diff --git a/3rdparty/mbedtls/wscript b/3rdparty/mbedtls/wscript
new file mode 100644
index 00000000..68f15ad2
--- /dev/null
+++ b/3rdparty/mbedtls/wscript
@@ -0,0 +1,65 @@
+#! /usr/bin/env python
+# encoding: utf-8
+
+def options(opt):
+	grp = opt.add_option_group('mbedTLS options')
+	grp.add_option('--disable-mbedtls', action='store_false', dest='MBEDTLS', default=True,
+		help='disable bundled mbedTLS and built-in HTTPS support [default: enabled]')
+
+def configure(conf):
+	conf.env.MBEDTLS = conf.options.MBEDTLS
+	if not conf.env.MBEDTLS:
+		return
+
+	if not conf.path.find_dir('mbedtls') or not conf.path.find_dir('mbedtls/library'):
+		conf.fatal('Can\'t find mbedtls submodule. Run `git submodule update --init --recursive`.')
+
+	if not conf.path.find_dir('mbedtls/tf-psa-crypto/core'):
+		conf.fatal('mbedTLS nested submodule tf-psa-crypto is missing. Run `git submodule update --init --recursive`.')
+
+def build(bld):
+	if not bld.env.MBEDTLS:
+		return
+
+	sources = bld.path.ant_glob([
+		'mbedtls/library/*.c',
+		'mbedtls/tf-psa-crypto/core/*.c',
+		'mbedtls/tf-psa-crypto/extras/*.c',
+		'mbedtls/tf-psa-crypto/platform/*.c',
+		'mbedtls/tf-psa-crypto/utilities/*.c',
+		'mbedtls/tf-psa-crypto/drivers/builtin/src/*.c',
+	])
+
+	defines = [
+		'MBEDTLS_USER_CONFIG_FILE="xash_mbedtls_config.h"',
+		'TF_PSA_CRYPTO_USER_CONFIG_FILE="xash_psa_config.h"',
+	]
+
+	includes = [
+		'.',
+		'mbedtls/include',
+		'mbedtls/library',
+		'mbedtls/tf-psa-crypto/include',
+		'mbedtls/tf-psa-crypto/drivers/builtin/include',
+		'mbedtls/tf-psa-crypto/core',
+		'mbedtls/tf-psa-crypto/drivers/builtin/src',
+		'mbedtls/tf-psa-crypto/utilities',
+		'mbedtls/tf-psa-crypto/extras',
+		'mbedtls/tf-psa-crypto/platform',
+		'mbedtls/tf-psa-crypto/dispatch',
+	]
+
+	bld.stlib(
+		source = sources,
+		target = 'mbedtls',
+		features = 'c',
+		includes = includes,
+		defines = defines,
+		export_defines = ['XASH_MBEDTLS'],
+		export_includes = [
+			'.',
+			'mbedtls/include',
+			'mbedtls/tf-psa-crypto/include',
+			'mbedtls/tf-psa-crypto/drivers/builtin/include',
+		]
+	)
diff --git a/3rdparty/mbedtls/xash_mbedtls_config.h b/3rdparty/mbedtls/xash_mbedtls_config.h
new file mode 100644
index 00000000..144084a6
--- /dev/null
+++ b/3rdparty/mbedtls/xash_mbedtls_config.h
@@ -0,0 +1,36 @@
+#ifndef XASH_MBEDTLS_CONFIG_H
+#define XASH_MBEDTLS_CONFIG_H
+
+#undef MBEDTLS_NET_C
+#undef MBEDTLS_PKCS7_C
+#undef MBEDTLS_TIMING_C
+#undef MBEDTLS_SSL_SRV_C
+#undef MBEDTLS_SSL_PROTO_DTLS
+#undef MBEDTLS_SSL_DTLS_ANTI_REPLAY
+#undef MBEDTLS_SSL_DTLS_CONNECTION_ID
+#undef MBEDTLS_SSL_DTLS_HELLO_VERIFY
+#undef MBEDTLS_SSL_DTLS_SRTP
+#undef MBEDTLS_SSL_DTLS_CLIENT_PORT_REUSE
+#undef MBEDTLS_SSL_COOKIE_C
+#undef MBEDTLS_SSL_CACHE_C
+#undef MBEDTLS_SSL_TICKET_C
+#undef MBEDTLS_SSL_SESSION_TICKETS
+#undef MBEDTLS_SSL_RENEGOTIATION
+#undef MBEDTLS_SSL_CONTEXT_SERIALIZATION
+#undef MBEDTLS_SSL_KEYING_MATERIAL_EXPORT
+#undef MBEDTLS_SSL_MAX_FRAGMENT_LENGTH
+#undef MBEDTLS_SSL_ALL_ALERT_MESSAGES
+#undef MBEDTLS_SSL_ALPN
+#undef MBEDTLS_SSL_ENCRYPT_THEN_MAC
+#undef MBEDTLS_KEY_EXCHANGE_PSK_ENABLED
+#undef MBEDTLS_KEY_EXCHANGE_ECDHE_PSK_ENABLED
+#undef MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_ENABLED
+#undef MBEDTLS_SSL_TLS1_3_KEY_EXCHANGE_MODE_PSK_EPHEMERAL_ENABLED
+#undef MBEDTLS_X509_CREATE_C
+#undef MBEDTLS_X509_CRT_WRITE_C
+#undef MBEDTLS_X509_CSR_PARSE_C
