wolfssl: refer to it as wolfSSL only

Remove support for, references to and use of "cyaSSL" from the source
and docs. wolfSSL is the current name and there's no point in keeping
references to ancient history.

Assisted-by: Daniel Gustafsson

Closes #3903

17 files changed, 182 insertions, 221 deletions

diff --git a/configure.ac b/configure.ac
index 4cd2cb81f..1a2e237d4 100755
--- a/configure.ac
+++ b/configure.ac
@@ -155,7 +155,7 @@ AC_SUBST(PKGADD_VENDOR)
 
 dnl
 dnl initialize all the info variables
-    curl_ssl_msg="no      (--with-{ssl,gnutls,nss,mbedtls,cyassl,schannel,secure-transport,mesalink,amissl} )"
+    curl_ssl_msg="no      (--with-{ssl,gnutls,nss,mbedtls,wolfssl,schannel,secure-transport,mesalink,amissl} )"
     curl_ssh_msg="no      (--with-libssh2)"
    curl_zlib_msg="no      (--with-zlib)"
  curl_brotli_msg="no      (--with-brotli)"
@@ -2211,48 +2211,48 @@ if test -z "$ssl_backends" -o "x$OPT_MBEDTLS" != xno; then
 fi
 
 dnl ----------------------------------------------------
-dnl check for CyaSSL
+dnl check for wolfSSL
 dnl ----------------------------------------------------
 
-dnl Default to compiler & linker defaults for CyaSSL files & libraries.
-OPT_CYASSL=no
+dnl Default to compiler & linker defaults for wolfSSL files & libraries.
+OPT_WOLFSSL=no
 
 _cppflags=$CPPFLAGS
 _ldflags=$LDFLAGS
 AC_ARG_WITH(cyassl,dnl
 AC_HELP_STRING([--with-cyassl=PATH],[where to look for CyaSSL, PATH points to the installation root (default: system lib default)])
 AC_HELP_STRING([--without-cyassl], [disable CyaSSL detection]),
-  OPT_CYASSL=$withval)
+  OPT_WOLFSSL=$withval)
 
 dnl provide --with-wolfssl as an alias for --with-cyassl
 AC_ARG_WITH(wolfssl,dnl
 AC_HELP_STRING([--with-wolfssl=PATH],[where to look for WolfSSL, PATH points to the installation root (default: system lib default)])
 AC_HELP_STRING([--without-wolfssl], [disable WolfSSL detection]),
-  OPT_CYASSL=$withval)
+  OPT_WOLFSSL=$withval)
 
-if test -z "$ssl_backends" -o "x$OPT_CYASSL" != xno; then
+if test -z "$ssl_backends" -o "x$OPT_WOLFSSL" != xno; then
   ssl_msg=
 
-  if test X"$OPT_CYASSL" != Xno; then
+  if test X"$OPT_WOLFSSL" != Xno; then
 
-    if test "$OPT_CYASSL" = "yes"; then
-      OPT_CYASSL=""
+    if test "$OPT_WOLFSSL" = "yes"; then
+      OPT_WOLFSSL=""
     fi
 
     dnl This should be reworked to use pkg-config instead
 
     cyassllibname=cyassl
 
-    if test -z "$OPT_CYASSL" ; then
+    if test -z "$OPT_WOLFSSL" ; then
       dnl check for lib in system default first
 
       AC_CHECK_LIB(cyassl, CyaSSL_Init,
       dnl libcyassl found, set the variable
        [
-         AC_DEFINE(USE_CYASSL, 1, [if CyaSSL is enabled])
-         AC_SUBST(USE_CYASSL, [1])
-         CYASSL_ENABLED=1
-         USE_CYASSL="yes"
+         AC_DEFINE(USE_WOLFSSL, 1, [if wolfSSL is enabled])
+         AC_SUBST(USE_WOLFSSL, [1])
+         WOLFSSL_ENABLED=1
+         USE_WOLFSSL="yes"
          ssl_msg="CyaSSL"
 	 test cyassl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
         ])
@@ -2263,11 +2263,11 @@ if test -z "$ssl_backends" -o "x$OPT_CYASSL" != xno; then
     addcflags=""
     cyassllib=""
 
-    if test "x$USE_CYASSL" != "xyes"; then
+    if test "x$USE_WOLFSSL" != "xyes"; then
       dnl add the path and test again
-      addld=-L$OPT_CYASSL/lib$libsuff
-      addcflags=-I$OPT_CYASSL/include
-      cyassllib=$OPT_CYASSL/lib$libsuff
+      addld=-L$OPT_WOLFSSL/lib$libsuff
+      addcflags=-I$OPT_WOLFSSL/include
+      cyassllib=$OPT_WOLFSSL/lib$libsuff
 
       LDFLAGS="$LDFLAGS $addld"
       if test "$addcflags" != "-I/usr/include"; then
@@ -2276,10 +2276,10 @@ if test -z "$ssl_backends" -o "x$OPT_CYASSL" != xno; then
 
       AC_CHECK_LIB(cyassl, CyaSSL_Init,
        [
-       AC_DEFINE(USE_CYASSL, 1, [if CyaSSL is enabled])
-       AC_SUBST(USE_CYASSL, [1])
-       CYASSL_ENABLED=1
-       USE_CYASSL="yes"
+       AC_DEFINE(USE_WOLFSSL, 1, [if CyaSSL is enabled])
+       AC_SUBST(USE_WOLFSSL, [1])
+       WOLFSSL_ENABLED=1
+       USE_WOLFSSL="yes"
        ssl_msg="CyaSSL"
        test cyassl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
        ],
@@ -2294,11 +2294,11 @@ if test -z "$ssl_backends" -o "x$OPT_CYASSL" != xno; then
     addlib=""
     addcflags=""
 
-    if test "x$USE_CYASSL" != "xyes"; then
+    if test "x$USE_WOLFSSL" != "xyes"; then
       dnl libcyassl renamed to libwolfssl as of 3.4.0
-      addld=-L$OPT_CYASSL/lib$libsuff
-      addcflags=-I$OPT_CYASSL/include
-      cyassllib=$OPT_CYASSL/lib$libsuff
+      addld=-L$OPT_WOLFSSL/lib$libsuff
+      addcflags=-I$OPT_WOLFSSL/include
+      cyassllib=$OPT_WOLFSSL/lib$libsuff
 
       LDFLAGS="$LDFLAGS $addld"
       if test "$addcflags" != "-I/usr/include"; then
@@ -2322,10 +2322,10 @@ if test -z "$ssl_backends" -o "x$OPT_CYASSL" != xno; then
 	]])
       ],[
          AC_MSG_RESULT(yes)
-         AC_DEFINE(USE_CYASSL, 1, [if CyaSSL/WolfSSL is enabled])
-         AC_SUBST(USE_CYASSL, [1])
-         CYASSL_ENABLED=1
-         USE_CYASSL="yes"
+         AC_DEFINE(USE_WOLFSSL, 1, [if wolfSSL is enabled])
+         AC_SUBST(USE_WOLFSSL, [1])
+         WOLFSSL_ENABLED=1
+         USE_WOLFSSL="yes"
          ssl_msg="WolfSSL"
 	 test cyassl != "$DEFAULT_SSL_BACKEND" || VALID_DEFAULT_SSL_BACKEND=yes
        ],
@@ -2338,32 +2338,20 @@ if test -z "$ssl_backends" -o "x$OPT_CYASSL" != xno; then
       LIBS="$my_ac_save_LIBS"
     fi
 
