diff --git a/security/mbedtls/Makefile b/security/mbedtls/Makefile
index 5d2a5c805997..dd4c87fc05e1 100644
--- a/security/mbedtls/Makefile
+++ b/security/mbedtls/Makefile
@@ -1,39 +1,40 @@
 PORTNAME=	mbedtls
-PORTVERSION=	2.28.5
+PORTVERSION=	2.28.6
 DISTVERSIONPREFIX=${PORTNAME}-
 CATEGORIES=	security devel
 
 MAINTAINER=	tijl@FreeBSD.org
 COMMENT=	SSL/TLS and cryptography library
 WWW=		https://www.trustedfirmware.org/projects/mbed-tls/
 
-LICENSE=	APACHE20
+LICENSE=	APACHE20 GPLv2+
+LICENSE_COMB=	dual
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 USES=		gmake python:test shebangfix
 SHEBANG_FILES=	scripts/*.py tests/scripts/*.py
 
 USE_GITHUB=	yes
 GH_ACCOUNT=	Mbed-TLS
 
 ALL_TARGET=	no_test
 TEST_TARGET=	test
 MAKE_ENV=	PYTHON=${PYTHON_CMD} SHARED=1
 USE_LDCONFIG=	yes
 
 PORTSCOUT=	limit:^${PORTVERSION:R:S/./\./g}\.
 
 post-patch:
 	@${RM} ${WRKSRC}/include/mbedtls/*.orig
 	@${REINPLACE_CMD} \
 		-e 's/PREFIX/NAMEPREFIX/' \
 		-e 's/$$(DESTDIR)/&$$(PREFIX)/' \
 		${WRKSRC}/Makefile
 	@${REINPLACE_CMD} 's/-fpic//' ${WRKSRC}/library/Makefile
 
 post-install:
 	${FIND} ${STAGEDIR}${PREFIX}/bin -type f -not -name \*.sh \
 		-exec ${STRIP_CMD} {} +
 	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/*.so
 
 .include <bsd.port.mk>
diff --git a/security/mbedtls/distinfo b/security/mbedtls/distinfo
index 660d4e4015c3..5e03bfd1cd4a 100644
--- a/security/mbedtls/distinfo
+++ b/security/mbedtls/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1696581549
-SHA256 (Mbed-TLS-mbedtls-mbedtls-2.28.5_GH0.tar.gz) = dbd42a11c26143aa8de1c07fd6ec6765395e86b06f583f051cfa60e8f0b23125
-SIZE (Mbed-TLS-mbedtls-mbedtls-2.28.5_GH0.tar.gz) = 4005000
+TIMESTAMP = 1699528221
+SHA256 (Mbed-TLS-mbedtls-mbedtls-2.28.6_GH0.tar.gz) = 18cac49f4efef7269d233972bb09c57ace40d992229fa49804e7b10cf0debe43
+SIZE (Mbed-TLS-mbedtls-mbedtls-2.28.6_GH0.tar.gz) = 3988909