @@
 --- src/tls.c.orig	2022-01-22 12:16:26 UTC
 +++ src/tls.c
+@@ -161,7 +161,7 @@ int init_tls_module(mbedtls_x509_crt *ca_certificates)
+ int init_tls_module(mbedtls_x509_crt *ca_certificates) {
+ 	char version[16];
+ 
+-	if (mbedtls_version_get_number() < 0x03000000) {
++	if (mbedtls_version_get_number() < 0x021c0000) {
+ 		mbedtls_version_get_string(version);
+ 		fprintf(stderr, "This Hiawatha installation requires at least mbed TLS v3.0.0 and you have v%s.\n", version);
+ 		return -1;
 @@ -322,7 +322,7 @@ int tls_load_key_cert(char *file, mbedtls_pk_context *
  	}
  	mbedtls_pk_init(*private_key);
  
 -	if ((result = mbedtls_pk_parse_keyfile(*private_key, file, NULL, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE)) != 0) {
 +	if ((result = mbedtls_pk_parse_keyfile(*private_key, file, NULL)) != 0) {
  		print_tls_error(result, "Error loading private key from %s", file);
  		return -1;
  	}
-@@ -436,11 +436,13 @@ int tls_accept(int *sock, mbedtls_ssl_context *context
+@@ -436,7 +436,7 @@ int tls_accept(int *sock, mbedtls_ssl_context *context
  
  	result = TLS_HANDSHAKE_OKE;
  	while ((handshake = mbedtls_ssl_handshake(context)) != 0) {
-+#ifndef __FreeBSD__
- 		if (handshake == MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE) {
+-		if (handshake == MBEDTLS_ERR_SSL_HANDSHAKE_FAILURE) {
++		if (handshake == MBEDTLS_ERR_SSL_BAD_HS_PROTOCOL_VERSION) {
  			mbedtls_ssl_free(context);
  			result = TLS_HANDSHAKE_NO_MATCH;
  			break;
- 		}
-+#endif
- 
- 		if ((handshake != MBEDTLS_ERR_SSL_WANT_READ) && (handshake != MBEDTLS_ERR_SSL_WANT_WRITE)) {
- 			mbedtls_ssl_free(context);
diff --git a/www/hiawatha/files/patch-src_wigwam.c b/www/hiawatha/files/patch-src_wigwam.c
index 47266fdadfa9..cefa70ecc49f 100644
--- a/www/hiawatha/files/patch-src_wigwam.c
+++ b/www/hiawatha/files/patch-src_wigwam.c
@@ -1,23 +1,20 @@
---- src/wigwam.c.orig	2022-08-31 17:25:16 UTC
+--- src/wigwam.c.orig	2022-06-29 09:42:42 UTC
 +++ src/wigwam.c
 @@ -582,7 +582,7 @@ int check_main_config(char *config_dir) {
  		/* Private key check
  		 */
  		mbedtls_pk_init(&private_key);
 -		if (mbedtls_pk_parse_keyfile(&private_key, needle->value, NULL, mbedtls_psa_get_random, MBEDTLS_PSA_RANDOM_STATE) != 0) {
 +		if (mbedtls_pk_parse_keyfile(&private_key, needle->value, NULL) != 0) {
  			printf("Error loading private key from %s.\n", needle->value);
  			errors++;
  			goto next_crt;
-@@ -601,9 +601,11 @@ int check_main_config(char *config_dir) {
+@@ -601,7 +601,7 @@ int check_main_config(char *config_dir) {
  			goto next_crt;
  		}
  
-+#ifndef __FreeBSD__
- 		if (certificate.MBEDTLS_PRIVATE(sig_md) < MBEDTLS_MD_SHA256) {
+-		if (certificate.MBEDTLS_PRIVATE(sig_md) < MBEDTLS_MD_SHA256) {
++		if (certificate.sig_md < MBEDTLS_MD_SHA256) {
  			printf("Warning: the certificate signature algoritm in %s should at least be SHA256.\n", needle->value);
  		}
-+#endif
  
- next_crt:
- 		last_file = needle->value;