-    if test "x$USE_CYASSL" = "xyes"; then
+    if test "x$USE_WOLFSSL" = "xyes"; then
       AC_MSG_NOTICE([detected $cyassllibname])
       check_for_ca_bundle=1
 
       dnl cyassl/ctaocrypt/types.h needs SIZEOF_LONG_LONG defined!
       AX_COMPILE_CHECK_SIZEOF(long long)
 
-      dnl Versions since at least 2.6.0 may have options.h
-      AC_CHECK_HEADERS(cyassl/options.h)
-
-      dnl Versions since at least 2.9.4 renamed error.h to error-ssl.h
-      AC_CHECK_HEADERS(cyassl/error-ssl.h)
-
       LIBS="-l$cyassllibname -lm $LIBS"
 
-      if test "x$cyassllibname" = "xwolfssl"; then
-        dnl Recent WolfSSL versions build without SSLv3 by default
-        dnl WolfSSL needs configure --enable-opensslextra to have *get_peer*
-        AC_CHECK_FUNCS(wolfSSLv3_client_method \
-                       wolfSSL_get_peer_certificate \
-                       wolfSSL_UseALPN)
-      else
-        dnl Cyassl needs configure --enable-opensslextra to have *get_peer*
-        AC_CHECK_FUNCS(CyaSSL_CTX_UseSupportedCurve \
-                       CyaSSL_get_peer_certificate)
-      fi
+      dnl Recent WolfSSL versions build without SSLv3 by default
+      dnl WolfSSL needs configure --enable-opensslextra to have *get_peer*
+      AC_CHECK_FUNCS(wolfSSLv3_client_method \
+                     wolfSSL_get_peer_certificate \
+                     wolfSSL_UseALPN)
 
       if test -n "$cyassllib"; then
         dnl when shared libs were found in a path that the run-time
@@ -2379,7 +2367,7 @@ if test -z "$ssl_backends" -o "x$OPT_CYASSL" != xno; then
 
     fi
 
-  fi dnl CyaSSL not disabled
+  fi dnl wolfSSL not disabled
 
   test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
 fi
@@ -2606,10 +2594,10 @@ if test -z "$ssl_backends" -o "x$OPT_NSS" != xno; then
   test -z "$ssl_msg" || ssl_backends="${ssl_backends:+$ssl_backends, }$ssl_msg"
 fi
 
-case "x$OPENSSL_ENABLED$GNUTLS_ENABLED$NSS_ENABLED$MBEDTLS_ENABLED$CYASSL_ENABLED$WINSSL_ENABLED$SECURETRANSPORT_ENABLED$MESALINK_ENABLED$AMISSL_ENABLED" in
+case "x$OPENSSL_ENABLED$GNUTLS_ENABLED$NSS_ENABLED$MBEDTLS_ENABLED$WOLFSSL_ENABLED$WINSSL_ENABLED$SECURETRANSPORT_ENABLED$MESALINK_ENABLED$AMISSL_ENABLED" in
 x)
   AC_MSG_WARN([SSL disabled, you will not be able to use HTTPS, FTPS, NTLM and more.])
-  AC_MSG_WARN([Use --with-ssl, --with-gnutls, --with-cyassl, --with-nss, --with-schannel, --with-secure-transport, --with-mesalink or --with-amissl to address this.])
+  AC_MSG_WARN([Use --with-ssl, --with-gnutls, --with-wolfssl, --with-mbedtls, --with-nss, --with-schannel, --with-secure-transport, --with-mesalink or --with-amissl to address this.])
   ;;
 x1)
   # one SSL backend is enabled
@@ -3033,8 +3021,8 @@ AC_HELP_STRING([--disable-versioned-symbols], [Disable versioned symbols in shar
           versioned_symbols_flavour="GNUTLS_"
         elif test "x$NSS_ENABLED" = "x1"; then
           versioned_symbols_flavour="NSS_"
-        elif test "x$CYASSL_ENABLED" = "x1"; then
-          versioned_symbols_flavour="CYASSL_"
+        elif test "x$WOLFSSL_ENABLED" = "x1"; then
+          versioned_symbols_flavour="WOLFSSL_"
         elif test "x$WINSSL_ENABLED" = "x1"; then
           versioned_symbols_flavour="SCHANNEL_"
         elif test "x$SECURETRANSPORT_ENABLED" = "x1"; then
diff --git a/docs/INTERNALS.md b/docs/INTERNALS.md
index 1563ec516..cd004e8f4 100644
--- a/docs/INTERNALS.md
+++ b/docs/INTERNALS.md
@@ -90,7 +90,7 @@ Dependencies
  - libssh2      0.16
  - c-ares       1.6.0
  - libidn2      2.0.0
- - cyassl       2.0.0
+ - wolfSSL      2.0.0
  - openldap     2.0
  - MIT Kerberos 1.2.4
  - GSKit        V5R3M0
diff --git a/docs/cmdline-opts/pinnedpubkey.d b/docs/cmdline-opts/pinnedpubkey.d
index b1c7bdef6..cd21911f8 100644
--- a/docs/cmdline-opts/pinnedpubkey.d
+++ b/docs/cmdline-opts/pinnedpubkey.d
@@ -15,10 +15,10 @@ abort the connection before sending or receiving any data.
 
 PEM/DER support:
   7.39.0: OpenSSL, GnuTLS and GSKit
-  7.43.0: NSS and wolfSSL/CyaSSL
+  7.43.0: NSS and wolfSSL
   7.47.0: mbedtls
 sha256 support:
-  7.44.0: OpenSSL, GnuTLS, NSS and wolfSSL/CyaSSL.
+  7.44.0: OpenSSL, GnuTLS, NSS and wolfSSL
   7.47.0: mbedtls
 Other SSL backends not supported.
 
diff --git a/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.3 b/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.3
index 44ad40574..b4a74a92e 100644
--- a/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.3
+++ b/docs/libcurl/opts/CURLINFO_TLS_SSL_PTR.3
@@ -54,7 +54,7 @@ struct curl_tlssessioninfo {
 
