diff --git a/.gitignore b/.gitignore
index 93bcd04..39a5cf5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,6 +4,8 @@
 /lib/pclsync/compile_commands.json
 /lib/mbedtls-1.3.10/build
 /lib/mbedtls-1.3.10/library/Makefile
+/lib/mbedtls-2.1.14/build
+/lib/mbedtls-2.1.14/library/Makefile
 /build
 /CMakeFiles/
 /cmake_install.cmake
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 8e73437..9e8c107 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -15,7 +15,7 @@ link_directories(${Boost_LIBRARY_DIR})
 #set (CMAKE_CXX_FLAGS "-Wl,-Bstatic")
 set (CMAKE_C_FLAGS "-fPIC")
 set (PCLSYNC_PATH ${CMAKE_SOURCE_DIR}/lib/pclsync)
-set (MBEDTLS_PATH ${CMAKE_SOURCE_DIR}/lib/mbedtls-1.3.10)
+set (MBEDTLS_PATH ${CMAKE_SOURCE_DIR}/lib/mbedtls-2.1.14)
 set (CMD_PATH ${CMAKE_SOURCE_DIR}/cmd/pcloudcc)
 
 #add_subdirectory(${MBEDTLS_PATH})
@@ -40,6 +40,8 @@ add_library(pcloudcc_lib SHARED ${CMD_PATH}/pclsync_lib_c.cpp ${CMD_PATH}/pclsyn
 target_link_libraries(pcloudcc_lib
 	${PCLSYNC_PATH}/psynclib.a
 	${MBEDTLS_PATH}/build/library/libmbedtls.a
+	${MBEDTLS_PATH}/build/library/libmbedx509.a	
+	${MBEDTLS_PATH}/build/library/libmbedcrypto.a	
 	fuse
 	pthread
 	sqlite3
diff --git a/Makefile b/Makefile
index 8e8eb43..6a7396f 100644
--- a/Makefile
+++ b/Makefile
@@ -1,14 +1,14 @@
 all:
 	make -C ./lib/pclsync fs
-	cmake -H./lib/mbedtls-1.3.10 -B./lib/mbedtls-1.3.10/build
-	make -C ./lib/mbedtls-1.3.10/build
+	cmake -H./lib/mbedtls-2.1.14 -B./lib/mbedtls-2.1.14/build
+	make -C ./lib/mbedtls-2.1.14/build
 	mkdir -p ./cmd/pcloudcc/build
 	cmake -H. -B./cmd/pcloudcc/build
 	make -C ./cmd/pcloudcc/build
 
 clean:
 	make -C lib/pclsync clean
-	rm -rf lib/mbedtls-1.3.10/build
+	rm -rf lib/mbedtls-2.1.14/build
 	rm -rf ./cmd/pcloudcc/build
 
