diff --git a/CMakeLists.txt b/CMakeLists.txt
index 9e561d9f9..c3a3be361 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -437,7 +437,7 @@ add_option(WOLFSSL_ALPN
     "no" "yes;no")
 
 if(WOLFSSL_ALPN)
-        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ALPN" "-DHAVE_TLS_EXTENSIONS")
+    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ALPN" "-DHAVE_TLS_EXTENSIONS")
 endif()
 
 # altcertchains
@@ -2236,32 +2236,6 @@ endif()
 
 file(REMOVE ${OPTION_FILE})
 
-file(APPEND ${OPTION_FILE} "/* wolfssl options.h\n")
-file(APPEND ${OPTION_FILE} " * generated from configure options\n")
-file(APPEND ${OPTION_FILE} " *\n")
-file(APPEND ${OPTION_FILE} " * Copyright (C) 2006-2023 wolfSSL Inc.\n")
-file(APPEND ${OPTION_FILE} " *\n")
-file(APPEND ${OPTION_FILE} " * This file is part of wolfSSL. (formerly known as CyaSSL)\n")
-file(APPEND ${OPTION_FILE} " *\n")
-file(APPEND ${OPTION_FILE} " */\n\n")
-file(APPEND ${OPTION_FILE} "#ifndef WOLFSSL_OPTIONS_H\n")
-file(APPEND ${OPTION_FILE} "#define WOLFSSL_OPTIONS_H\n\n\n")
-file(APPEND ${OPTION_FILE} "#ifdef __cplusplus\n")
-file(APPEND ${OPTION_FILE} "extern \"C\" {\n")
-file(APPEND ${OPTION_FILE} "#endif\n\n")
-
-add_to_options_file("${WOLFSSL_DEFINITIONS}" "${OPTION_FILE}")
-# CMAKE_C_FLAGS is just a string of space-separated flags to pass to the C
-# compiler. We need to replace those spaces with semicolons in order to treat it
-# as a CMake list.
-string(REPLACE " " ";" CMAKE_C_FLAGS_LIST "${CMAKE_C_FLAGS}")
-add_to_options_file("${CMAKE_C_FLAGS_LIST}" "${OPTION_FILE}")
-
-file(APPEND ${OPTION_FILE} "\n#ifdef __cplusplus\n")
-file(APPEND ${OPTION_FILE} "}\n")
-file(APPEND ${OPTION_FILE} "#endif\n\n\n")
-file(APPEND ${OPTION_FILE} "#endif /* WOLFSSL_OPTIONS_H */\n\n")
-
 ####################################################
 # Library Target
 ####################################################
@@ -2339,6 +2313,19 @@ if(WOLFSSL_ARIA)
     message(STATUS "ARIA Check: WOLFSSL_LINK_LIBS    = ${WOLFSSL_LINK_LIBS}")
 endif()
 
+foreach(DEF IN LISTS WOLFSSL_DEFINITIONS)
+    string(REGEX MATCH "^(-D)?([^=]+)(=(.*))?$" DEF_MATCH ${DEF})
+    if (DEFINED CMAKE_MATCH_4)
+        set(${CMAKE_MATCH_2} ${CMAKE_MATCH_4})
+        # message("set(${CMAKE_MATCH_2} ${CMAKE_MATCH_4})")
+    else()
+        set(${CMAKE_MATCH_2} 1)
+        # message("set(${CMAKE_MATCH_2} 1)")
+    endif()
+endforeach()
+
+configure_file(${CMAKE_CURRENT_SOURCE_DIR}/wolfssl/options.h.in ${OPTION_FILE})
+
 set_target_properties(wolfssl
     PROPERTIES
         SOVERSION ${WOLFSSL_LIBRARY_VERSION_FIRST}
diff --git a/cmake/functions.cmake b/cmake/functions.cmake
index 566feff76..279f5a82e 100644
--- a/cmake/functions.cmake
+++ b/cmake/functions.cmake
@@ -918,35 +918,6 @@ function(generate_lib_src_list LIB_SOURCES)
     set(LIB_SOURCES ${LIB_SOURCES} PARENT_SCOPE)
 endfunction()
 
-function(add_to_options_file DEFINITIONS OPTION_FILE)
-    list(REMOVE_DUPLICATES DEFINITIONS)
-    foreach(DEF IN LISTS DEFINITIONS)
-        if(DEF MATCHES "^-D")
-            if(DEF MATCHES "^-D(N)?DEBUG(=.+)?")
