diff --git a/Makefile b/Makefile
index 74dd2ce..9e20c43 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,9 @@
-MODULE		= nginx_acme
-# build/build-%.mk: debug, debug-static, release, release-static, sanitize
+# NGINX module name (should match the exported symbol name).
+MODULE_NAME	= ngx_http_acme_module
+# Target name used by cargo build.
+TARGET_NAME	= nginx_acme
+
+# build/build-%.mk: debug, debug-static, release, release-static, sanitize, ...
 BUILD		?= debug
 TESTS		?= t/
 NGX_CARGO	?= cargo
@@ -20,6 +24,12 @@ NGINX_BUILD_DIR		?= $(CURDIR)/objs-$(BUILD)
 TEST_NGINX_BINARY	= $(NGINX_BUILD_DIR)/nginx
 TEST_NGINX_GLOBALS	+= env RUST_BACKTRACE;
 
+# Shared library generated with --add-dynamic-module=.
+NGINX_BUILT_MODULE	= $(NGINX_BUILD_DIR)/$(MODULE_NAME).so
+# Shared libraries generated by cargo build.
+CARGO_DEBUG_MODULE	= target/debug/lib$(TARGET_NAME)$(SHLIB_EXT)
+CARGO_RELEASE_MODULE	= target/release/lib$(TARGET_NAME)$(SHLIB_EXT)
+
 # "build" always calls cargo and causes relinking.
 # Clearing this var allows to skip the build step: "make test TEST_PREREQ="
 TEST_PREREQ = build
@@ -64,8 +74,7 @@ help:
 	@echo "Pass NGINX_SOURCE_DIR to specify path to your NGINX source checkout."
 
 # Always rebuild targets managed by external build tool
-.PHONY: target/debug/lib$(MODULE)$(NGX_MODEXT) \
-	target/release/lib$(MODULE)$(NGX_MODEXT) \
+.PHONY: $(CARGO_DEBUG_MODULE) $(CARGO_RELEASE_MODULE) $(NGINX_BUILT_MODULE) \
 	$(TEST_NGINX_BINARY)
 
 $(NGINX_BUILD_DIR)/Makefile: config config.make auto/rust
@@ -81,12 +90,16 @@ $(NGINX_BUILD_DIR)/Makefile: $(NGINX_SOURCE_DIR)/src/core/nginx.h
 
 $(TEST_NGINX_BINARY): $(NGINX_BUILD_DIR)/Makefile
 	cd $(NGINX_SOURCE_DIR) \
-		&& $(BUILD_ENV) $(MAKE) -f $(NGINX_BUILD_DIR)/Makefile
+		&& $(BUILD_ENV) $(MAKE) -f $(NGINX_BUILD_DIR)/Makefile binary
+
+$(NGINX_BUILT_MODULE): $(NGINX_BUILD_DIR)/Makefile
+	cd $(NGINX_SOURCE_DIR) \
+		&& $(BUILD_ENV) $(MAKE) -f $(NGINX_BUILD_DIR)/Makefile modules
 
-target/debug/lib$(MODULE)$(NGX_MODEXT): $(NGINX_BUILD_DIR)/Makefile
+$(CARGO_DEBUG_MODULE): $(NGINX_BUILD_DIR)/Makefile
 	$(BUILD_ENV) $(NGX_CARGO) build
 
-target/release/lib$(MODULE)$(NGX_MODEXT): $(NGINX_BUILD_DIR)/Makefile
+$(CARGO_RELEASE_MODULE): $(NGINX_BUILD_DIR)/Makefile
 	$(BUILD_ENV) $(NGX_CARGO) build --release
 
 build: $(TEST_NGINX_BINARY) ## Build the module
diff --git a/build/build-aws-lc.mk b/build/build-aws-lc.mk
index 3d52e1e..9a9b02d 100644
--- a/build/build-aws-lc.mk
+++ b/build/build-aws-lc.mk
@@ -5,7 +5,7 @@
 #
 # * we use libssl objects created by nginx, and thus have to link to the same
 #   library
-# 
+#
 # * linking static libssl.a to the nginx binary alone results in missing
 #   symbols during module load
 #
@@ -24,6 +24,7 @@ BUILD_ENV		+= OPENSSL_LIB_DIR="$(LIBSSL_DESTDIR)/lib"
 BUILD_ENV		+= OPENSSL_STATIC=0
 
 TEST_ENV		+= LD_LIBRARY_PATH="$(LIBSSL_DESTDIR)/lib"
+TEST_NGINX_GLOBALS	+= load_module $(NGINX_BUILT_MODULE);
 
 NGINX_CONFIGURE		= \
 	$(NGINX_CONFIGURE_BASE) \
@@ -33,13 +34,7 @@ NGINX_CONFIGURE		= \
 		--add-dynamic-module="$(CURDIR)"
 