 
diff --git a/lib/mbedtls-2.1.14/CMakeLists.txt b/lib/mbedtls-2.1.14/CMakeLists.txt
index f032ad4..16b87d2 100644
--- a/lib/mbedtls-2.1.14/CMakeLists.txt
+++ b/lib/mbedtls-2.1.14/CMakeLists.txt
@@ -58,20 +58,20 @@ if(CMAKE_COMPILER_IS_GNU)
     # note: starting with CMake 2.8 we could use CMAKE_C_COMPILER_VERSION
     execute_process(COMMAND ${CMAKE_C_COMPILER} -dumpversion
                     OUTPUT_VARIABLE GCC_VERSION)
-    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -W -Wdeclaration-after-statement -Wwrite-strings")
+    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wall -Wextra -W -Wdeclaration-after-statement -Wwrite-strings -fPIC")
     if (GCC_VERSION VERSION_GREATER 4.5 OR GCC_VERSION VERSION_EQUAL 4.5)
-        set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wlogical-op")
+        set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wlogical-op -fPIC")
     endif()
     if (GCC_VERSION VERSION_GREATER 4.8 OR GCC_VERSION VERSION_EQUAL 4.8)
-        set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wshadow")
+        set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -Wshadow -fPIC")
     endif()
-    set(CMAKE_C_FLAGS_RELEASE     "-O2")
-    set(CMAKE_C_FLAGS_DEBUG       "-O0 -g3")
-    set(CMAKE_C_FLAGS_COVERAGE    "-O0 -g3 --coverage")
-    set(CMAKE_C_FLAGS_ASAN        "-Werror -fsanitize=address -fno-common -O3")
-    set(CMAKE_C_FLAGS_ASANDBG     "-Werror -fsanitize=address -fno-common -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls ")
-    set(CMAKE_C_FLAGS_CHECK       "-Werror -Os")
-    set(CMAKE_C_FLAGS_CHECKFULL   "${CMAKE_C_FLAGS_CHECK} -Wcast-qual")
+    set(CMAKE_C_FLAGS_RELEASE     "-O2 -fPIC")
+    set(CMAKE_C_FLAGS_DEBUG       "-O0 -g3 -fPIC")
+    set(CMAKE_C_FLAGS_COVERAGE    "-O0 -g3 --coverage -fPIC")
+    set(CMAKE_C_FLAGS_ASAN        "-Werror -fsanitize=address -fno-common -O3 -fPIC")
+    set(CMAKE_C_FLAGS_ASANDBG     "-Werror -fsanitize=address -fno-common -O1 -g3 -fno-omit-frame-pointer -fno-optimize-sibling-calls -fPIC ")
+    set(CMAKE_C_FLAGS_CHECK       "-Werror -Os -fPIC")
+    set(CMAKE_C_FLAGS_CHECKFULL   "${CMAKE_C_FLAGS_CHECK} -Wcast-qual -fPIC")
 endif(CMAKE_COMPILER_IS_GNU)
 
 if(CMAKE_COMPILER_IS_CLANG)
diff --git a/lib/pclsync/Makefile b/lib/pclsync/Makefile
index f29c3d4..b14c69a 100644
--- a/lib/pclsync/Makefile
+++ b/lib/pclsync/Makefile
@@ -9,7 +9,7 @@ CFLAGS=-Werror -O2 -g -fno-stack-protector -fomit-frame-pointer -mtune=core2 -I.
 LIB_A=psynclib.a
 UNAME_S := $(shell uname -s)
 UNAME_V := $(shell uname -v)
-CFLAGS += -DP_OS_LINUX -D_FILE_OFFSET_BITS=64 -DP_SSL_MBEDTLS -I../mbedtls-1.3.10/include
+CFLAGS += -DP_OS_LINUX -D_FILE_OFFSET_BITS=64 -DP_SSL_MBEDTLS -I../mbedtls-2.1.14/include -fPIC
 LDFLAGS += -lssl -lcrypto -lfuse -lpthread -lsqlite3 -lzlib
 
 OBJ=pcompat.o psynclib.o plocks.o plibs.o pcallbacks.o pdiff.o pstatus.o papi.o ptimer.o\
diff --git a/lib/pclsync/pasyncnet.c b/lib/pclsync/pasyncnet.c
index 778d685..8d42c71 100644
--- a/lib/pclsync/pasyncnet.c
+++ b/lib/pclsync/pasyncnet.c
@@ -27,13 +27,16 @@
   EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/sha1.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "papi.h"
 #include "pasyncnet.h"
 #include "pcompat.h"
diff --git a/lib/pclsync/pcache.c b/lib/pclsync/pcache.c
index 30a9d76..09b8301 100644
--- a/lib/pclsync/pcache.c
+++ b/lib/pclsync/pcache.c
@@ -28,13 +28,15 @@
   DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcache.h"
 #include "pcompat.h"
 #include "plibs.h"
diff --git a/lib/pclsync/pcloudcrypto.c b/lib/pclsync/pcloudcrypto.c
index 764b2c6..702e069 100644
--- a/lib/pclsync/pcloudcrypto.c
+++ b/lib/pclsync/pcloudcrypto.c
@@ -29,13 +29,17 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/sha1.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "papi.h"
 #include "pcache.h"
 #include "pcloudcrypto.h"
diff --git a/lib/pclsync/pcompat.c b/lib/pclsync/pcompat.c
index 20e517b..f1aab86 100644
--- a/lib/pclsync/pcompat.c
+++ b/lib/pclsync/pcompat.c
@@ -28,11 +28,13 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
+
+#include "mbedtls/compat-1.3.h"
 