 The \fIbackend\fP struct member is one of the defines in the CURLSSLBACKEND_*
 series: CURLSSLBACKEND_NONE (when built without TLS support),
-CURLSSLBACKEND_CYASSL, CURLSSLBACKEND_DARWINSSL,
+CURLSSLBACKEND_WOLFSSL, CURLSSLBACKEND_DARWINSSL,
 CURLSSLBACKEND_GNUTLS, CURLSSLBACKEND_GSKIT, CURLSSLBACKEND_MBEDTLS,
 CURLSSLBACKEND_NSS, CURLSSLBACKEND_OPENSSL, CURLSSLBACKEND_POLARSSL,
 CURLSSLBACKEND_SCHANNEL or CURLSSLBACKEND_MESALINK. (Note that the OpenSSL
@@ -83,9 +83,9 @@ mbedtls_ssl_context *
 ssl_context *
 .IP "Secure Channel"
 CtxtHandle *
-.IP "Secure Transport (DarwinSSL)"
+.IP "Secure Transport"
 SSLContext *
-.IP "WolfSSL (formerly CyaSSL)"
+.IP "wolfSSL"
 SSL *
 .IP "MesaLink"
 SSL *
diff --git a/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3 b/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
index 987a24357..fb9698c24 100644
--- a/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
+++ b/docs/libcurl/opts/CURLOPT_PINNEDPUBLICKEY.3
@@ -109,7 +109,7 @@ PEM/DER support:
 
 sha256 support:
 
-  7.44.0: OpenSSL, GnuTLS, NSS and wolfSSL/CyaSSL
+  7.44.0: OpenSSL, GnuTLS, NSS and wolfSSL
 
   7.47.0: mbedtls
 
diff --git a/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.3 b/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.3
index 216bdec3a..85e1168e5 100644
--- a/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.3
+++ b/docs/libcurl/opts/CURLOPT_SSL_CTX_DATA.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
+.\" * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -112,8 +112,8 @@ int main(void)
 }
 .fi
 .SH AVAILABILITY
-Added in 7.11.0 for OpenSSL. Added in 7.42.0 for wolfSSL/CyaSSL. Other SSL
-backends not supported.
+Added in 7.11.0 for OpenSSL, in 7.42.0 for wolfSSL and in 7.54.0 for
+mbedTLS. Other SSL backends are not supported.
 .SH RETURN VALUE
 CURLE_OK if supported; or an error such as:
 
diff --git a/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3 b/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3
index 04d8e297e..01acb9766 100644
--- a/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3
+++ b/docs/libcurl/opts/CURLOPT_SSL_CTX_FUNCTION.3
@@ -5,7 +5,7 @@
 .\" *                            | (__| |_| |  _ <| |___
 .\" *                             \___|\___/|_| \_\_____|
 .\" *
-.\" * Copyright (C) 1998 - 2018, Daniel Stenberg, <daniel@haxx.se>, et al.
+.\" * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
 .\" *
 .\" * This software is licensed as described in the file COPYING, which
 .\" * you should have received as part of this distribution. The terms
@@ -22,7 +22,7 @@
 .\"
 .TH CURLOPT_SSL_CTX_FUNCTION 3 "19 Jun 2014" "libcurl 7.37.0" "curl_easy_setopt options"
 .SH NAME
-CURLOPT_SSL_CTX_FUNCTION \- SSL context callback for OpenSSL, wolfSSL/CyaSSL or mbedTLS
+CURLOPT_SSL_CTX_FUNCTION \- SSL context callback for OpenSSL, wolfSSL or mbedTLS
 .SH SYNOPSIS
 .nf
 #include <curl/curl.h>
@@ -32,9 +32,8 @@ CURLcode ssl_ctx_callback(CURL *curl, void *ssl_ctx, void *userptr);
 CURLcode curl_easy_setopt(CURL *handle, CURLOPT_SSL_CTX_FUNCTION,
                           ssl_ctx_callback);
 .SH DESCRIPTION
-This option only works for libcurl powered by OpenSSL, wolfSSL/CyaSSL or
-mbedTLS. If libcurl was built against another SSL library this functionality is
-absent.
+This option only works for libcurl powered by OpenSSL, wolfSSL or mbedTLS. If
+libcurl was built against another SSL library this functionality is absent.
 
 Pass a pointer to your callback function, which should match the prototype
 shown above.
@@ -43,11 +42,11 @@ This callback function gets called by libcurl just before the initialization
 of an SSL connection after having processed all other SSL related options to
 give a last chance to an application to modify the behavior of the SSL
 initialization. The \fIssl_ctx\fP parameter is actually a pointer to the SSL
-library's \fISSL_CTX\fP for OpenSSL or wolfSSL/CyaSSL, and a pointer to
-\fImbedtls_ssl_config\fP for mbedTLS. If an error is returned from the callback
-no attempt to establish a connection is made and the perform operation will
-return the callback's error code. Set the \fIuserptr\fP argument with the
-\fICURLOPT_SSL_CTX_DATA(3)\fP option.
+library's \fISSL_CTX\fP for OpenSSL or wolfSSL, and a pointer to
+\fImbedtls_ssl_config\fP for mbedTLS. If an error is returned from the
+callback no attempt to establish a connection is made and the perform
+operation will return the callback's error code. Set the \fIuserptr\fP
+argument with the \fICURLOPT_SSL_CTX_DATA(3)\fP option.
 
 This function will get called on all new connections made to a server, during
 the SSL negotiation. The \fIssl_ctx\fP will point to a newly initialized object
@@ -72,8 +71,8 @@ See cacertinmem.c in docs/examples directory for usage example.
 
 https://curl.haxx.se/libcurl/c/cacertinmem.html
 .SH AVAILABILITY
-Added in 7.11.0 for OpenSSL. Added in 7.42.0 for wolfSSL/CyaSSL. Added in
-7.54.0 for mbedTLS. Other SSL backends not supported.
+Added in 7.11.0 for OpenSSL, in 7.42.0 for wolfSSL and in 7.54.0 for
+mbedTLS. Other SSL backends are not supported.
 .SH RETURN VALUE
 CURLE_OK if supported; or an error such as:
 
diff --git a/lib/Makefile.inc b/lib/Makefile.inc
index 235b82b0e..37f702681 100644
--- a/lib/Makefile.inc
+++ b/lib/Makefile.inc
@@ -29,12 +29,12 @@ LIB_VAUTH_HFILES = vauth/vauth.h vauth/digest.h vauth/ntlm.h
 
 LIB_VTLS_CFILES = vtls/openssl.c vtls/gtls.c vtls/vtls.c vtls/nss.c     \
   vtls/polarssl.c vtls/polarssl_threadlock.c                            \
-  vtls/cyassl.c vtls/schannel.c vtls/schannel_verify.c                  \
+  vtls/wolfssl.c vtls/schannel.c vtls/schannel_verify.c                 \
   vtls/sectransp.c vtls/gskit.c vtls/mbedtls.c vtls/mesalink.c
 
 LIB_VTLS_HFILES = vtls/openssl.h vtls/vtls.h vtls/gtls.h                \
   vtls/nssg.h vtls/polarssl.h vtls/polarssl_threadlock.h                \
-  vtls/cyassl.h vtls/schannel.h vtls/sectransp.h vtls/gskit.h           \
+  vtls/wolfssl.h vtls/schannel.h vtls/sectransp.h vtls/gskit.h          \
   vtls/mbedtls.h vtls/mesalink.h
 
 LIB_CFILES = file.c timeval.c base64.c hostip.c progress.c formdata.c   \
diff --git a/lib/curl_setup.h b/lib/curl_setup.h
index a4601c49e..27414a540 100644
--- a/lib/curl_setup.h
+++ b/lib/curl_setup.h
@@ -648,7 +648,7 @@ int netware_init(void);
 
