diff --git a/package/libnetconf2/Config.in b/package/libnetconf2/Config.in
index 1763243120..59e021375d 100644
--- a/package/libnetconf2/Config.in
+++ b/package/libnetconf2/Config.in
@@ -12,6 +12,24 @@ config BR2_PACKAGE_LIBNETCONF2
 
 	  https://github.com/CESNET/libnetconf2
 
+if BR2_PACKAGE_LIBNETCONF2
+
+config BR2_PACKAGE_LIBNETCONF2_SSH_TLS
+	bool "SSH/TLS support"
+	depends on BR2_USE_MMU # libssh
+	depends on !BR2_STATIC_LIBS # libssh
+	depends on BR2_TOOLCHAIN_HAS_THREADS # libssh
+	select BR2_PACKAGE_OPENSSL if !BR2_PACKAGE_MBEDTLS
+	select BR2_PACKAGE_LIBCURL
+	select BR2_PACKAGE_LIBSSH
+	select BR2_PACKAGE_LIBSSH_SERVER
+
+comment "SSH/TLS support needs a toolchain w/ threads, dynamic library"
+	depends on BR2_USE_MMU
+	depends on BR2_STATIC_LIBS || !BR2_TOOLCHAIN_HAS_THREADS
+
+endif
+
 comment "libnetconf2 needs a toolchain w/ threads, dynamic library"
 	depends on BR2_USE_MMU
 	depends on BR2_TOOLCHAIN_HAS_SYNC_4
diff --git a/package/libnetconf2/libnetconf2.hash b/package/libnetconf2/libnetconf2.hash
index 675c76a500..2d6394e81b 100644
--- a/package/libnetconf2/libnetconf2.hash
+++ b/package/libnetconf2/libnetconf2.hash
@@ -1,3 +1,3 @@
 # Locally calculated
-sha256  72e9a6461fadbd22f0cf0d23ba68d62b297c8f564f7f2bee069748fb67fc3a24  libnetconf2-2.1.28.tar.gz
+sha256  c95c00ad887295d1fa31098c859c74e330eead78b2eee8d008701af2d9df80e5  libnetconf2-3.7.1.tar.gz
 sha256  bd962ab457c8a8cb8faaaa36c11484680f3c9a47dbc336507817ae8935384064  LICENSE
diff --git a/package/libnetconf2/libnetconf2.mk b/package/libnetconf2/libnetconf2.mk
index 88163926c0..79d8419a11 100644
--- a/package/libnetconf2/libnetconf2.mk
+++ b/package/libnetconf2/libnetconf2.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-LIBNETCONF2_VERSION = 2.1.28
+LIBNETCONF2_VERSION = 3.7.1
 LIBNETCONF2_SITE = $(call github,CESNET,libnetconf2,v$(LIBNETCONF2_VERSION))
 LIBNETCONF2_INSTALL_STAGING = YES
 LIBNETCONF2_LICENSE = BSD-3-Clause
@@ -16,18 +16,16 @@ LIBNETCONF2_CONF_OPTS = \
 	-DENABLE_TESTS=OFF \
 	-DENABLE_VALGRIND_TESTS=OFF
 
-ifeq ($(BR2_PACKAGE_LIBSSH_SERVER), y)
-LIBNETCONF2_CONF_OPTS += -DENABLE_SSH=ON
-LIBNETCONF2_DEPENDENCIES += libssh
+ifeq ($(BR2_PACKAGE_LIBNETCONF2_SSH_TLS),y)
+LIBNETCONF2_CONF_OPTS += -DENABLE_SSH_TLS=ON
+LIBNETCONF2_DEPENDENCIES += libcurl libssh
+ifeq ($(BR2_PACKAGE_MBEDTLS),y)
+LIBNETCONF2_DEPENDENCIES += mbedtls
 else
-LIBNETCONF2_CONF_OPTS += -DENABLE_SSH=OFF
-endif
-
-ifeq ($(BR2_PACKAGE_LIBOPENSSL), y)
-LIBNETCONF2_CONF_OPTS += -DENABLE_TLS=ON
 LIBNETCONF2_DEPENDENCIES += openssl
+endif
 else
-LIBNETCONF2_CONF_OPTS += -DENABLE_TLS=OFF
+LIBNETCONF2_CONF_OPTS += -DENABLE_SSH_TLS=OFF
 endif
 
 ifeq ($(BR2_PACKAGE_LIBXCRYPT),y)
@@ -37,8 +35,7 @@ endif
 HOST_LIBNETCONF2_CONF_OPTS = \
 	-DENABLE_TESTS=OFF \
 	-DENABLE_VALGRIND_TESTS=OFF \
-	-DENABLE_SSH=OFF \
-	-DENABLE_TLS=OFF
+	-DENABLE_SSH_TLS=OFF
 
 $(eval $(cmake-package))
 $(eval $(host-cmake-package))
diff --git a/package/netopeer2/Config.in b/package/netopeer2/Config.in
index db31a786a1..1e4248fa91 100644
--- a/package/netopeer2/Config.in
+++ b/package/netopeer2/Config.in
@@ -6,17 +6,15 @@ comment "netopeer2 needs a toolchain w/ gcc >= 4.8, C++, threads, dynamic librar
 
 config BR2_PACKAGE_NETOPEER2
 	bool "netopeer2"
-	depends on BR2_USE_MMU # libnetconf2, libssh, sysrepo
+	depends on BR2_USE_MMU # libnetconf2, sysrepo
 	depends on BR2_TOOLCHAIN_HAS_SYNC_4 # libyang
-	depends on !BR2_STATIC_LIBS # libnetconf2, libssh, libyang, sysrepo
+	depends on !BR2_STATIC_LIBS # libnetconf2, libyang, sysrepo
 	depends on BR2_INSTALL_LIBSTDCPP # sysrepo
 	depends on BR2_TOOLCHAIN_HAS_THREADS_NPTL
 	depends on BR2_TOOLCHAIN_GCC_AT_LEAST_4_8 # sysrepo
 	select BR2_PACKAGE_LIBNETCONF2
-	select BR2_PACKAGE_LIBSSH
-	select BR2_PACKAGE_LIBSSH_SERVER # For libnetconf2 to have SSH
+	select BR2_PACKAGE_LIBNETCONF2_SSH_TLS
 	select BR2_PACKAGE_LIBYANG
-	select BR2_PACKAGE_OPENSSL # For libnetconf2 to have TLS
 	select BR2_PACKAGE_SYSREPO
 	help
 	  Netopeer2 is a set of tools implementing network configuration