-                message("not outputting (N)DEBUG to ${OPTION_FILE}")
-            endif()
-
-            # allow user to ignore system options
-            if(DEF MATCHES "^-D_.*")
-                file(APPEND ${OPTION_FILE} "#ifndef WOLFSSL_OPTIONS_IGNORE_SYS\n")
-            endif()
-
-            string(REGEX REPLACE "^-D" "" DEF_NO_PREFIX ${DEF})
-            string(REGEX REPLACE "=.*$" "" DEF_NO_EQUAL_NO_VAL ${DEF_NO_PREFIX})
-            string(REPLACE "=" " " DEF_NO_EQUAL ${DEF_NO_PREFIX})
-
-            file(APPEND ${OPTION_FILE} "#undef  ${DEF_NO_EQUAL_NO_VAL}\n")
-            file(APPEND ${OPTION_FILE} "#define ${DEF_NO_EQUAL}\n")
-
-            if(DEF MATCHES "^-D_.*")
-                file(APPEND ${OPTION_FILE} "#endif\n")
-            endif()
-
-            file(APPEND ${OPTION_FILE} "\n")
-        endif()
-    endforeach()
-endfunction()
-
 # Function: set_wolfssl_definitions
 #   Parameter: SEARCH_VALUE  The string to search for. (e.g. "WOLFSSL_SHA3")
 #   Returns:   RESULT
diff --git a/wolfssl/options.h.in b/wolfssl/options.h.in
index 5296ed158..88672319e 100644
--- a/wolfssl/options.h.in
+++ b/wolfssl/options.h.in
@@ -30,6 +30,342 @@
 extern "C" {
 #endif
 
+#ifndef WOLFSSL_OPTIONS_IGNORE_SYS
+#undef _GNU_SOURCE
+#cmakedefine _GNU_SOURCE
+#undef _POSIX_THREADS
+#cmakedefine _POSIX_THREADS
+#endif
+#undef ASIO_USE_WOLFSSL
+#cmakedefine ASIO_USE_WOLFSSL
+#undef BOOST_ASIO_USE_WOLFSSL
+#cmakedefine BOOST_ASIO_USE_WOLFSSL
+#undef CURVE25519_SMALL
+#cmakedefine CURVE25519_SMALL
+#undef CURVE448_SMALL
+#cmakedefine CURVE448_SMALL
+#undef DEBUG
+#cmakedefine DEBUG
+#undef DEBUG_WOLFSSL
+#cmakedefine DEBUG_WOLFSSL
+#undef ECC_SHAMIR
+#cmakedefine ECC_SHAMIR
+#undef ECC_TIMING_RESISTANT
+#cmakedefine ECC_TIMING_RESISTANT
+#undef ED25519_SMALL
+#cmakedefine ED25519_SMALL
+#undef ED448_SMALL
+#cmakedefine ED448_SMALL
+#undef GCM_SMALL
+#cmakedefine GCM_SMALL
+#undef GCM_TABLE
+#cmakedefine GCM_TABLE
+#undef GCM_TABLE_4BIT
+#cmakedefine GCM_TABLE_4BIT
+#undef GCM_WORD32
+#cmakedefine GCM_WORD32
+#undef HAVE___UINT128_T
+#cmakedefine HAVE___UINT128_T
+#undef HAVE_AES_KEYWRAP
+#cmakedefine HAVE_AES_KEYWRAP
+#undef HAVE_AESCCM
+#cmakedefine HAVE_AESCCM
+#undef HAVE_AESGCM
+#cmakedefine HAVE_AESGCM
+#undef HAVE_ALPN
+#cmakedefine HAVE_ALPN
+#undef HAVE_ARIA
+#cmakedefine HAVE_ARIA
+#undef HAVE_CERTIFICATE_STATUS_REQUEST
+#cmakedefine HAVE_CERTIFICATE_STATUS_REQUEST
+#undef HAVE_CERTIFICATE_STATUS_REQUEST_V2
+#cmakedefine HAVE_CERTIFICATE_STATUS_REQUEST_V2
+#undef HAVE_CHACHA
+#cmakedefine HAVE_CHACHA
