diff --git a/security/testssl.sh/Makefile b/security/testssl.sh/Makefile
index d8d641b0bb27..7f65435754d3 100644
--- a/security/testssl.sh/Makefile
+++ b/security/testssl.sh/Makefile
@@ -1,43 +1,43 @@
 PORTNAME=	testssl.sh
 DISTVERSIONPREFIX=	v
-DISTVERSION=	3.0.6
+DISTVERSION=	3.0.7
 CATEGORIES=	security
 
 MAINTAINER=	adamw@FreeBSD.org
 COMMENT=	Analyze and report TLS/SSL configuration/misconfiguration
 
 LICENSE=	GPLv2
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 RUN_DEPENDS=	openssl-unsafe>=1.0.1:security/openssl-unsafe \
 		bash:shells/bash
 TEST_DEPENDS=	p5-JSON>=0:converters/p5-JSON
 
 USES=		perl5 shebangfix
 USE_GITHUB=	yes
 GH_ACCOUNT=	drwetter
 
 SHEBANG_FILES=	testssl.sh utils/*
 
 USE_PERL5=	test
 TEST_ENV=	TESTSSL_INSTALL_DIR=${WRKSRC}
 
 NO_ARCH=	yes
 NO_BUILD=	yes
 
 post-patch:
 	${REINPLACE_CMD} -e 's|%%PREFIX%%|${PREFIX}|; s|%%DATADIR%%|${DATADIR}|' \
 		${WRKSRC}/testssl.sh
 
 do-install:
 	${INSTALL_SCRIPT} ${WRKSRC}/testssl.sh ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_MAN} ${WRKSRC}/doc/testssl.1 ${STAGEDIR}${MAN1PREFIX}/man/man1
 	cd ${WRKSRC} && ${COPYTREE_SHARE} "etc utils" ${STAGEDIR}${DATADIR}
 
 do-test:
 # Run the badssl.com test as a sanity check.  The full test suite
 # opens too many network connections and might take too long to
 # run.
 	cd ${WRKSRC} && ${SETENV} ${TEST_ENV} prove -v t/51_badssl.com.t
 
 .include <bsd.port.mk>
diff --git a/security/testssl.sh/distinfo b/security/testssl.sh/distinfo
index 6c4a67b59dc1..31abe3c57ded 100644
--- a/security/testssl.sh/distinfo
+++ b/security/testssl.sh/distinfo
@@ -1,3 +1,3 @@
-TIMESTAMP = 1633279615
-SHA256 (drwetter-testssl.sh-v3.0.6_GH0.tar.gz) = 05768444d6cf3dc5812f8fb88695d17a82668089deddd6aaf969041ba4c10b10
-SIZE (drwetter-testssl.sh-v3.0.6_GH0.tar.gz) = 9217988
+TIMESTAMP = 1645302781
+SHA256 (drwetter-testssl.sh-v3.0.7_GH0.tar.gz) = c2beb3ae1fc1301ad845c7aa01c0a292c41b95747ef67f34601f21fb2da16145
+SIZE (drwetter-testssl.sh-v3.0.7_GH0.tar.gz) = 9219774
diff --git a/security/testssl.sh/files/patch-testssl.sh b/security/testssl.sh/files/patch-testssl.sh
index 13c5e3bee4a2..46ad2069d189 100644
--- a/security/testssl.sh/files/patch-testssl.sh
+++ b/security/testssl.sh/files/patch-testssl.sh
@@ -1,29 +1,29 @@
---- testssl.sh.orig	2020-09-29 09:50:09 UTC
+--- testssl.sh.orig	2022-02-19 20:34:21 UTC
 +++ testssl.sh
 @@ -132,7 +132,7 @@ declare -r RUN_DIR="$(dirname "$0")"
  declare -r SYSTEM="$(uname -s)"
  declare -r SYSTEMREV="$(uname -r)"
  SYSTEM2=""                                        # currently only being used for WSL = bash on windows
 -TESTSSL_INSTALL_DIR="${TESTSSL_INSTALL_DIR:-""}"  # If you run testssl.sh and it doesn't find it necessary file automagically set TESTSSL_INSTALL_DIR
 +TESTSSL_INSTALL_DIR="${TESTSSL_INSTALL_DIR:-"%%DATADIR%%"}"  # If you run testssl.sh and it doesn't find it necessary file automagically set TESTSSL_INSTALL_DIR
  CA_BUNDLES_PATH="${CA_BUNDLES_PATH:-""}"          # You can have your stores some place else
  ADDITIONAL_CA_FILES="${ADDITIONAL_CA_FILES:-""}"  # single file with a CA in PEM format or comma separated lists of them
  CIPHERS_BY_STRENGTH_FILE=""
 @@ -187,6 +187,9 @@ TERM_CURRPOS=0                                        
  ########### Defining (and presetting) variables which can be changed
  #
  # Following variables make use of $ENV and can be used like "OPENSSL=<myprivate_path_to_openssl> ./testssl.sh <URI>"
 +if [[ -z "$OPENSSL" ]]; then
-+     OPENSSL=%%PREFIX%%/openssl-unsafe/bin/openssl
++     OPENSSL="%%PREFIX%%/openssl-unsafe/bin/openssl"
 +fi
  declare -x OPENSSL
  OPENSSL_TIMEOUT=${OPENSSL_TIMEOUT:-""}  # Default connect timeout with openssl before we call the server side unreachable
  CONNECT_TIMEOUT=${CONNECT_TIMEOUT:-""}  # Default connect timeout with sockets before we call the server side unreachable
-@@ -20128,7 +20131,6 @@ lets_roll() {
+@@ -20345,7 +20348,6 @@ lets_roll() {
       mybanner
       check_proxy
       check4openssl_oldfarts
 -     check_bsd_mount
- 
+      setup_lc_collate
  
       if "$do_display_only"; then