find_package(OpenSSL QUIET)
if(OPENSSL_FOUND)
  set(HAVE_OPENSSL_RNG TRUE)
  if(OPENSSL_VERSION VERSION_LESS "3.0.0")
    message(STATUS "Install version >= 3.0.0 to enable OpenSSL support "
                   "(found version \"${OPENSSL_VERSION}\")")
  else()
    set(DISABLE_OPENSSL FALSE CACHE BOOL "Disable OpenSSL support")
    if(NOT DISABLE_OPENSSL)
      message(STATUS "OpenSSL support enabled, found version ${OPENSSL_VERSION}")
      set(HAVE_OPENSSL TRUE CACHE INTERNAL "OpenSSL cryptography support available")
      set(DISABLE_PQC FALSE CACHE BOOL "Disable post-quantum cryptography support")
      if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.4.0")
        if(NOT DISABLE_PQC)
          set(HAVE_OPENSSL_PQC TRUE CACHE INTERNAL "OpenSSL post-quantum cryptography available")
          message(STATUS "OpenSSL PQC support enabled")
        else()
          message(STATUS "OpenSSL PQC support disabled by user")
          unset(HAVE_OPENSSL_PQC CACHE)
        endif()
      else()
        message(STATUS "Install OpenSSL >= 3.4.0 for PQC support")
      endif()
    else()
      message(STATUS "OpenSSL support disabled")
      unset(HAVE_OPENSSL CACHE)
    endif()
  endif()
else()
  message(STATUS "Install OpenSSL version >= 3.0.0 to enable OpenSSL support")
  unset(HAVE_OPENSSL_RNG)
  unset(HAVE_OPENSSL CACHE)
endif()

# Secure memory options are in cmake/config/global.cmake