+#undef HAVE_CRL
+#cmakedefine HAVE_CRL
+#undef HAVE_CRL_IO
+#cmakedefine HAVE_CRL_IO
+#undef HAVE_CURVE25519
+#cmakedefine HAVE_CURVE25519
+#undef HAVE_CURVE448
+#cmakedefine HAVE_CURVE448
+#undef HAVE_DH_DEFAULT_PARAMS
+#cmakedefine HAVE_DH_DEFAULT_PARAMS
+#undef HAVE_ECC
+#cmakedefine HAVE_ECC
+#undef HAVE_ECH
+#cmakedefine HAVE_ECH
+#undef HAVE_ED25519
+#cmakedefine HAVE_ED25519
+#undef HAVE_ED448
+#cmakedefine HAVE_ED448
+#undef HAVE_ENCRYPT_THEN_MAC
+#cmakedefine HAVE_ENCRYPT_THEN_MAC
+#undef HAVE_EX_DATA
+#cmakedefine HAVE_EX_DATA
+#undef HAVE_EXTENDED_MASTER
+#cmakedefine HAVE_EXTENDED_MASTER
+#undef HAVE_FFDHE_2048
+#cmakedefine HAVE_FFDHE_2048
+#undef HAVE_HASHDRBG
+#cmakedefine HAVE_HASHDRBG
+#undef HAVE_HKDF
+#cmakedefine HAVE_HKDF
+#undef HAVE_HPKE
+#cmakedefine HAVE_HPKE
+#undef HAVE_KEYING_MATERIAL
+#cmakedefine HAVE_KEYING_MATERIAL
+#undef HAVE_LIBOQS
+#cmakedefine HAVE_LIBOQS
+#undef HAVE_MAX_FRAGMENT
+#cmakedefine HAVE_MAX_FRAGMENT
+#undef HAVE_OCSP
+#cmakedefine HAVE_OCSP
+#undef HAVE_ONE_TIME_AUTH
+#cmakedefine HAVE_ONE_TIME_AUTH
+#undef HAVE_PKCS7
+#cmakedefine HAVE_PKCS7
+#undef HAVE_POLY1305
+#cmakedefine HAVE_POLY1305
+#undef HAVE_PTHREAD
+#cmakedefine HAVE_PTHREAD
+#undef HAVE_REPRODUCIBLE_BUILD
+#cmakedefine HAVE_REPRODUCIBLE_BUILD
+#undef HAVE_SESSION_TICKET
+#cmakedefine HAVE_SESSION_TICKET
+#undef HAVE_SNI
+#cmakedefine HAVE_SNI
+#undef HAVE_SUPPORTED_CURVES
+#cmakedefine HAVE_SUPPORTED_CURVES
+#undef HAVE_THREAD_LS
+#cmakedefine HAVE_THREAD_LS
+#undef HAVE_TLS_EXTENSIONS
+#cmakedefine HAVE_TLS_EXTENSIONS
+#undef HAVE_TRUNCATED_HMAC
+#cmakedefine HAVE_TRUNCATED_HMAC
+#undef HAVE_TRUSTED_CA
+#cmakedefine HAVE_TRUSTED_CA
+#undef HAVE_X963_KDF
+#cmakedefine HAVE_X963_KDF
+#undef NO_AES
+#cmakedefine NO_AES
+#undef NO_AES_CBC
+#cmakedefine NO_AES_CBC
+#undef NO_ASN
+#cmakedefine NO_ASN
+#undef NO_ASN_CRYPT
+#cmakedefine NO_ASN_CRYPT
+#undef NO_BIG_INT
+#cmakedefine NO_BIG_INT
+#undef NO_CERTS
+#cmakedefine NO_CERTS
+#undef NO_CHACHA_ASM
+#cmakedefine NO_CHACHA_ASM
+#undef NO_CODING
+#cmakedefine NO_CODING
+#undef NO_CURVED25519_128BIT
+#cmakedefine NO_CURVED25519_128BIT
+#undef NO_CURVED448_128BIT
+#cmakedefine NO_CURVED448_128BIT
+#undef NO_DES3
+#cmakedefine NO_DES3
+#undef NO_DH
+#cmakedefine NO_DH
+#undef NO_DSA
+#cmakedefine NO_DSA
+#undef NO_ERROR_QUEUE
+#cmakedefine NO_ERROR_QUEUE
+#undef NO_ERROR_STRINGS
+#cmakedefine NO_ERROR_STRINGS
+#undef NO_FILESYSTEM
+#cmakedefine NO_FILESYSTEM
+#undef NO_INLINE
+#cmakedefine NO_INLINE
+#undef NO_MD4
+#cmakedefine NO_MD4
+#undef NO_MD5
