Index: build/make-kit-win32
==================================================================
--- build/make-kit-win32
+++ build/make-kit-win32
@@ -4,8 +4,10 @@
 CC=i586-mingw32msvc-gcc
 CXX=i586-mingw32msvc-g++
 RANLIB=i586-mingw32msvc-ranlib
 RC=i586-mingw32msvc-windres
 STRIP="${STRIP:-i586-mingw32msvc-strip}"
-export AR CC CXX RANLIB RC STRIP
+TEA_PLATFORM='windows'
+KC_TLS_LINKADD='-lws2_32 -lgdi32'
+export AR CC CXX RANLIB RC STRIP TEA_PLATFORM KC_TLS_LINKADD
 
 ./kitcreator "$@" --host=i586-mingw32msvc

Index: tls/build.sh
==================================================================
--- tls/build.sh
+++ tls/build.sh
@@ -9,11 +9,11 @@
 	echo 'ERROR: The TCLVERS environment variable is not set' >&2
 
 	exit 1
 fi
 
-TLSVERS="1.6"
+TLSVERS="1.6.7"
 SRC="src/tls-${TLSVERS}.tar.gz"
 SRCURL="http://sourceforge.net/projects/tls/files/tls/${TLSVERS}/tls${TLSVERS}-src.tar.gz"
 BUILDDIR="$(pwd)/build/tls${TLSVERS}"
 OUTDIR="$(pwd)/out"
 INSTDIR="$(pwd)/inst"
@@ -57,11 +57,21 @@
 
 	# Determine SSL directory
 	if [ -z "${CPP}" ]; then
 		CPP="${CC} -E"
 	fi
-	SSLDIR="$(echo '#include <openssl/ssl.h>' 2>/dev/null | ${CPP} - | awk '/# 1 "\/.*\/ssl\.h/{ print $3; exit }' | sed 's@^"@@;s@"$@@;s@/include/openssl/ssl\.h$@@')"
+
+	if [ -n "${KC_TLS_SSLDIR}" ]; then
+		SSLDIR="${KC_TLS_SSLDIR}"
+	else
+		SSLDIR="$(echo '#include <openssl/ssl.h>' 2>/dev/null | ${CPP} - | awk '/# 1 "\/.*\/ssl\.h/{ print $3; exit }' | sed 's@^"@@;s@"$@@;s@/include/openssl/ssl\.h$@@')"
+		if [ -z "${SSLDIR}" ]; then
+			echo "Unable to find OpenSSL, aborting." >&2
+
+			exit 1
+		fi
+	fi
 
 	# Apply required patches
 	cd "${BUILDDIR}" || exit 1
 	for patch in "${PATCHDIR}/all"/tls-${TLSVERS}-*.diff "${PATCHDIR}/${TCL_VERSION}"/tls-${TLSVERS}-*.diff; do
 		if [ ! -f "${patch}" ]; then
@@ -129,10 +139,15 @@
 
 			echo "Running: ${MAKE:-make} tcllibdir=\"${INSTDIR}/lib\" AR=\"${AR:-ar}\" RANLIB=\"${RANLIB:-ranlib}\" install"
 			${MAKE:-make} tcllibdir="${INSTDIR}/lib" AR="${AR:-ar}" RANLIB="${RANLIB:-ranlib}" install || exit 1
 		) || continue
 
+		# Determine SSL library directory
+		SSL_LIB_DIR="$(${MAKE:-make} --print-data-base | awk '/^SSL_LIB_DIR = /{ print }' | sed 's@^SSL_LIB_DIR = *@@')"
+
+		echo "SSL_LIB_DIR = ${SSL_LIB_DIR}"
+
 		break
 	done
 
 	# Create pkgIndex if needed
 	if [ ! -e "${INSTDIR}/lib/tls${TLSVERS}/pkgIndex.tcl" ]; then
@@ -141,21 +156,25 @@
     "[list source [file join \$dir tls.tcl]] ; \
      [list load {} tls]"
 _EOF_
 	fi
 
+	# Determine name of static object
+	LINKADDFILE="$(find "${INSTDIR}" -name '*.a' | head -n 1).linkadd"
+
 	## XXX: TODO: Determine what we actually need to link against
-	addlibs="-lssl -lcrypto"
+	addlibs="-L${SSL_LIB_DIR:-/lib} -lssl -lcrypto ${KC_TLS_LINKADD}"
+	addlibs_staticOnly=""
 	if [ "${KC_TLS_LINKSSLSTATIC}" = '1' ]; then
-		echo "-Wl,-Bstatic ${addlibs} -Wl,-Bdynamic"
+		echo "-Wl,-Bstatic ${addlibs} ${addlibs_staticOnly} -Wl,-Bdynamic"
 	else
 		echo "${addlibs}"
-	fi > "${INSTDIR}/lib/tls${TLSVERS}/libtls${TLSVERS}.a.linkadd"
+	fi > "${LINKADDFILE}"
 
