diff --git a/security/mbedtls3/Makefile b/security/mbedtls3/Makefile
new file mode 100644
index 000000000000..a4882e5e8ec7
--- /dev/null
+++ b/security/mbedtls3/Makefile
@@ -0,0 +1,37 @@
+PORTNAME=	mbedtls3
+PORTVERSION=	3.1.0
+DISTVERSIONPREFIX=${PORTNAME}-
+CATEGORIES=	security devel
+
+MAINTAINER=	christopher.petrik@usm.edu
+COMMENT=	SSL/TLS and cryptography library
+
+LICENSE=	APACHE20
+LICENSE_FILE=	${WRKSRC}/LICENSE
+
+CONFLICTS_INSTALL=	mbedtls
+USES=		gmake python:test shebangfix
+SHEBANG_FILES=	scripts/*.py tests/scripts/*.py
+
+USE_GITHUB=	yes
+GH_ACCOUNT=	ARMmbed
+
+ALL_TARGET=	no_test
+TEST_TARGET=	test
+MAKE_ENV=	PYTHON=${PYTHON_CMD} SHARED=1
+USE_LDCONFIG=	yes
+
+post-patch:
+	@${RM} ${WRKSRC}/include/mbedtls/*.orig
+	@${REINPLACE_CMD} \
+		-e 's/PREFIX/NAMEPREFIX/' \
+		-e 's/$$(DESTDIR)/&$$(PREFIX)/' \
+		${WRKSRC}/Makefile
+	@${REINPLACE_CMD} 's/-fpic//' ${WRKSRC}/library/Makefile
+
+post-install:
+	${FIND} ${STAGEDIR}${PREFIX}/bin -type f -not -name \*.sh \
+		-exec ${STRIP_CMD} {} +
+	${STRIP_CMD} ${STAGEDIR}${PREFIX}/lib/*.so
+
+.include <bsd.port.mk>
diff --git a/security/mbedtls3/distinfo b/security/mbedtls3/distinfo
new file mode 100644
index 000000000000..39ecea9d27c1
--- /dev/null
+++ b/security/mbedtls3/distinfo
@@ -0,0 +1,3 @@
+TIMESTAMP = 1646684591
+SHA256 (ARMmbed-mbedtls-mbedtls-3.1.0_GH0.tar.gz) = 64d01a3b22b91cf3a25630257f268f11bc7bfa37981ae6d397802dd4ccec4690
+SIZE (ARMmbed-mbedtls-mbedtls-3.1.0_GH0.tar.gz) = 3766628
diff --git a/security/mbedtls3/files/patch-include_mbedtls_config.h b/security/mbedtls3/files/patch-include_mbedtls_config.h
new file mode 100644
index 000000000000..f1d6f39163b9
--- /dev/null
+++ b/security/mbedtls3/files/patch-include_mbedtls_config.h
@@ -0,0 +1,29 @@
+--- include/mbedtls/mbedtls_config.h.orig	2021-12-15 13:47:54 UTC
++++ include/mbedtls/mbedtls_config.h
+@@ -1946,7 +1946,7 @@
+  *
+  * Uncomment this to enable support for use_srtp extension.
+  */
+-//#define MBEDTLS_SSL_DTLS_SRTP
++#define MBEDTLS_SSL_DTLS_SRTP
+ 
+ /**
+  * \def MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
+@@ -2129,7 +2129,7 @@
+  *
+  * Uncomment this to enable pthread mutexes.
+  */
+-//#define MBEDTLS_THREADING_PTHREAD
++#define MBEDTLS_THREADING_PTHREAD
+ 
+ /**
+  * \def MBEDTLS_USE_PSA_CRYPTO
+@@ -2891,7 +2891,7 @@
+  *
+  * Enable this layer to allow use of mutexes within mbed TLS
+  */
+-//#define MBEDTLS_THREADING_C
++#define MBEDTLS_THREADING_C
+ 
+ /**
+  * \def MBEDTLS_TIMING_C
diff --git a/security/mbedtls3/pkg-descr b/security/mbedtls3/pkg-descr
new file mode 100644
index 000000000000..41b01c0c3c83
--- /dev/null
+++ b/security/mbedtls3/pkg-descr
@@ -0,0 +1,4 @@
+mbed TLS is a lightweight, portable, fully featured and standards compliant
+SSL/TLS and cryptography library.