 #include "pcompat.h"
 #include "plibs.h"
diff --git a/lib/pclsync/pcrypto.c b/lib/pclsync/pcrypto.c
index 6e648ff..6e4654a 100644
--- a/lib/pclsync/pcrypto.c
+++ b/lib/pclsync/pcrypto.c
@@ -29,13 +29,15 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcompat.h"
 #include "pcompiler.h"
 
diff --git a/lib/pclsync/pdiff.c b/lib/pclsync/pdiff.c
index 8ae0911..bc8e044 100644
--- a/lib/pclsync/pdiff.c
+++ b/lib/pclsync/pdiff.c
@@ -30,14 +30,18 @@
 */
 
 #include <ctype.h>
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/sha1.h>
+#include <mbedtls/sha512.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 #include <stddef.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "paccountevents.h"
 #include "papi.h"
 #include "pbusinessaccount.h"
diff --git a/lib/pclsync/pdownload.c b/lib/pclsync/pdownload.c
index 4180cfc..95e985a 100644
--- a/lib/pclsync/pdownload.c
+++ b/lib/pclsync/pdownload.c
@@ -28,14 +28,18 @@
   DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/sha1.h>
+#include <mbedtls/sha512.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 #include <stddef.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "papi.h"
 #include "pasyncnet.h"
 #include "pcallbacks.h"
diff --git a/lib/pclsync/pfolder.c b/lib/pclsync/pfolder.c
index 06e4484..2c2c363 100644
--- a/lib/pclsync/pfolder.c
+++ b/lib/pclsync/pfolder.c
@@ -29,14 +29,16 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 #include <stddef.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "papi.h"
 #include "pcloudcrypto.h"
 #include "pdiff.h"
diff --git a/lib/pclsync/pfs.c b/lib/pclsync/pfs.c
index 791c027..89d9be1 100644
--- a/lib/pclsync/pfs.c
+++ b/lib/pclsync/pfs.c
@@ -31,13 +31,15 @@
 #define FUSE_USE_VERSION 26
 #define _FILE_OFFSET_BITS 64
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcloudcrypto.h"
 #include "pcompat.h"
 #include "pfolder.h"
diff --git a/lib/pclsync/pfscrypto.c b/lib/pclsync/pfscrypto.c
index cd32a53..3086b42 100644
--- a/lib/pclsync/pfscrypto.c
+++ b/lib/pclsync/pfscrypto.c
@@ -29,18 +29,20 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <ctype.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcloudcrypto.h"
 #include "pfscrypto.h"
 #include "plibs.h"
 #include "ppagecache.h"
-#include <ctype.h>
 
 // this is only for debug, adds needless checks of tree for local files
 #if IS_DEBUG
diff --git a/lib/pclsync/pfsfolder.c b/lib/pclsync/pfsfolder.c
index 6ed8a07..e104c37 100644
--- a/lib/pclsync/pfsfolder.c
+++ b/lib/pclsync/pfsfolder.c
@@ -29,13 +29,15 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcloudcrypto.h"
 #include "pfolder.h"
 #include "pfs.h"
diff --git a/lib/pclsync/pfstasks.c b/lib/pclsync/pfstasks.c
index 544c10f..d5237a4 100644
--- a/lib/pclsync/pfstasks.c
+++ b/lib/pclsync/pfstasks.c
@@ -29,13 +29,15 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcache.h"
 #include "pcloudcrypto.h"
 #include "pcompat.h"
diff --git a/lib/pclsync/pfsupload.c b/lib/pclsync/pfsupload.c
index 4712935..b5ad440 100644
--- a/lib/pclsync/pfsupload.c
+++ b/lib/pclsync/pfsupload.c
@@ -29,13 +29,15 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcache.h"
 #include "pdiff.h"
 #include "pfileops.h"
diff --git a/lib/pclsync/plocalscan.c b/lib/pclsync/plocalscan.c
index f470479..e0721f2 100644
--- a/lib/pclsync/plocalscan.c
+++ b/lib/pclsync/plocalscan.c
@@ -29,12 +29,17 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <ctype.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
+#include <string.h>
+
+#include "mbedtls/compat-1.3.h"
 