 #if defined(USE_GNUTLS) || defined(USE_OPENSSL) || defined(USE_NSS) || \
     defined(USE_MBEDTLS) || \
-    defined(USE_CYASSL) || defined(USE_SCHANNEL) || \
+    defined(USE_WOLFSSL) || defined(USE_SCHANNEL) || \
     defined(USE_SECTRANSP) || defined(USE_GSKIT) || defined(USE_MESALINK)
 #define USE_SSL    /* SSL support has been enabled */
 #endif
diff --git a/lib/vtls/vtls.c b/lib/vtls/vtls.c
index a7452dcd5..6a0e60fb6 100644
--- a/lib/vtls/vtls.c
+++ b/lib/vtls/vtls.c
@@ -514,7 +514,7 @@ void Curl_ssl_close_all(struct Curl_easy *data)
 
 #if defined(USE_OPENSSL) || defined(USE_GNUTLS) || defined(USE_SCHANNEL) || \
   defined(USE_SECTRANSP) || defined(USE_POLARSSL) || defined(USE_NSS) || \
-  defined(USE_MBEDTLS) || defined(USE_CYASSL)
+  defined(USE_MBEDTLS) || defined(USE_WOLFSSL)
 int Curl_ssl_getsock(struct connectdata *conn, curl_socket_t *socks,
                      int numsocks)
 {
@@ -1172,8 +1172,8 @@ static const struct Curl_ssl Curl_ssl_multi = {
 const struct Curl_ssl *Curl_ssl =
 #if defined(CURL_WITH_MULTI_SSL)
   &Curl_ssl_multi;
-#elif defined(USE_CYASSL)
-  &Curl_ssl_cyassl;
+#elif defined(USE_WOLFSSL)
+  &Curl_ssl_wolfssl;
 #elif defined(USE_SECTRANSP)
   &Curl_ssl_sectransp;
 #elif defined(USE_GNUTLS)
@@ -1197,8 +1197,8 @@ const struct Curl_ssl *Curl_ssl =
 #endif
 
 static const struct Curl_ssl *available_backends[] = {
-#if defined(USE_CYASSL)
-  &Curl_ssl_cyassl,
+#if defined(USE_WOLFSSL)
+  &Curl_ssl_wolfssl,
 #endif
 #if defined(USE_SECTRANSP)
   &Curl_ssl_sectransp,
diff --git a/lib/vtls/vtls.h b/lib/vtls/vtls.h
index 2a87ca1f7..173d360de 100644
--- a/lib/vtls/vtls.h
+++ b/lib/vtls/vtls.h
@@ -103,7 +103,7 @@ CURLcode Curl_none_md5sum(unsigned char *input, size_t inputlen,
 #include "nssg.h"           /* NSS versions */
 #include "gskit.h"          /* Global Secure ToolKit versions */
 #include "polarssl.h"       /* PolarSSL versions */
-#include "cyassl.h"         /* CyaSSL versions */
+#include "wolfssl.h"        /* wolfSSL versions */
 #include "schannel.h"       /* Schannel SSPI version */
 #include "sectransp.h"      /* SecureTransport (Darwin) version */
 #include "mbedtls.h"        /* mbedTLS versions */
diff --git a/lib/vtls/cyassl.c b/lib/vtls/wolfssl.c
index 40626a5f1..30e3756bf 100644
--- a/lib/vtls/cyassl.c
+++ b/lib/vtls/wolfssl.c
@@ -21,31 +21,21 @@
  ***************************************************************************/
 
 /*
- * Source file for all CyaSSL-specific code for the TLS/SSL layer. No code
+ * Source file for all wolfSSL specific code for the TLS/SSL layer. No code
  * but vtls.c should ever call or use these functions.
  *
  */
 
 #include "curl_setup.h"
 
-#ifdef USE_CYASSL
+#ifdef USE_WOLFSSL
 
 #define WOLFSSL_OPTIONS_IGNORE_SYS
-/* CyaSSL's version.h, which should contain only the version, should come
-before all other CyaSSL includes and be immediately followed by build config
-aka options.h. https://curl.haxx.se/mail/lib-2015-04/0069.html */
-#include <cyassl/version.h>
-#if defined(HAVE_CYASSL_OPTIONS_H) && (LIBCYASSL_VERSION_HEX > 0x03004008)
-#if defined(CYASSL_API) || defined(WOLFSSL_API)
-/* Safety measure. If either is defined some API include was already included
-and that's a problem since options.h hasn't been included yet. */
-#error "CyaSSL API was included before the CyaSSL build options."
-#endif
-#include <cyassl/options.h>
-#endif
+#include <wolfssl/version.h>
+#include <wolfssl/options.h>
 
 /* To determine what functions are available we rely on one or both of:
-   - the user's options.h generated by CyaSSL/wolfSSL
+   - the user's options.h generated by wolfSSL
    - the symbols detected by curl's configure
    Since they are markedly different from one another, and one or the other may
    not be available, we do some checking below to bring things in sync. */
@@ -61,8 +51,8 @@ and that's a problem since options.h hasn't been included yet. */
    options.h, but is only seen in >= 3.6.6 since that's when they started
    disabling SSLv3 by default. */
 #ifndef WOLFSSL_ALLOW_SSLV3
-#if (LIBCYASSL_VERSION_HEX < 0x03006006) || \
-    defined(HAVE_WOLFSSLV3_CLIENT_METHOD)
+#if (LIBWOLFSSL_VERSION_HEX < 0x03006006) || \
+  defined(HAVE_WOLFSSLV3_CLIENT_METHOD)
 #define WOLFSSL_ALLOW_SSLV3
 #endif
 #endif
@@ -81,33 +71,21 @@ and that's a problem since options.h hasn't been included yet. */
 #include "curl_printf.h"
 #include "multiif.h"
 
-#include <cyassl/openssl/ssl.h>
-#include <cyassl/ssl.h>
-#ifdef HAVE_CYASSL_ERROR_SSL_H
-#include <cyassl/error-ssl.h>
-#else
-#include <cyassl/error.h>
-#endif
-#include <cyassl/ctaocrypt/random.h>
-#include <cyassl/ctaocrypt/sha256.h>
-
-#include "cyassl.h"
+#include <wolfssl/openssl/ssl.h>
+#include <wolfssl/ssl.h>
+#include <wolfssl/error-ssl.h>
+#include "wolfssl.h"
 
 /* The last #include files should be: */
 #include "curl_memory.h"
 #include "memdebug.h"
 
-#if LIBCYASSL_VERSION_HEX < 0x02007002 /* < 2.7.2 */
-#define CYASSL_MAX_ERROR_SZ 80
-#endif
-
 /* KEEP_PEER_CERT is a product of the presence of build time symbol
    OPENSSL_EXTRA without NO_CERTS, depending on the version. KEEP_PEER_CERT is
    in wolfSSL's settings.h, and the latter two are build time symbols in
    options.h. */
 #ifndef KEEP_PEER_CERT
-#if defined(HAVE_CYASSL_GET_PEER_CERTIFICATE) || \
-    defined(HAVE_WOLFSSL_GET_PEER_CERTIFICATE) || \
+#if defined(HAVE_WOLFSSL_GET_PEER_CERTIFICATE) || \
     (defined(OPENSSL_EXTRA) && !defined(NO_CERTS))
 #define KEEP_PEER_CERT
 #endif
@@ -120,8 +98,8 @@ struct ssl_backend_data {
 