+#cmakedefine NO_MD5
+#undef NO_OLD_RNGNAME
+#cmakedefine NO_OLD_RNGNAME
+#undef NO_OLD_SHA_NAMES
+#cmakedefine NO_OLD_SHA_NAMES
+#undef NO_OLD_SSL_NAMES
+#cmakedefine NO_OLD_SSL_NAMES
+#undef NO_OLD_TLS
+#cmakedefine NO_OLD_TLS
+#undef NO_OLD_WC_NAMES
+#cmakedefine NO_OLD_WC_NAMES
+#undef NO_PKCS12
+#cmakedefine NO_PKCS12
+#undef NO_PSK
+#cmakedefine NO_PSK
+#undef NO_PWDBASED
+#cmakedefine NO_PWDBASED
+#undef NO_RC4
+#cmakedefine NO_RC4
+#undef NO_RSA
+#cmakedefine NO_RSA
+#undef NO_SESSION_CACHE_REF
+#cmakedefine NO_SESSION_CACHE_REF
+#undef NO_SHA
+#cmakedefine NO_SHA
+#undef NO_WOLFSSL_MEMORY
+#cmakedefine NO_WOLFSSL_MEMORY
+#undef OPENSSL_ALL
+#cmakedefine OPENSSL_ALL
+#undef OPENSSL_EXTRA
+#cmakedefine OPENSSL_EXTRA
+#undef OPENSSL_NO_SSL2
+#cmakedefine OPENSSL_NO_SSL2
+#undef OPENSSL_NO_SSL3
+#cmakedefine OPENSSL_NO_SSL3
+#undef SSL_TXT_TLSV1_2
+#cmakedefine SSL_TXT_TLSV1_2
+#undef TFM_ECC256
+#cmakedefine TFM_ECC256
+#undef TFM_NO_ASM
+#cmakedefine TFM_NO_ASM
+#undef TFM_TIMING_RESISTANT
+#cmakedefine TFM_TIMING_RESISTANT
+#undef USE_FAST_MATH
+#cmakedefine USE_FAST_MATH
+#undef WC_16BIT_CPU
+#cmakedefine WC_16BIT_CPU
+#undef WC_ECC_NONBLOCK
+#cmakedefine WC_ECC_NONBLOCK
+#undef WC_NO_ASYNC_THREADING
+#cmakedefine WC_NO_ASYNC_THREADING
+#undef WC_NO_HARDEN
+#cmakedefine WC_NO_HARDEN
+#undef WC_NO_HASHDRBG
+#cmakedefine WC_NO_HASHDRBG
+#undef WC_NO_RNG
+#cmakedefine WC_NO_RNG
+#undef WC_NO_RSA_OAEP
+#cmakedefine WC_NO_RSA_OAEP
+#undef WC_RSA_BLINDING
+#cmakedefine WC_RSA_BLINDING
+#undef WC_RSA_NO_PADDING
+#cmakedefine WC_RSA_NO_PADDING
+#undef WC_RSA_PSS
+#cmakedefine WC_RSA_PSS
+#undef WOLF_CRYPTO_CB
+#cmakedefine WOLF_CRYPTO_CB
+#undef WOLFSSL_AARCH64_BUILD
+#cmakedefine WOLFSSL_AARCH64_BUILD
+#undef WOLFSSL_AES_CFB
+#cmakedefine WOLFSSL_AES_CFB
+#undef WOLFSSL_AES_COUNTER
+#cmakedefine WOLFSSL_AES_COUNTER
+#undef WOLFSSL_AES_DIRECT
+#cmakedefine WOLFSSL_AES_DIRECT
+#undef WOLFSSL_AES_OFB
+#cmakedefine WOLFSSL_AES_OFB
+#undef WOLFSSL_AES_SIV
+#cmakedefine WOLFSSL_AES_SIV
+#undef WOLFSSL_ALT_CERT_CHAINS
+#cmakedefine WOLFSSL_ALT_CERT_CHAINS
+#undef WOLFSSL_APPLE_NATIVE_CERT_VALIDATION
+#cmakedefine WOLFSSL_APPLE_NATIVE_CERT_VALIDATION
+#undef WOLFSSL_ASIO
+#cmakedefine WOLFSSL_ASIO
+#undef WOLFSSL_BASE64_ENCODE
+#cmakedefine WOLFSSL_BASE64_ENCODE
+#undef WOLFSSL_CAAM
+#cmakedefine WOLFSSL_CAAM
+#undef WOLFSSL_CERT_EXT
+#cmakedefine WOLFSSL_CERT_EXT
+#undef WOLFSSL_CERT_GEN
+#cmakedefine WOLFSSL_CERT_GEN
+#undef WOLFSSL_CERT_GEN_CACHE
+#cmakedefine WOLFSSL_CERT_GEN_CACHE
+#undef WOLFSSL_CERT_NAME_ALL