 #include "pcallbacks.h"
 #include "pfolder.h"
@@ -50,8 +55,6 @@
 #include "ptasks.h"
 #include "ptimer.h"
 #include "pupload.h"
-#include <ctype.h>
-#include <string.h>
 
 typedef struct {
   psync_list list;
diff --git a/lib/pclsync/pmemlock.c b/lib/pclsync/pmemlock.c
index 41db4e5..a775550 100644
--- a/lib/pclsync/pmemlock.c
+++ b/lib/pclsync/pmemlock.c
@@ -29,13 +29,15 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcloudcrypto.h"
 #include "pcompat.h"
 #include "pintervaltree.h"
diff --git a/lib/pclsync/pnetlibs.c b/lib/pclsync/pnetlibs.c
index 587f077..6725cde 100644
--- a/lib/pclsync/pnetlibs.c
+++ b/lib/pclsync/pnetlibs.c
@@ -29,12 +29,20 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <ctype.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/sha1.h>
+#include <mbedtls/sha512.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
+#include <semaphore.h>
+#include <stdarg.h>
+#include <stdio.h>
+
+#include "mbedtls/compat-1.3.h"
 
 #include "papi.h"
 #include "pcache.h"
@@ -45,10 +53,6 @@
 #include "pstatus.h"
 #include "ptimer.h"
 #include "ptree.h"
-#include <ctype.h>
-#include <semaphore.h>
-#include <stdarg.h>
-#include <stdio.h>
 
 struct time_bytes {
   time_t tm;
diff --git a/lib/pclsync/pp2p.c b/lib/pclsync/pp2p.c
index 7d7788c..4cbef87 100644
--- a/lib/pclsync/pp2p.c
+++ b/lib/pclsync/pp2p.c
@@ -29,13 +29,16 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/sha1.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "papi.h"
 #include "pcompat.h"
 #include "pcrypto.h"
diff --git a/lib/pclsync/ppagecache.c b/lib/pclsync/ppagecache.c
index 4c90fce..3484c7a 100644
--- a/lib/pclsync/ppagecache.c
+++ b/lib/pclsync/ppagecache.c
@@ -29,13 +29,15 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcache.h"
 #include "pcrc32c.h"
 #include "pfscrypto.h"
diff --git a/lib/pclsync/ppassword.c b/lib/pclsync/ppassword.c
index 2ff83d0..87c38b5 100644
--- a/lib/pclsync/ppassword.c
+++ b/lib/pclsync/ppassword.c
@@ -28,13 +28,16 @@
   DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/rsa.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "plibs.h"
 #include "ppassword.h"
 #include "ppassworddict.h"
diff --git a/lib/pclsync/ppathstatus.c b/lib/pclsync/ppathstatus.c
index 03d9cd9..34638f7 100644
--- a/lib/pclsync/ppathstatus.c
+++ b/lib/pclsync/ppathstatus.c
@@ -29,12 +29,15 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
+#include <string.h>
+
+#include "mbedtls/compat-1.3.h"
 
 #include "pcloudcrypto.h"
 #include "pfolder.h"
@@ -45,8 +48,6 @@
 #include "pstatus.h"
 #include "ptasks.h"
 #include "ptree.h"
-#include <ctype.h>
-#include <string.h>
 
 #define PATH_CACHE_SIZE 512
 #define PATH_HASH_SIZE 512
diff --git a/lib/pclsync/psettings.c b/lib/pclsync/psettings.c
index fc6a05f..093e072 100644
--- a/lib/pclsync/psettings.c
+++ b/lib/pclsync/psettings.c
@@ -29,13 +29,15 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pfs.h"
 #include "plibs.h"
 #include "plocalscan.h"
diff --git a/lib/pclsync/pssl.c b/lib/pclsync/pssl.c
index 0ef7052..526d5d5 100644
--- a/lib/pclsync/pssl.c
+++ b/lib/pclsync/pssl.c
@@ -30,14 +30,18 @@
 */
 
 #include <ctype.h>
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/net.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/sha256.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 #include <stddef.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcompat.h"
 #include "pcompiler.h"
 