+#undef MBEDTLS_X509_CSR_WRITE_C
+#undef MBEDTLS_X509_CRL_PARSE_C
+#undef MBEDTLS_VERSION_FEATURES
+
+#endif /* XASH_MBEDTLS_CONFIG_H */
diff --git a/3rdparty/mbedtls/xash_psa_config.h b/3rdparty/mbedtls/xash_psa_config.h
new file mode 100644
index 00000000..7bd8d0fe
--- /dev/null
+++ b/3rdparty/mbedtls/xash_psa_config.h
@@ -0,0 +1,70 @@
+#ifndef XASH_PSA_CONFIG_H
+#define XASH_PSA_CONFIG_H
+
+#undef MBEDTLS_FS_IO
+#undef MBEDTLS_PSA_ITS_FILE_C
+#undef MBEDTLS_PSA_CRYPTO_STORAGE_C
+#undef MBEDTLS_SELF_TEST
+#undef MBEDTLS_HMAC_DRBG_C
+#undef MBEDTLS_LMS_C
+#undef MBEDTLS_NIST_KW_C
+#undef MBEDTLS_PKCS5_C
+
+#undef PSA_WANT_ALG_CCM
+#undef PSA_WANT_ALG_CCM_STAR_NO_TAG
+#undef PSA_WANT_ALG_CBC_NO_PADDING
+#undef PSA_WANT_ALG_CBC_PKCS7
+#undef PSA_WANT_ALG_CFB
+#undef PSA_WANT_ALG_CMAC
+#undef PSA_WANT_ALG_CTR
+#undef PSA_WANT_ALG_ECB_NO_PADDING
+#undef PSA_WANT_ALG_OFB
+#undef PSA_WANT_ALG_STREAM_CIPHER
+#undef PSA_WANT_ALG_JPAKE
+#undef PSA_WANT_ALG_TLS12_ECJPAKE_TO_PMS
+#undef PSA_WANT_ALG_TLS12_PSK_TO_MS
+#undef PSA_WANT_ALG_FFDH
+#undef PSA_WANT_ALG_PBKDF2_HMAC
+#undef PSA_WANT_ALG_PBKDF2_AES_CMAC_PRF_128
+#undef PSA_WANT_KEY_TYPE_PASSWORD
+#undef PSA_WANT_KEY_TYPE_PASSWORD_HASH
+#undef PSA_WANT_ALG_SHA3_224
+#undef PSA_WANT_ALG_SHA3_256
+#undef PSA_WANT_ALG_SHA3_384
+#undef PSA_WANT_ALG_SHA3_512
+#undef PSA_WANT_ALG_SHAKE128
+#undef PSA_WANT_ALG_SHAKE256
+#undef PSA_WANT_ALG_SHA_224
+#undef PSA_WANT_ALG_SHA_1
+#undef PSA_WANT_ALG_MD5
+#undef PSA_WANT_ALG_RIPEMD160
+#undef PSA_WANT_KEY_TYPE_ARIA
+#undef PSA_WANT_KEY_TYPE_CAMELLIA
+#undef PSA_WANT_ECC_BRAINPOOL_P_R1_256
+#undef PSA_WANT_ECC_BRAINPOOL_P_R1_384
+#undef PSA_WANT_ECC_BRAINPOOL_P_R1_512
+#undef PSA_WANT_ECC_SECP_K1_256
+#undef PSA_WANT_ECC_MONTGOMERY_448
+#undef PSA_WANT_ECC_SECP_R1_521
+#undef PSA_WANT_DH_RFC7919_2048
+#undef PSA_WANT_DH_RFC7919_3072
+#undef PSA_WANT_DH_RFC7919_4096
+#undef PSA_WANT_DH_RFC7919_6144
+#undef PSA_WANT_DH_RFC7919_8192
+#undef PSA_WANT_KEY_TYPE_DH_KEY_PAIR_BASIC
+#undef PSA_WANT_KEY_TYPE_DH_KEY_PAIR_EXPORT
+#undef PSA_WANT_KEY_TYPE_DH_KEY_PAIR_GENERATE
+#undef PSA_WANT_KEY_TYPE_DH_KEY_PAIR_IMPORT
+#undef PSA_WANT_KEY_TYPE_DH_PUBLIC_KEY
+#undef PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_EXPORT
+#undef PSA_WANT_KEY_TYPE_ECC_KEY_PAIR_IMPORT
+#undef PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_EXPORT
+#undef PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_GENERATE
+#undef PSA_WANT_KEY_TYPE_RSA_KEY_PAIR_IMPORT
+#undef MBEDTLS_PEM_WRITE_C
+#undef MBEDTLS_PK_WRITE_C
+#undef MBEDTLS_PK_PARSE_EC_COMPRESSED
+#undef MBEDTLS_PK_PARSE_EC_EXTENDED
+#undef MBEDTLS_ASN1_WRITE_C
+
+#endif /* XASH_PSA_CONFIG_H */
diff --git a/wscript b/wscript
index 8800fc9c..2d3afa04 100644
--- a/wscript
+++ b/wscript
@@ -96,6 +96,7 @@ SUBDIRS = [
 	Subproject('ref/soft',              lambda x: x.env.CLIENT and x.env.SOFT),
 	Subproject('ref/null',              lambda x: x.env.CLIENT and x.env.NULL),
 	Subproject('3rdparty/bzip2',        lambda x: x.env.CLIENT and not x.env.HAVE_SYSTEM_BZ2),
+	Subproject('3rdparty/mbedtls'),
 	Subproject('3rdparty/opus',         lambda x: x.env.CLIENT and not x.env.HAVE_SYSTEM_OPUS),
 	Subproject('3rdparty/libogg',       lambda x: x.env.CLIENT and not x.env.HAVE_SYSTEM_OGG),
 	Subproject('3rdparty/vorbis',       lambda x: x.env.CLIENT and (not x.env.HAVE_SYSTEM_VORBIS or not x.env.HAVE_SYSTEM_VORBISFILE)),