+#cmakedefine WOLFSSL_CERT_NAME_ALL
+#undef WOLFSSL_CERT_REQ
+#cmakedefine WOLFSSL_CERT_REQ
+#undef WOLFSSL_CMAC
+#cmakedefine WOLFSSL_CMAC
+#undef WOLFSSL_DES_ECB
+#cmakedefine WOLFSSL_DES_ECB
+#undef WOLFSSL_DH_CONST
+#cmakedefine WOLFSSL_DH_CONST
+#undef WOLFSSL_DTLS
+#cmakedefine WOLFSSL_DTLS
+#undef WOLFSSL_DTLS_CID
+#cmakedefine WOLFSSL_DTLS_CID
+#undef WOLFSSL_DTLS13
+#cmakedefine WOLFSSL_DTLS13
+#undef WOLFSSL_EITHER_SIDE
+#cmakedefine WOLFSSL_EITHER_SIDE
+#undef WOLFSSL_ENCRYPTED_KEYS
+#cmakedefine WOLFSSL_ENCRYPTED_KEYS
+#undef WOLFSSL_ERROR_CODE_OPENSSL
+#cmakedefine WOLFSSL_ERROR_CODE_OPENSSL
+#undef WOLFSSL_IP_ALT_NAME
+#cmakedefine WOLFSSL_IP_ALT_NAME
+#undef WOLFSSL_KEY_GEN
+#cmakedefine WOLFSSL_KEY_GEN
+#undef WOLFSSL_NO_ASM
+#cmakedefine WOLFSSL_NO_ASM
+#undef WOLFSSL_NO_SHAKE128
+#cmakedefine WOLFSSL_NO_SHAKE128
+#undef WOLFSSL_NO_SHAKE256
+#cmakedefine WOLFSSL_NO_SHAKE256
+#undef WOLFSSL_NO_TLS12
+#cmakedefine WOLFSSL_NO_TLS12
+#undef WOLFSSL_POST_HANDSHAKE_AUTH
+#cmakedefine WOLFSSL_POST_HANDSHAKE_AUTH
+#undef WOLFSSL_PSS_LONG_SALT
+#cmakedefine WOLFSSL_PSS_LONG_SALT
+#undef WOLFSSL_PUBLIC_MP
+#cmakedefine WOLFSSL_PUBLIC_MP
+#undef WOLFSSL_QUIC
+#cmakedefine WOLFSSL_QUIC
+#undef WOLFSSL_SEND_HRR_COOKIE
+#cmakedefine WOLFSSL_SEND_HRR_COOKIE
+#undef WOLFSSL_SHA224
+#cmakedefine WOLFSSL_SHA224
+#undef WOLFSSL_SHA3
+#cmakedefine WOLFSSL_SHA3
+#undef WOLFSSL_SHA3_SMALL
+#cmakedefine WOLFSSL_SHA3_SMALL
+#undef WOLFSSL_SHA384
+#cmakedefine WOLFSSL_SHA384
+#undef WOLFSSL_SHA512
+#cmakedefine WOLFSSL_SHA512
+#undef WOLFSSL_SHAKE128
+#cmakedefine WOLFSSL_SHAKE128
+#undef WOLFSSL_SHAKE256
+#cmakedefine WOLFSSL_SHAKE256
+#undef WOLFSSL_SRTP
+#cmakedefine WOLFSSL_SRTP
+#undef WOLFSSL_SYS_CA_CERTS
+#cmakedefine WOLFSSL_SYS_CA_CERTS
+#undef WOLFSSL_TICKET_HAVE_ID
+#cmakedefine WOLFSSL_TICKET_HAVE_ID
+#undef WOLFSSL_TICKET_NONCE_MALLOC
+#cmakedefine WOLFSSL_TICKET_NONCE_MALLOC
+#undef WOLFSSL_TLS13
+#cmakedefine WOLFSSL_TLS13
+#undef WOLFSSL_USE_ALIGN
+#cmakedefine WOLFSSL_USE_ALIGN
+#undef WOLFSSL_USER_SETTINGS_ASM
+#cmakedefine WOLFSSL_USER_SETTINGS_ASM
+#undef WOLFSSL_W64_WRAPPER
+#cmakedefine WOLFSSL_W64_WRAPPER
+#undef WOLFSSL_WOLFSSH
+#cmakedefine WOLFSSL_WOLFSSH
+#undef WOLFSSL_X86_64_BUILD
+#cmakedefine WOLFSSL_X86_64_BUILD
+#undef NO_DES3_TLS_SUITES
+#cmakedefine NO_DES3_TLS_SUITES
+#undef WOLFSSL_EXPERIMENTAL_SETTINGS
+#cmakedefine WOLFSSL_EXPERIMENTAL_SETTINGS
+#undef WOLFSSL_HAVE_KYBER
+#cmakedefine WOLFSSL_HAVE_KYBER
+#undef WOLFSSL_WC_KYBER
+#cmakedefine WOLFSSL_WC_KYBER
 
 #ifdef __cplusplus
 }