--- main/tcptls.c	(Asterisk 13.27.0)
+++ main/tcptls.c	(working copy)
@@ -1053,20 +1053,25 @@
 
-	#ifndef SSL_CTRL_SET_ECDH_AUTO
-		#define SSL_CTRL_SET_ECDH_AUTO 94
-	#endif
-	/* SSL_CTX_set_ecdh_auto(cfg->ssl_ctx, on); requires OpenSSL 1.0.2 which wraps: */
-	if (SSL_CTX_ctrl(cfg->ssl_ctx, SSL_CTRL_SET_ECDH_AUTO, 1, NULL)) {
-		ast_verb(2, "TLS/SSL ECDH initialized (automatic), faster PFS ciphers enabled\n");
-#if !defined(OPENSSL_NO_ECDH) && (OPENSSL_VERSION_NUMBER >= 0x10000000L) && (OPENSSL_VERSION_NUMBER < 0x10100000L)
-	} else {
-		/* enables AES-128 ciphers, to get AES-256 use NID_secp384r1 */
-		EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
-		if (ecdh != NULL) {
-			if (SSL_CTX_set_tmp_ecdh(cfg->ssl_ctx, ecdh)) {
-				ast_verb(2, "TLS/SSL ECDH initialized (secp256r1), faster PFS cipher-suites enabled\n");
-			}
-			EC_KEY_free(ecdh);
+#if !defined(OPENSSL_NO_ECDH)
+#if OPENSSL_VERSION_NUMBER >= 0x10101000L
+	if (SSL_CTX_set1_groups_list(cfg->ssl_ctx, "X25519:P-256:P-224:X448:P-384:P-521")) {
+		ast_verb(2, "TLS/SSL ECDH initialized (x25519, secp256r1, secp224r1, x448), faster PFS cipher-suites enabled\n");
+	}
+#elif OPENSSL_VERSION_NUMBER >= 0x10100000L
+	if (SSL_CTX_set1_curves_list(cfg->ssl_ctx, "X25519:P-256:P-224:P-384:P-521")) {
+		ast_verb(2, "TLS/SSL ECDH initialized (x25519, secp256r1, secp224r1), faster PFS cipher-suites enabled\n");
+	}
+#elif OPENSSL_VERSION_NUMBER >= 0x10002000L
+	if (SSL_CTX_set1_curves_list(cfg->ssl_ctx, "P-256:P-224:P-384:P-521")) {
+		ast_verb(2, "TLS/SSL ECDH initialized (secp256r1, secp224r1), faster PFS cipher-suites enabled\n");
+	}
+#elif defined(SSL_CTRL_SET_TMP_ECDH)
+	EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
+	if (ecdh) {
+		if (SSL_CTX_set_tmp_ecdh(cfg->ssl_ctx, ecdh)) {
+			ast_verb(2, "TLS/SSL ECDH initialized (secp256r1), faster PFS cipher-suites enabled\n");
 		}
-#endif
+		EC_KEY_free(ecdh);
 	}
+#endif
+#endif