@@ -132,6 +136,7 @@ typedef struct {
 
 typedef struct {
   ssl_context ssl;
+  mbedtls_ssl_config conf;
   psync_socket_t sock;
   int isbroken;
   char cachekey[];
@@ -209,9 +214,13 @@ int psync_ssl_init() {
   entropy_init(&psync_mbed_entropy);
   psync_get_random_seed(seed, seed, sizeof(seed), 0);
   entropy_update_manual(&psync_mbed_entropy, seed, sizeof(seed));
+  /*
   if (ctr_drbg_init(&psync_mbed_rng.rnd, entropy_func, &psync_mbed_entropy,
                     NULL, 0))
     return PRINT_RETURN(-1);
+  */
+  ctr_drbg_init(&psync_mbed_rng.rnd);
+
   x509_crt_init(&psync_mbed_trusted_certs_x509);
   for (i = 0; i < ARRAY_SIZE(psync_ssl_trusted_certs); i++)
     if (x509_crt_parse(&psync_mbed_trusted_certs_x509,
@@ -239,6 +248,12 @@ static ssl_connection_t *psync_ssl_alloc_conn(const char *hostname) {
   return conn;
 }
 
+static mbedtls_ssl_config *psync_ssl_alloc_config() {
+  mbedtls_ssl_config *cfg;
+  cfg = malloc(sizeof(mbedtls_ssl_config));
+  return cfg;
+}
+
 static void psync_set_ssl_error(ssl_connection_t *conn, int err) {
   if (err == POLARSSL_ERR_NET_WANT_READ)
     psync_ssl_errno = PSYNC_SSL_ERR_WANT_READ;
@@ -341,22 +356,23 @@ static int psync_ssl_check_peer_public_key(ssl_connection_t *conn) {
 int psync_ssl_connect(psync_socket_t sock, void **sslconn,
                       const char *hostname) {
   ssl_connection_t *conn;
+  mbedtls_ssl_config *cfg;
   ssl_session *sess;
   int ret;
   conn = psync_ssl_alloc_conn(hostname);
-  if (unlikely(ssl_init(&conn->ssl)))
-    goto err0;
+  cfg = psync_ssl_alloc_config();
+  ssl_init(&conn->ssl);
   conn->sock = sock;
-  ssl_set_endpoint(&conn->ssl, SSL_IS_CLIENT);
-  ssl_set_dbg(&conn->ssl, debug_cb, debug_ctx);
-  ssl_set_authmode(&conn->ssl, SSL_VERIFY_REQUIRED);
-  ssl_set_min_version(&conn->ssl, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3);
-  ssl_set_ca_chain(&conn->ssl, &psync_mbed_trusted_certs_x509, NULL, hostname);
-  ssl_set_ciphersuites(&conn->ssl, psync_mbed_ciphersuite);
-  ssl_set_rng(&conn->ssl, ctr_drbg_random_locked, &psync_mbed_rng);
-  ssl_set_bio(&conn->ssl, psync_mbed_read, conn, psync_mbed_write, conn);
-  ssl_set_hostname(&conn->ssl, hostname); // we do not need SNI, but should not
-                                          // hurt in general to support
+  ssl_set_endpoint(&conn->conf, SSL_IS_CLIENT);
+  ssl_set_dbg(&conn->conf, debug_cb, debug_ctx);
+  ssl_set_authmode(&conn->conf, SSL_VERIFY_REQUIRED);
+  ssl_set_min_version(&conn->conf, SSL_MAJOR_VERSION_3, SSL_MINOR_VERSION_3);
+  ssl_set_ca_chain(&conn->conf, &psync_mbed_trusted_certs_x509, NULL);
+  ssl_set_ciphersuites(&conn->conf, psync_mbed_ciphersuite);
+  ssl_set_rng(&conn->conf, ctr_drbg_random_locked, &psync_mbed_rng);
+
+  // XXX: may not be needed
+  // ssl_set_bio(&conn->ssl, psync_mbed_read, conn, psync_mbed_write, conn);
   if ((sess = (ssl_session *)psync_cache_get(conn->cachekey))) {
     debug(D_NOTICE, "reusing cached session for %s", hostname);
     if (ssl_set_session(&conn->ssl, sess))
@@ -631,7 +647,7 @@ psync_ssl_gen_symmetric_key_from_pass(const char *password, size_t keylen,
   key->keylen = keylen;
   pkcs5_pbkdf2_hmac(&ctx, (const unsigned char *)password, strlen(password),
                     salt, saltlen, iterations, keylen, key->key);
-  md_free_ctx(&ctx);
+  md_free(&ctx);
   return key;
 }
 