 
-NGX_MODULE		= $(NGINX_BUILD_DIR)/ngx_http_acme_module.so
-TEST_NGINX_GLOBALS	+= load_module $(NGX_MODULE);
-
-.PHONY: $(NGX_MODULE)
-
-build: $(NGX_MODULE)
-
+build: $(NGINX_BUILT_MODULE)
 
 $(LIBSSL_BUILDDIR)/CMakeCache.txt: $(LIBSSL_SRCDIR)/CMakeLists.txt
 	cmake -S $(LIBSSL_SRCDIR) \
@@ -50,8 +45,8 @@ $(LIBSSL_BUILDDIR)/CMakeCache.txt: $(LIBSSL_SRCDIR)/CMakeLists.txt
 		-DCMAKE_INSTALL_LIBDIR:STRING=lib \
 		-DCMAKE_INSTALL_PREFIX:STRING=$(LIBSSL_DESTDIR)
 
-$(LIBSSL_DESTDIR)/lib/libssl.so: $(LIBSSL_BUILDDIR)/CMakeCache.txt
+$(LIBSSL_DESTDIR)/lib/libssl$(SHLIB_EXT): $(LIBSSL_BUILDDIR)/CMakeCache.txt
 	cmake --build $(LIBSSL_BUILDDIR)
 	cmake --install $(LIBSSL_BUILDDIR)
 
-$(NGINX_BUILD_DIR)/Makefile: $(LIBSSL_DESTDIR)/lib/libssl.so
+$(NGINX_BUILD_DIR)/Makefile: $(LIBSSL_DESTDIR)/lib/libssl$(SHLIB_EXT)
diff --git a/build/build-boringssl-static.mk b/build/build-boringssl-static.mk
new file mode 100644
index 0000000..ebd46eb
--- /dev/null
+++ b/build/build-boringssl-static.mk
@@ -0,0 +1,31 @@
+#
+# Build static module with BoringSSL
+#
+
+LIBSSL_SRCDIR		= $(BORINGSSL_SOURCE_DIR)
+LIBSSL_BUILDDIR		= $(NGINX_BUILD_DIR)/lib/boringssl
+
+# pass SSL library location to openssl-sys
+
+BUILD_ENV		+= OPENSSL_INCLUDE_DIR="$(LIBSSL_SRCDIR)/include"
+BUILD_ENV		+= OPENSSL_LIB_DIR="$(LIBSSL_BUILDDIR)"
+BUILD_ENV		+= OPENSSL_STATIC=1
+
+NGINX_CONFIGURE		= \
+	$(NGINX_CONFIGURE_BASE) \
+		--with-cc-opt="-I$(LIBSSL_SRCDIR)/include" \
+		--with-ld-opt="-L$(LIBSSL_BUILDDIR) -lstdc++" \
+		--with-debug \
+		--add-module="$(CURDIR)"
+
+
+$(LIBSSL_BUILDDIR)/CMakeCache.txt: $(LIBSSL_SRCDIR)/CMakeLists.txt
+	cmake -S $(LIBSSL_SRCDIR) \
+		-B $(LIBSSL_BUILDDIR) \
+		-DBUILD_TESTING:BOOL=OFF \
+		-DCMAKE_BUILD_TYPE=RelWithDebInfo
+
+$(LIBSSL_BUILDDIR)/libssl.a: $(LIBSSL_BUILDDIR)/CMakeCache.txt
+	cmake --build $(LIBSSL_BUILDDIR)
+
+$(NGINX_BUILD_DIR)/Makefile: $(LIBSSL_BUILDDIR)/libssl.a
diff --git a/build/build-boringssl.mk b/build/build-boringssl.mk
new file mode 100644
index 0000000..1325491
--- /dev/null
+++ b/build/build-boringssl.mk
@@ -0,0 +1,48 @@
+#
+# Build dynamic module with BoringSSL
+#
+# This build flavor requires shared BoringSSL, because:
+#
+# * we use libssl objects created by nginx, and thus have to link to the same
+#   library
+#
+# * linking static libssl.a to the nginx binary alone results in missing
+#   symbols during module load
+#
+# * linking static libssl.a to both the binary and the module results in two
+#   different sets of static globals
+#
+
+LIBSSL_SRCDIR		= $(BORINGSSL_SOURCE_DIR)
+LIBSSL_BUILDDIR		= $(NGINX_BUILD_DIR)/lib/boringssl
+
+# pass SSL library location to openssl-sys
+
+BUILD_ENV		+= OPENSSL_INCLUDE_DIR="$(LIBSSL_SRCDIR)/include"
+BUILD_ENV		+= OPENSSL_LIB_DIR="$(LIBSSL_BUILDDIR)"
+BUILD_ENV		+= OPENSSL_STATIC=0
+
+TEST_ENV		+= LD_LIBRARY_PATH="$(LIBSSL_BUILDDIR)"
+TEST_NGINX_GLOBALS	+= load_module $(NGINX_BUILT_MODULE);
+
+NGINX_CONFIGURE		= \
+	$(NGINX_CONFIGURE_BASE) \
+		--with-cc-opt="-I$(LIBSSL_SRCDIR)/include" \
+		--with-ld-opt="-L$(LIBSSL_BUILDDIR) -lstdc++" \
+		--with-debug \
+		--add-dynamic-module="$(CURDIR)"
+
+
+build: $(NGINX_BUILT_MODULE)
+
+$(LIBSSL_BUILDDIR)/CMakeCache.txt: $(LIBSSL_SRCDIR)/CMakeLists.txt
+	cmake -S $(LIBSSL_SRCDIR) \
+		-B $(LIBSSL_BUILDDIR) \
+		-DBUILD_SHARED_LIBS:BOOL=ON \
+		-DBUILD_TESTING:BOOL=OFF \
+		-DCMAKE_BUILD_TYPE=RelWithDebInfo
+
+$(LIBSSL_BUILDDIR)/libssl$(SHLIB_EXT): $(LIBSSL_BUILDDIR)/CMakeCache.txt
+	cmake --build $(LIBSSL_BUILDDIR)
+
+$(NGINX_BUILD_DIR)/Makefile: $(LIBSSL_BUILDDIR)/libssl$(SHLIB_EXT)
diff --git a/build/build-debug.mk b/build/build-debug.mk
index 2cd5f77..1e63406 100644
--- a/build/build-debug.mk
+++ b/build/build-debug.mk
@@ -1,12 +1,8 @@
-NGX_MODULE		= target/debug/lib$(MODULE)$(NGX_MODEXT)
-TEST_NGINX_GLOBALS	+= load_module $(CURDIR)/$(NGX_MODULE);
+TEST_NGINX_GLOBALS	+= load_module $(CURDIR)/$(CARGO_DEBUG_MODULE);
 