 #define BACKEND connssl->backend
 
-static Curl_recv cyassl_recv;
-static Curl_send cyassl_send;
+static Curl_recv wolfssl_recv;
+static Curl_send wolfssl_send;
 
 
 static int do_file_type(const char *type)
@@ -140,7 +118,7 @@ static int do_file_type(const char *type)
  * layer and do all necessary magic.
  */
 static CURLcode
-cyassl_connect_step1(struct connectdata *conn,
+wolfssl_connect_step1(struct connectdata *conn,
                      int sockindex)
 {
   char *ciphers;
@@ -159,7 +137,7 @@ cyassl_connect_step1(struct connectdata *conn,
     return CURLE_OK;
 
   if(SSL_CONN_CONFIG(version_max) != CURL_SSLVERSION_MAX_NONE) {
-    failf(data, "CyaSSL does not support to set maximum SSL/TLS version");
+    failf(data, "wolfSSL does not support to set maximum SSL/TLS version");
     return CURLE_SSL_CONNECT_ERROR;
   }
 
@@ -167,11 +145,11 @@ cyassl_connect_step1(struct connectdata *conn,
   switch(SSL_CONN_CONFIG(version)) {
   case CURL_SSLVERSION_DEFAULT:
   case CURL_SSLVERSION_TLSv1:
-#if LIBCYASSL_VERSION_HEX >= 0x03003000 /* >= 3.3.0 */
+#if LIBWOLFSSL_VERSION_HEX >= 0x03003000 /* >= 3.3.0 */
     /* minimum protocol version is set later after the CTX object is created */
     req_method = SSLv23_client_method();
 #else
-    infof(data, "CyaSSL <3.3.0 cannot be configured to use TLS 1.0-1.2, "
+    infof(data, "wolfSSL <3.3.0 cannot be configured to use TLS 1.0-1.2, "
           "TLS 1.0 is used exclusively\n");
     req_method = TLSv1_client_method();
 #endif
@@ -182,7 +160,7 @@ cyassl_connect_step1(struct connectdata *conn,
     req_method = TLSv1_client_method();
     use_sni(TRUE);
 #else
-    failf(data, "CyaSSL does not support TLS 1.0");
+    failf(data, "wolfSSL does not support TLS 1.0");
     return CURLE_NOT_BUILT_IN;
 #endif
     break;
@@ -200,7 +178,7 @@ cyassl_connect_step1(struct connectdata *conn,
     use_sni(TRUE);
     break;
 #else
-    failf(data, "CyaSSL: TLS 1.3 is not yet supported");
+    failf(data, "wolfSSL: TLS 1.3 is not yet supported");
     return CURLE_SSL_CONNECT_ERROR;
 #endif
   case CURL_SSLVERSION_SSLv3:
@@ -208,12 +186,12 @@ cyassl_connect_step1(struct connectdata *conn,
     req_method = SSLv3_client_method();
     use_sni(FALSE);
 #else
-    failf(data, "CyaSSL does not support SSLv3");
+    failf(data, "wolfSSL does not support SSLv3");
     return CURLE_NOT_BUILT_IN;
 #endif
     break;
   case CURL_SSLVERSION_SSLv2:
-    failf(data, "CyaSSL does not support SSLv2");
+    failf(data, "wolfSSL does not support SSLv2");
     return CURLE_SSL_CONNECT_ERROR;
   default:
     failf(data, "Unrecognized parameter passed via CURLOPT_SSLVERSION");
@@ -237,13 +215,12 @@ cyassl_connect_step1(struct connectdata *conn,
   switch(SSL_CONN_CONFIG(version)) {
   case CURL_SSLVERSION_DEFAULT:
   case CURL_SSLVERSION_TLSv1:
-#if LIBCYASSL_VERSION_HEX > 0x03004006 /* > 3.4.6 */
-    /* Versions 3.3.0 to 3.4.6 we know the minimum protocol version is whatever
-    minimum version of TLS was built in and at least TLS 1.0. For later library
-    versions that could change (eg TLS 1.0 built in but defaults to TLS 1.1) so
-    we have this short circuit evaluation to find the minimum supported TLS
-    version. We use wolfSSL_CTX_SetMinVersion and not CyaSSL_SetMinVersion
-    because only the former will work before the user's CTX callback is called.
+#if LIBWOLFSSL_VERSION_HEX > 0x03004006 /* > 3.4.6 */
+    /* Versions 3.3.0 to 3.4.6 we know the minimum protocol version is
+     * whatever minimum version of TLS was built in and at least TLS 1.0. For
+     * later library versions that could change (eg TLS 1.0 built in but
+     * defaults to TLS 1.1) so we have this short circuit evaluation to find
+     * the minimum supported TLS version.
     */
     if((wolfSSL_CTX_SetMinVersion(BACKEND->ctx, WOLFSSL_TLSV1) != 1) &&
        (wolfSSL_CTX_SetMinVersion(BACKEND->ctx, WOLFSSL_TLSV1_1) != 1) &&
@@ -347,7 +324,7 @@ cyassl_connect_step1(struct connectdata *conn,
 #ifdef ENABLE_IPV6
        (0 == Curl_inet_pton(AF_INET6, hostname, &addr6)) &&
 #endif
-       (CyaSSL_CTX_UseSNI(BACKEND->ctx, CYASSL_SNI_HOST_NAME, hostname,
+       (wolfssl_CTX_UseSNI(BACKEND->ctx, WOLFSSL_SNI_HOST_NAME, hostname,
                           (unsigned short)hostname_len) != 1)) {
       infof(data, "WARNING: failed to configure server name indication (SNI) "
             "TLS extension\n");
@@ -366,7 +343,7 @@ cyassl_connect_step1(struct connectdata *conn,
   }
 #ifdef NO_FILESYSTEM
   else if(SSL_CONN_CONFIG(verifypeer)) {
-    failf(data, "SSL: Certificates couldn't be loaded because CyaSSL was built"
+    failf(data, "SSL: Certificates can't be loaded because wolfSSL was built"
           " with \"no filesystem\". Either disable peer verification"
           " (insecure) or if you are building an application with libcurl you"
           " can load certificates via CURLOPT_SSL_CTX_FUNCTION.");
@@ -418,11 +395,11 @@ cyassl_connect_step1(struct connectdata *conn,
     if(!Curl_ssl_getsessionid(conn, &ssl_sessionid, NULL, sockindex)) {
       /* we got a session id, use it! */
       if(!SSL_set_session(BACKEND->handle, ssl_sessionid)) {
-        char error_buffer[CYASSL_MAX_ERROR_SZ];
+        char error_buffer[WOLFSSL_MAX_ERROR_SZ];
         Curl_ssl_sessionid_unlock(conn);
         failf(data, "SSL: SSL_set_session failed: %s",
               ERR_error_string(SSL_get_error(BACKEND->handle, 0),
-              error_buffer));
+                               error_buffer));
         return CURLE_SSL_CONNECT_ERROR;
       }
       /* Informational message */
@@ -443,7 +420,7 @@ cyassl_connect_step1(struct connectdata *conn,
 
 
 static CURLcode
-cyassl_connect_step2(struct connectdata *conn,
+wolfssl_connect_step2(struct connectdata *conn,
                      int sockindex)
 {
   int ret = -1;
@@ -457,19 +434,19 @@ cyassl_connect_step2(struct connectdata *conn,
                         data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY] :
                         data->set.str[STRING_SSL_PINNEDPUBLICKEY_ORIG];
 