 	# Install files needed by installation
 	cp -r "${INSTDIR}/lib" "${OUTDIR}" || exit 1
 	find "${OUTDIR}" -name '*.a' -type f | xargs -n 1 rm -f --
 
 	exit 0
 ) || exit 1
 
 exit 0

ADDED   tls/patches/all/tls-1.6.7-fixcrosscompile.diff
Index: tls/patches/all/tls-1.6.7-fixcrosscompile.diff
==================================================================
--- /dev/null
+++ tls/patches/all/tls-1.6.7-fixcrosscompile.diff
@@ -0,0 +1,45 @@
+diff -uNr tls1.6.7.orig/configure tls1.6.7-fixcrosscompile/configure
+--- tls1.6.7.orig/configure	2015-07-07 12:16:02.000000000 -0500
++++ tls1.6.7-fixcrosscompile/configure	2015-10-28 09:59:25.414214000 -0500
+@@ -1387,7 +1387,9 @@
+ fi
+ 
+ 	    EXEEXT=".exe"
+-	    TEA_PLATFORM="windows"
++		if [ -z "${TEA_PLATFORM}" ]; then
++			TEA_PLATFORM="windows"
++		fi
+ 	    ;;
+ 	*CYGWIN_*)
+ 	    CYGPATH=echo
+@@ -1397,7 +1399,9 @@
+ 	*)
+ 	    CYGPATH=echo
+ 	    EXEEXT=""
+-	    TEA_PLATFORM="unix"
++		if [ -z "${TEA_PLATFORM}" ]; then
++			TEA_PLATFORM="unix"
++		fi
+ 	    ;;
+     esac
+ 
+@@ -1682,13 +1686,17 @@
+ echo $ECHO_N "checking for cygwin variant... $ECHO_C" >&6
+ 	    case ${TCL_EXTRA_CFLAGS} in
+ 		*-mwin32*|*-mno-cygwin*)
+-		    TEA_PLATFORM="windows"
++			if [ -z "${TEA_PLATFORM}" ]; then
++				TEA_PLATFORM="windows"
++			fi
+ 		    CFLAGS="$CFLAGS -mwin32"
+ 		    echo "$as_me:$LINENO: result: win32" >&5
+ echo "${ECHO_T}win32" >&6
+ 		    ;;
+ 		*)
+-		    TEA_PLATFORM="unix"
++			if [ -z "${TEA_PLATFORM}" ]; then
++				TEA_PLATFORM="unix"
++			fi
+ 		    echo "$as_me:$LINENO: result: unix" >&5
+ echo "${ECHO_T}unix" >&6
+ 		    ;;

ADDED   tls/patches/all/tls-1.6.7-peercertificate.diff
Index: tls/patches/all/tls-1.6.7-peercertificate.diff
==================================================================
--- /dev/null
+++ tls/patches/all/tls-1.6.7-peercertificate.diff
@@ -0,0 +1,43 @@
+diff -uNr tls1.6.7.orig/tlsX509.c tls1.6.7-peercertificate/tlsX509.c
+--- tls1.6.7.orig/tlsX509.c	2004-06-29 05:58:08.000000000 -0500
++++ tls1.6.7-peercertificate/tlsX509.c	2015-10-28 10:19:04.914214000 -0500
+@@ -100,12 +100,14 @@
+     char serial[BUFSIZ];
+     char notBefore[BUFSIZ];
+     char notAfter[BUFSIZ];
++    char certStr[BUFSIZ];
+ #ifndef NO_SSL_SHA
+     int shai;
+     char sha_hash[SHA_DIGEST_LENGTH*2];
+     const char *shachars="0123456789ABCDEF";
+ #endif
+ 
++    certStr[0] = 0;
+     if ((bio = BIO_new(BIO_s_mem())) == NULL) {
+ 	subject[0] = 0;
+ 	issuer[0]  = 0;
+@@ -132,6 +134,13 @@
+ 	serial[n] = 0;
+ 	BIO_flush(bio);
+ 
++        if (PEM_write_bio_X509(bio, cert)) {
++            n = BIO_read(bio, certStr, min(BIO_pending(bio), BUFSIZ - 1));
++            n = max(n, 0);
++            certStr[n] = 0;
++            BIO_flush(bio);
++        }
++
+ 	BIO_free(bio);
+     }
+ 
+@@ -175,5 +184,10 @@
+     Tcl_ListObjAppendElement( interp, certPtr,
+ 	    Tcl_NewStringObj( serial, -1) );
+ 
++    Tcl_ListObjAppendElement( interp, certPtr,
++	    Tcl_NewStringObj( "certificate", -1) );
++    Tcl_ListObjAppendElement( interp, certPtr,
++	    Tcl_NewStringObj( certStr, -1) );
++
+     return certPtr;
+ }