@@ -654,7 +670,7 @@ char *psync_ssl_derive_password_from_passphrase(const char *username,
   pkcs5_pbkdf2_hmac(&ctx, (const unsigned char *)passphrase, strlen(passphrase),
                     usersha512, PSYNC_SHA512_DIGEST_LEN, 5000,
                     sizeof(passwordbin), passwordbin);
-  md_free_ctx(&ctx);
+  md_free(&ctx);
   usercopy = psync_base64_encode(passwordbin, sizeof(passwordbin), &userlen);
   return (char *)usercopy;
 }
diff --git a/lib/pclsync/pssl.h b/lib/pclsync/pssl.h
index 6566321..e11da29 100644
--- a/lib/pclsync/pssl.h
+++ b/lib/pclsync/pssl.h
@@ -91,8 +91,8 @@ typedef struct {
 typedef aes_context *psync_aes256_encoder;
 typedef aes_context *psync_aes256_decoder;
 
-typedef void (*psync_ssl_debug_callback_t)(void *ctx, int level,
-                                           const char *message);
+typedef void (*psync_ssl_debug_callback_t)(void *, int, const char *, int,
+                                           const char *);
 void psync_ssl_set_log_threshold(int threshold);
 void psync_ssl_set_debug_callback(psync_ssl_debug_callback_t cb, void *ctx);
 
diff --git a/lib/pclsync/psyncer.c b/lib/pclsync/psyncer.c
index ca87259..dd335f9 100644
--- a/lib/pclsync/psyncer.c
+++ b/lib/pclsync/psyncer.c
@@ -29,13 +29,16 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 #include <stddef.h>
+#include <string.h>
+
+#include "mbedtls/compat-1.3.h"
 
 #include "pcallbacks.h"
 #include "pdownload.h"
@@ -48,7 +51,6 @@
 #include "psyncer.h"
 #include "ptasks.h"
 #include "ptree.h"
-#include <string.h>
 
 typedef struct {
   psync_tree tree;
diff --git a/lib/pclsync/psynclib.c b/lib/pclsync/psynclib.c
index 74d77b4..798ab98 100644
--- a/lib/pclsync/psynclib.c
+++ b/lib/pclsync/psynclib.c
@@ -30,14 +30,16 @@
 */
 
 #include <ctype.h>
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 #include <stddef.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "papi.h"
 #include "pasyncnet.h"
 #include "pbusinessaccount.h"
@@ -206,7 +208,9 @@ static void psync_stop_crypto_on_sleep() {
   }
 }
 
-static void ssl_debug_cb(void *ctx, int level, const char *msg) {
+// TODO: figure out what the new args are
+static void ssl_debug_cb(void *ctx, int level, const char *msg, int TODO1,
+                         const char *TODO2) {
   debug(D_NOTICE, "%s", msg);
 }
 
diff --git a/lib/pclsync/ptasks.c b/lib/pclsync/ptasks.c
index df90b01..e6f25a5 100644
--- a/lib/pclsync/ptasks.c
+++ b/lib/pclsync/ptasks.c
@@ -29,13 +29,15 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "pcallbacks.h"
 #include "pdownload.h"
 #include "plibs.h"
diff --git a/lib/pclsync/pupload.c b/lib/pclsync/pupload.c
index 36b81d2..73cdb6d 100644
--- a/lib/pclsync/pupload.c
+++ b/lib/pclsync/pupload.c
@@ -29,14 +29,16 @@
    DAMAGE.
 */
 
-#include <polarssl/ctr_drbg.h>
-#include <polarssl/debug.h>
-#include <polarssl/entropy.h>
-#include <polarssl/pkcs5.h>
-#include <polarssl/ssl.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/debug.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/pkcs5.h>
+#include <mbedtls/ssl.h>
 #include <pthread.h>
 #include <stddef.h>
 
+#include "mbedtls/compat-1.3.h"
+
 #include "papi.h"
 #include "pcallbacks.h"
 #include "pcompat.h"