-  conn->recv[sockindex] = cyassl_recv;
-  conn->send[sockindex] = cyassl_send;
+  conn->recv[sockindex] = wolfssl_recv;
+  conn->send[sockindex] = wolfssl_send;
 
   /* Enable RFC2818 checks */
   if(SSL_CONN_CONFIG(verifyhost)) {
-    ret = CyaSSL_check_domain_name(BACKEND->handle, hostname);
+    ret = wolfSSL_check_domain_name(BACKEND->handle, hostname);
     if(ret == SSL_FAILURE)
       return CURLE_OUT_OF_MEMORY;
   }
 
   ret = SSL_connect(BACKEND->handle);
   if(ret != 1) {
-    char error_buffer[CYASSL_MAX_ERROR_SZ];
+    char error_buffer[WOLFSSL_MAX_ERROR_SZ];
     int  detail = SSL_get_error(BACKEND->handle, ret);
 
     if(SSL_ERROR_WANT_READ == detail) {
@@ -489,11 +466,12 @@ cyassl_connect_step2(struct connectdata *conn,
             dispname);
       return CURLE_PEER_FAILED_VERIFICATION;
 #else
-      /* When the CyaSSL_check_domain_name() is used and you desire to continue
-       * on a DOMAIN_NAME_MISMATCH, i.e. 'conn->ssl_config.verifyhost == 0',
-       * CyaSSL version 2.4.0 will fail with an INCOMPLETE_DATA error. The only
-       * way to do this is currently to switch the CyaSSL_check_domain_name()
-       * in and out based on the 'conn->ssl_config.verifyhost' value. */
+      /* When the wolfssl_check_domain_name() is used and you desire to
+       * continue on a DOMAIN_NAME_MISMATCH, i.e. 'conn->ssl_config.verifyhost
+       * == 0', CyaSSL version 2.4.0 will fail with an INCOMPLETE_DATA
+       * error. The only way to do this is currently to switch the
+       * Wolfssl_check_domain_name() in and out based on the
+       * 'conn->ssl_config.verifyhost' value. */
       if(SSL_CONN_CONFIG(verifyhost)) {
         failf(data,
               "\tsubject alt name(s) or common name do not match \"%s\"\n",
@@ -508,7 +486,7 @@ cyassl_connect_step2(struct connectdata *conn,
       }
 #endif
     }
-#if LIBCYASSL_VERSION_HEX >= 0x02007000 /* 2.7.0 */
+#if LIBWOLFSSL_VERSION_HEX >= 0x02007000 /* 2.7.0 */
     else if(ASN_NO_SIGNER_E == detail) {
       if(SSL_CONN_CONFIG(verifypeer)) {
         failf(data, "\tCA signer not available for verification\n");
@@ -544,7 +522,7 @@ cyassl_connect_step2(struct connectdata *conn,
       return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
     }
 
-    x509_der = (const char *)CyaSSL_X509_get_der(x509, &x509_der_len);
+    x509_der = (const char *)wolfssl_X509_get_der(x509, &x509_der_len);
     if(!x509_der) {
       failf(data, "SSL: failed retrieving ASN.1 server certificate");
       return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
@@ -612,7 +590,7 @@ cyassl_connect_step2(struct connectdata *conn,
 #endif /* HAVE_ALPN */
 
   connssl->connecting_state = ssl_connect_3;
-#if (LIBCYASSL_VERSION_HEX >= 0x03009010)
+#if (LIBWOLFSSL_VERSION_HEX >= 0x03009010)
   infof(data, "SSL connection using %s / %s\n",
         wolfSSL_get_version(BACKEND->handle),
         wolfSSL_get_cipher_name(BACKEND->handle));
@@ -625,7 +603,7 @@ cyassl_connect_step2(struct connectdata *conn,
 
 
 static CURLcode
-cyassl_connect_step3(struct connectdata *conn,
+wolfssl_connect_step3(struct connectdata *conn,
                      int sockindex)
 {
   CURLcode result = CURLE_OK;
@@ -670,14 +648,14 @@ cyassl_connect_step3(struct connectdata *conn,
 }
 
 
-static ssize_t cyassl_send(struct connectdata *conn,
+static ssize_t wolfssl_send(struct connectdata *conn,
                            int sockindex,
                            const void *mem,
                            size_t len,
                            CURLcode *curlcode)
 {
   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
-  char error_buffer[CYASSL_MAX_ERROR_SZ];
+  char error_buffer[WOLFSSL_MAX_ERROR_SZ];
   int  memlen = (len > (size_t)INT_MAX) ? INT_MAX : (int)len;
   int  rc     = SSL_write(BACKEND->handle, mem, memlen);
 
@@ -701,7 +679,7 @@ static ssize_t cyassl_send(struct connectdata *conn,
   return rc;
 }
 
-static void Curl_cyassl_close(struct connectdata *conn, int sockindex)
+static void Curl_wolfssl_close(struct connectdata *conn, int sockindex)
 {
   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
 
@@ -716,14 +694,14 @@ static void Curl_cyassl_close(struct connectdata *conn, int sockindex)
   }
 }
 
-static ssize_t cyassl_recv(struct connectdata *conn,
+static ssize_t wolfssl_recv(struct connectdata *conn,
                            int num,
                            char *buf,
                            size_t buffersize,
                            CURLcode *curlcode)
 {
   struct ssl_connect_data *connssl = &conn->ssl[num];
-  char error_buffer[CYASSL_MAX_ERROR_SZ];
+  char error_buffer[WOLFSSL_MAX_ERROR_SZ];
   int  buffsize = (buffersize > (size_t)INT_MAX) ? INT_MAX : (int)buffersize;
   int  nread    = SSL_read(BACKEND->handle, buf, buffsize);
 
@@ -750,40 +728,36 @@ static ssize_t cyassl_recv(struct connectdata *conn,
 }
 
 
-static void Curl_cyassl_session_free(void *ptr)
+static void Curl_wolfssl_session_free(void *ptr)
 {
   (void)ptr;
-  /* CyaSSL reuses sessions on own, no free */
+  /* wolfSSL reuses sessions on own, no free */
 }
 