+
+WWW: https://www.trustedfirmware.org/projects/mbed-tls/
diff --git a/security/mbedtls3/pkg-plist b/security/mbedtls3/pkg-plist
new file mode 100644
index 000000000000..3f075e914abd
--- /dev/null
+++ b/security/mbedtls3/pkg-plist
@@ -0,0 +1,153 @@
+bin/mbedtls_benchmark
+bin/mbedtls_cert_app
+bin/mbedtls_cert_req
+bin/mbedtls_cert_write
+bin/mbedtls_crl_app
+bin/mbedtls_crypt_and_hash
+bin/mbedtls_crypto_examples
+bin/mbedtls_dh_client
+bin/mbedtls_dh_genprime
+bin/mbedtls_dh_server
+bin/mbedtls_dlopen
+bin/mbedtls_dlopen_demo.sh
+bin/mbedtls_dtls_client
+bin/mbedtls_dtls_server
+bin/mbedtls_ecdh_curve25519
+bin/mbedtls_ecdsa
+bin/mbedtls_fuzz_client
+bin/mbedtls_fuzz_dtlsclient
+bin/mbedtls_fuzz_dtlsserver
+bin/mbedtls_fuzz_privkey
+bin/mbedtls_fuzz_pubkey
+bin/mbedtls_fuzz_server
+bin/mbedtls_fuzz_x509crl
+bin/mbedtls_fuzz_x509crt
+bin/mbedtls_fuzz_x509csr
+bin/mbedtls_gen_entropy
+bin/mbedtls_gen_key
+bin/mbedtls_gen_random_ctr_drbg
+bin/mbedtls_generate_cpp_dummy_build.sh
+bin/mbedtls_generic_sum
+bin/mbedtls_hello
+bin/mbedtls_key_app
+bin/mbedtls_key_app_writer
+bin/mbedtls_key_ladder_demo
+bin/mbedtls_key_ladder_demo.sh
+bin/mbedtls_load_roots
+bin/mbedtls_mini_client
+bin/mbedtls_mpi_demo
+bin/mbedtls_pem2der
+bin/mbedtls_pk_decrypt
+bin/mbedtls_pk_encrypt
+bin/mbedtls_pk_sign
+bin/mbedtls_pk_verify
+bin/mbedtls_psa_constant_names
+bin/mbedtls_query_compile_time_config
+bin/mbedtls_req_app
+bin/mbedtls_rsa_decrypt
+bin/mbedtls_rsa_encrypt
+bin/mbedtls_rsa_genkey
+bin/mbedtls_rsa_sign
+bin/mbedtls_rsa_sign_pss
+bin/mbedtls_rsa_verify
+bin/mbedtls_rsa_verify_pss
+bin/mbedtls_selftest
+bin/mbedtls_ssl_client1
+bin/mbedtls_ssl_client2
+bin/mbedtls_ssl_context_info
+bin/mbedtls_ssl_fork_server
+bin/mbedtls_ssl_mail_client
+bin/mbedtls_ssl_server
+bin/mbedtls_ssl_server2
+bin/mbedtls_strerror
+bin/mbedtls_udp_proxy
+bin/mbedtls_udp_proxy_wrapper.sh
+bin/mbedtls_zeroize
+include/mbedtls/aes.h
+include/mbedtls/aria.h
+include/mbedtls/asn1.h
+include/mbedtls/asn1write.h
+include/mbedtls/base64.h
+include/mbedtls/bignum.h
+include/mbedtls/build_info.h
+include/mbedtls/camellia.h
+include/mbedtls/ccm.h
+include/mbedtls/chacha20.h
+include/mbedtls/chachapoly.h
+include/mbedtls/check_config.h
+include/mbedtls/cipher.h
+include/mbedtls/cmac.h
+include/mbedtls/compat-2.x.h
+include/mbedtls/config_psa.h
+include/mbedtls/constant_time.h
+include/mbedtls/ctr_drbg.h
+include/mbedtls/debug.h
+include/mbedtls/des.h
+include/mbedtls/dhm.h
+include/mbedtls/ecdh.h
+include/mbedtls/ecdsa.h
+include/mbedtls/ecjpake.h
+include/mbedtls/ecp.h
+include/mbedtls/entropy.h
+include/mbedtls/error.h
+include/mbedtls/gcm.h
+include/mbedtls/hkdf.h
+include/mbedtls/hmac_drbg.h
+include/mbedtls/mbedtls_config.h
+include/mbedtls/md.h
+include/mbedtls/md5.h
+include/mbedtls/memory_buffer_alloc.h
+include/mbedtls/net_sockets.h
+include/mbedtls/nist_kw.h
+include/mbedtls/oid.h
+include/mbedtls/pem.h
+include/mbedtls/pk.h
+include/mbedtls/pkcs12.h
+include/mbedtls/pkcs5.h
+include/mbedtls/platform.h
+include/mbedtls/platform_time.h
+include/mbedtls/platform_util.h
+include/mbedtls/poly1305.h
+include/mbedtls/private_access.h
+include/mbedtls/psa_util.h
+include/mbedtls/ripemd160.h
+include/mbedtls/rsa.h
+include/mbedtls/sha1.h
+include/mbedtls/sha256.h
+include/mbedtls/sha512.h
+include/mbedtls/ssl.h
+include/mbedtls/ssl_cache.h
+include/mbedtls/ssl_ciphersuites.h
+include/mbedtls/ssl_cookie.h
+include/mbedtls/ssl_ticket.h
+include/mbedtls/threading.h
+include/mbedtls/timing.h
+include/mbedtls/version.h
+include/mbedtls/x509.h
+include/mbedtls/x509_crl.h
+include/mbedtls/x509_crt.h
+include/mbedtls/x509_csr.h
+include/psa/crypto.h
+include/psa/crypto_builtin_composites.h
+include/psa/crypto_builtin_primitives.h
+include/psa/crypto_compat.h
+include/psa/crypto_config.h
+include/psa/crypto_driver_common.h
+include/psa/crypto_driver_contexts_composites.h
+include/psa/crypto_driver_contexts_primitives.h
+include/psa/crypto_extra.h
+include/psa/crypto_platform.h
+include/psa/crypto_se_driver.h
+include/psa/crypto_sizes.h
+include/psa/crypto_struct.h
+include/psa/crypto_types.h
+include/psa/crypto_values.h
+lib/libmbedcrypto.a
+lib/libmbedcrypto.so
+lib/libmbedcrypto.so.11
+lib/libmbedtls.a
+lib/libmbedtls.so
+lib/libmbedtls.so.17
+lib/libmbedx509.a
+lib/libmbedx509.so
+lib/libmbedx509.so.4