 NGINX_CONFIGURE		= \
 	$(NGINX_CONFIGURE_BASE) \
 		--with-debug \
 		--add-dynamic-module="$(CURDIR)"
 
-# always rebuild targets managed by external build tool
-.PHONY: $(NGX_MODULE)
-
-build: $(NGX_MODULE)
+build: $(CARGO_DEBUG_MODULE) $(NGINX_BUILT_MODULE)
diff --git a/build/build-release.mk b/build/build-release.mk
index d83a699..b696d12 100644
--- a/build/build-release.mk
+++ b/build/build-release.mk
@@ -1,11 +1,7 @@
-NGX_MODULE		= target/release/lib$(MODULE)$(NGX_MODEXT)
-TEST_NGINX_GLOBALS	+= load_module $(CURDIR)/$(NGX_MODULE);
+TEST_NGINX_GLOBALS	+= load_module $(CURDIR)/$(CARGO_RELEASE_MODULE);
 
 NGINX_CONFIGURE		= \
 	$(NGINX_CONFIGURE_BASE) \
 		--add-dynamic-module="$(CURDIR)"
 
-# always rebuild targets managed by external build tool
-.PHONY: $(NGX_MODULE)
-
-build: $(NGX_MODULE)
+build: $(CARGO_RELEASE_MODULE) $(NGINX_BUILT_MODULE)
diff --git a/build/compat-gnu.mk b/build/compat-gnu.mk
index bdf27ab..c994afa 100644
--- a/build/compat-gnu.mk
+++ b/build/compat-gnu.mk
@@ -3,9 +3,9 @@ TEST_JOBS	:= $(shell nproc 2>/dev/null || getconf NPROCESSORS_ONLN 2>/dev/null |
 
 # extension for Rust cdylib targets
 ifeq ($(shell uname), Darwin)
-NGX_MODEXT	= .dylib
+SHLIB_EXT	= .dylib
 else
-NGX_MODEXT	= .so
+SHLIB_EXT	= .so
 endif
 
 # resolve paths
diff --git a/build/compat-posix.mk b/build/compat-posix.mk
index 4fec031..f4639f1 100644
--- a/build/compat-posix.mk
+++ b/build/compat-posix.mk
@@ -4,7 +4,7 @@ TEST_JOBS	!= nproc 2>/dev/null || getconf NPROCESSORS_ONLN 2>/dev/null || echo 1
 # bsd make compatibility
 CURDIR		?= $(.CURDIR)
 # extension for Rust cdylib targets
-NGX_MODEXT	!= if [ `uname` = Darwin ]; then echo ".dylib"; else echo ".so"; fi
+SHLIB_EXT	!= if [ `uname` = Darwin ]; then echo ".dylib"; else echo ".so"; fi
 
 # resolve paths