 
-static size_t Curl_cyassl_version(char *buffer, size_t size)
+static size_t Curl_wolfssl_version(char *buffer, size_t size)
 {
-#if LIBCYASSL_VERSION_HEX >= 0x03006000
+#if LIBWOLFSSL_VERSION_HEX >= 0x03006000
   return msnprintf(buffer, size, "wolfSSL/%s", wolfSSL_lib_version());
 #elif defined(WOLFSSL_VERSION)
   return msnprintf(buffer, size, "wolfSSL/%s", WOLFSSL_VERSION);
-#elif defined(CYASSL_VERSION)
-  return msnprintf(buffer, size, "CyaSSL/%s", CYASSL_VERSION);
-#else
-  return msnprintf(buffer, size, "CyaSSL/%s", "<1.8.8");
 #endif
 }
 
 
-static int Curl_cyassl_init(void)
+static int Curl_wolfssl_init(void)
 {
-  return (CyaSSL_Init() == SSL_SUCCESS);
+  return (wolfSSL_Init() == SSL_SUCCESS);
 }
 
 
-static void Curl_cyassl_cleanup(void)
+static void Curl_wolfssl_cleanup(void)
 {
-  CyaSSL_Cleanup();
+  wolfSSL_Cleanup();
 }
 
 
-static bool Curl_cyassl_data_pending(const struct connectdata* conn,
+static bool Curl_wolfssl_data_pending(const struct connectdata* conn,
                                      int connindex)
 {
   const struct ssl_connect_data *connssl = &conn->ssl[connindex];
@@ -798,7 +772,7 @@ static bool Curl_cyassl_data_pending(const struct connectdata* conn,
  * This function is called to shut down the SSL layer but keep the
  * socket open (CCC - Clear Command Channel)
  */
-static int Curl_cyassl_shutdown(struct connectdata *conn, int sockindex)
+static int Curl_wolfssl_shutdown(struct connectdata *conn, int sockindex)
 {
   int retval = 0;
   struct ssl_connect_data *connssl = &conn->ssl[sockindex];
@@ -812,7 +786,7 @@ static int Curl_cyassl_shutdown(struct connectdata *conn, int sockindex)
 
 
 static CURLcode
-cyassl_connect_common(struct connectdata *conn,
+wolfssl_connect_common(struct connectdata *conn,
                       int sockindex,
                       bool nonblocking,
                       bool *done)
@@ -840,7 +814,7 @@ cyassl_connect_common(struct connectdata *conn,
       return CURLE_OPERATION_TIMEDOUT;
     }
 
-    result = cyassl_connect_step1(conn, sockindex);
+    result = wolfssl_connect_step1(conn, sockindex);
     if(result)
       return result;
   }
@@ -895,7 +869,7 @@ cyassl_connect_common(struct connectdata *conn,
      * ensuring that a client using select() or epoll() will always
      * have a valid fdset to wait on.
      */
-    result = cyassl_connect_step2(conn, sockindex);
+    result = wolfssl_connect_step2(conn, sockindex);
     if(result || (nonblocking &&
                   (ssl_connect_2 == connssl->connecting_state ||
                    ssl_connect_2_reading == connssl->connecting_state ||
@@ -904,15 +878,15 @@ cyassl_connect_common(struct connectdata *conn,
   } /* repeat step2 until all transactions are done. */
 
   if(ssl_connect_3 == connssl->connecting_state) {
-    result = cyassl_connect_step3(conn, sockindex);
+    result = wolfssl_connect_step3(conn, sockindex);
     if(result)
       return result;
   }
 
   if(ssl_connect_done == connssl->connecting_state) {
     connssl->state = ssl_connection_complete;
-    conn->recv[sockindex] = cyassl_recv;
-    conn->send[sockindex] = cyassl_send;
+    conn->recv[sockindex] = wolfssl_recv;
+    conn->send[sockindex] = wolfssl_send;
     *done = TRUE;
   }
   else
@@ -925,19 +899,19 @@ cyassl_connect_common(struct connectdata *conn,
 }
 
 
-static CURLcode Curl_cyassl_connect_nonblocking(struct connectdata *conn,
+static CURLcode Curl_wolfssl_connect_nonblocking(struct connectdata *conn,
                                                 int sockindex, bool *done)
 {
-  return cyassl_connect_common(conn, sockindex, TRUE, done);
+  return wolfssl_connect_common(conn, sockindex, TRUE, done);
 }
 
 
-static CURLcode Curl_cyassl_connect(struct connectdata *conn, int sockindex)
+static CURLcode Curl_wolfssl_connect(struct connectdata *conn, int sockindex)
 {
   CURLcode result;
   bool done = FALSE;
 
-  result = cyassl_connect_common(conn, sockindex, FALSE, &done);
+  result = wolfssl_connect_common(conn, sockindex, FALSE, &done);
   if(result)
     return result;
 
@@ -946,43 +920,43 @@ static CURLcode Curl_cyassl_connect(struct connectdata *conn, int sockindex)
   return CURLE_OK;
 }
 
-static CURLcode Curl_cyassl_random(struct Curl_easy *data,
+static CURLcode Curl_wolfssl_random(struct Curl_easy *data,
                                    unsigned char *entropy, size_t length)
 {
   RNG rng;
   (void)data;
-  if(InitRng(&rng))
+  if(wc_InitRng(&rng))
     return CURLE_FAILED_INIT;
   if(length > UINT_MAX)
     return CURLE_FAILED_INIT;
-  if(RNG_GenerateBlock(&rng, entropy, (unsigned)length))
+  if(wc_RNG_GenerateBlock(&rng, entropy, (unsigned)length))
     return CURLE_FAILED_INIT;
-  if(FreeRng(&rng))
+  if(wc_FreeRng(&rng))
     return CURLE_FAILED_INIT;
   return CURLE_OK;
 }
 
-static CURLcode Curl_cyassl_sha256sum(const unsigned char *tmp, /* input */
+static CURLcode Curl_wolfssl_sha256sum(const unsigned char *tmp, /* input */
                                   size_t tmplen,
                                   unsigned char *sha256sum /* output */,
                                   size_t unused)
 {
   Sha256 SHA256pw;
   (void)unused;
-  InitSha256(&SHA256pw);
-  Sha256Update(&SHA256pw, tmp, (word32)tmplen);
-  Sha256Final(&SHA256pw, sha256sum);
+  wc_InitSha256(&SHA256pw);
+  wc_Sha256Update(&SHA256pw, tmp, (word32)tmplen);
+  wc_Sha256Final(&SHA256pw, sha256sum);
   return CURLE_OK;
 }
 
-static void *Curl_cyassl_get_internals(struct ssl_connect_data *connssl,
+static void *Curl_wolfssl_get_internals(struct ssl_connect_data *connssl,
                                        CURLINFO info UNUSED_PARAM)
 {
   (void)info;
   return BACKEND->handle;
 }
 
-const struct Curl_ssl Curl_ssl_cyassl = {
+const struct Curl_ssl Curl_ssl_wolfssl = {
   { CURLSSLBACKEND_WOLFSSL, "WolfSSL" }, /* info */
 
 #ifdef KEEP_PEER_CERT
@@ -992,26 +966,26 @@ const struct Curl_ssl Curl_ssl_cyassl = {
 
   sizeof(struct ssl_backend_data),
 
-  Curl_cyassl_init,                /* init */
-  Curl_cyassl_cleanup,             /* cleanup */
-  Curl_cyassl_version,             /* version */
+  Curl_wolfssl_init,                /* init */
+  Curl_wolfssl_cleanup,             /* cleanup */
+  Curl_wolfssl_version,             /* version */
   Curl_none_check_cxn,             /* check_cxn */
-  Curl_cyassl_shutdown,            /* shutdown */
-  Curl_cyassl_data_pending,        /* data_pending */
-  Curl_cyassl_random,              /* random */
+  Curl_wolfssl_shutdown,            /* shutdown */
+  Curl_wolfssl_data_pending,        /* data_pending */
+  Curl_wolfssl_random,              /* random */
   Curl_none_cert_status_request,   /* cert_status_request */
-  Curl_cyassl_connect,             /* connect */
-  Curl_cyassl_connect_nonblocking, /* connect_nonblocking */
-  Curl_cyassl_get_internals,       /* get_internals */
-  Curl_cyassl_close,               /* close_one */
+  Curl_wolfssl_connect,             /* connect */
+  Curl_wolfssl_connect_nonblocking, /* connect_nonblocking */
+  Curl_wolfssl_get_internals,       /* get_internals */
+  Curl_wolfssl_close,               /* close_one */
   Curl_none_close_all,             /* close_all */
-  Curl_cyassl_session_free,        /* session_free */
+  Curl_wolfssl_session_free,        /* session_free */
   Curl_none_set_engine,            /* set_engine */
   Curl_none_set_engine_default,    /* set_engine_default */
   Curl_none_engines_list,          /* engines_list */
   Curl_none_false_start,           /* false_start */
   Curl_none_md5sum,                /* md5sum */
-  Curl_cyassl_sha256sum            /* sha256sum */
+  Curl_wolfssl_sha256sum            /* sha256sum */
 };
 
 #endif
diff --git a/lib/vtls/cyassl.h b/lib/vtls/wolfssl.h
index 01e11cc23..2b9673c0f 100644
--- a/lib/vtls/cyassl.h
+++ b/lib/vtls/wolfssl.h
@@ -1,5 +1,5 @@
-#ifndef HEADER_CURL_CYASSL_H
-#define HEADER_CURL_CYASSL_H
+#ifndef HEADER_CURL_WOLFSSL_H
+#define HEADER_CURL_WOLFSSL_H
 /***************************************************************************
  *                                  _   _ ____  _
  *  Project                     ___| | | |  _ \| |
@@ -7,7 +7,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2017, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -23,9 +23,9 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#ifdef USE_CYASSL
+#ifdef USE_WOLFSSL
 
-extern const struct Curl_ssl Curl_ssl_cyassl;
+extern const struct Curl_ssl Curl_ssl_wolfssl;
 
-#endif /* USE_CYASSL */
-#endif /* HEADER_CURL_CYASSL_H */
+#endif /* USE_WOLFSSL */
+#endif /* HEADER_CURL_WOLFSSL_H */
diff --git a/lib/x509asn1.c b/lib/x509asn1.c
index 0c1256ba8..ece5364d8 100644
--- a/lib/x509asn1.c
+++ b/lib/x509asn1.c
@@ -23,7 +23,7 @@
 #include "curl_setup.h"
 
 #if defined(USE_GSKIT) || defined(USE_NSS) || defined(USE_GNUTLS) || \
-    defined(USE_CYASSL) || defined(USE_SCHANNEL)
+    defined(USE_WOLFSSL) || defined(USE_SCHANNEL)
 
 #include <curl/curl.h>
 #include "urldata.h"
@@ -1104,7 +1104,7 @@ CURLcode Curl_extract_certinfo(struct connectdata *conn,
   return CURLE_OK;
 }
 
-#endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_CYASSL or USE_SCHANNEL */
+#endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL */
 
 #if defined(USE_GSKIT)
 
diff --git a/lib/x509asn1.h b/lib/x509asn1.h
index ce4029792..205fdc0d7 100644
--- a/lib/x509asn1.h
+++ b/lib/x509asn1.h
@@ -8,7 +8,7 @@
  *                            | (__| |_| |  _ <| |___
  *                             \___|\___/|_| \_\_____|
  *
- * Copyright (C) 1998 - 2016, Daniel Stenberg, <daniel@haxx.se>, et al.
+ * Copyright (C) 1998 - 2019, Daniel Stenberg, <daniel@haxx.se>, et al.
  *
  * This software is licensed as described in the file COPYING, which
  * you should have received as part of this distribution. The terms
@@ -26,7 +26,7 @@
 #include "curl_setup.h"
 
 #if defined(USE_GSKIT) || defined(USE_NSS) || defined(USE_GNUTLS) || \
-    defined(USE_CYASSL) || defined(USE_SCHANNEL)
+    defined(USE_WOLFSSL) || defined(USE_SCHANNEL)
 
 #include "urldata.h"
 
@@ -130,5 +130,5 @@ CURLcode Curl_extract_certinfo(struct connectdata *conn, int certnum,
                                const char *beg, const char *end);
 CURLcode Curl_verifyhost(struct connectdata *conn,
                          const char *beg, const char *end);
-#endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_CYASSL or USE_SCHANNEL */
+#endif /* USE_GSKIT or USE_NSS or USE_GNUTLS or USE_WOLFSSL or USE_SCHANNEL */
 #endif /* HEADER_CURL_X509ASN1_H */
diff --git a/tests/runtests.pl b/tests/runtests.pl
index b5182513b..a6e1adde3 100755
--- a/tests/runtests.pl
+++ b/tests/runtests.pl
@@ -244,7 +244,7 @@ my $h2cver = "h2c";
 my $has_openssl;    # built with a lib using an OpenSSL-like API
 my $has_gnutls;     # built with GnuTLS
 my $has_nss;        # built with NSS
-my $has_yassl;      # built with yassl
+my $has_wolfssl;    # built with wolfSSL
 my $has_polarssl;   # built with polarssl
 my $has_winssl;     # built with WinSSL    (Secure Channel aka Schannel)
 my $has_darwinssl;  # built with DarwinSSL (Secure Transport)
@@ -2622,8 +2622,8 @@ sub checksystem {
                $has_nss=1;
                $has_sslpinning=1;
            }
-           elsif ($libcurl =~ /(yassl|wolfssl)/i) {
-               $has_yassl=1;
+           elsif ($libcurl =~ /wolfssl/i) {
+               $has_wolfssl=1;
                $has_sslpinning=1;
            }
            elsif ($libcurl =~ /polarssl/i) {
diff --git a/tests/unit/unit1651.c b/tests/unit/unit1651.c
index db3a0f35b..3652601f9 100644
--- a/tests/unit/unit1651.c
+++ b/tests/unit/unit1651.c
@@ -33,7 +33,7 @@ static void unit_stop(void)
 
 }
 #if defined(USE_GSKIT) || defined(USE_NSS) || defined(USE_GNUTLS) || \
-    defined(USE_CYASSL) || defined(USE_SCHANNEL)
+    defined(USE_WOLFSSL) || defined(USE_SCHANNEL)
 
 /* cert captured from gdb when connecting to curl.haxx.se on October 26
    2018 */