diff --git a/repos/ports/ports/lighttpd.hash b/repos/ports/ports/lighttpd.hash
index d2b797526..5ee0e9b11 100644
--- a/repos/ports/ports/lighttpd.hash
+++ b/repos/ports/ports/lighttpd.hash
@@ -1 +1 @@
-8a37ad17d931ef5960e695af206e444d58d825d8
+0665eee22a27970bb977c93abdea7e89d3011a1d
diff --git a/repos/ports/ports/lighttpd.inc b/repos/ports/ports/lighttpd.inc
index ea90bc288..1def5a27f 100644
--- a/repos/ports/ports/lighttpd.inc
+++ b/repos/ports/ports/lighttpd.inc
@@ -1,5 +1,5 @@
 LIGHTTPD_MAIN    := 1
 LIGHTTPD_MAJOR   := 4
-LIGHTTPD_MINOR   := 38
+LIGHTTPD_MINOR   := 52
 LIGHTTPD_VERSION := $(LIGHTTPD_MAIN).$(LIGHTTPD_MAJOR).$(LIGHTTPD_MINOR)
 LIGHTTPD         := lighttpd-$(LIGHTTPD_VERSION)
diff --git a/repos/ports/ports/lighttpd.port b/repos/ports/ports/lighttpd.port
index 7c97fe61e..c33df06e2 100644
--- a/repos/ports/ports/lighttpd.port
+++ b/repos/ports/ports/lighttpd.port
@@ -1,11 +1,9 @@
 LICENSE   := BSD
-VERSION   := 1.4.38
+VERSION   := 1.4.52
 DOWNLOADS := lighttpd.archive
 
 URL(lighttpd) := http://download.lighttpd.net/lighttpd/releases-1.4.x/lighttpd-$(VERSION).tar.gz
-SHA(lighttpd) := eb3c689f83ee3545dc688d99e36011b28145a1727bb6d17c94c5ed6684edcdd1
-SIG(lighttpd) := ${URL(lighttpd)}.asc
-KEY(lighttpd) := stbuehler@lighttpd.net
+SHA(lighttpd) := 0f9de0227681c078f6b8c6154b581ced5fe7bcb5ff428ccf292581764b771145
 DIR(lighttpd) := src/app/lighttpd
 
-PATCHES := src/app/lighttpd/disable_gethostbyaddr_fcntl.patch
+PATCHES := $(addprefix src/app/lighttpd/,fd_cloexec.patch stat_cache.c.patch)
diff --git a/repos/ports/run/lighttpd.run b/repos/ports/run/lighttpd.run
index 9b8cb9656..591bd3a72 100644
--- a/repos/ports/run/lighttpd.run
+++ b/repos/ports/run/lighttpd.run
@@ -113,6 +113,7 @@ append boot_modules {
 	core init timer ld.lib.so } [nic_drv_binary] {
 	libc.lib.so libm.lib.so posix.lib.so
 	vfs.lib.so vfs_lwip.lib.so zlib.lib.so
+	libcrypto.lib.so libssl.lib.so
 	lighttpd
 }
 
diff --git a/repos/ports/src/app/lighttpd/disable_gethostbyaddr_fcntl.patch b/repos/ports/src/app/lighttpd/disable_gethostbyaddr_fcntl.patch
deleted file mode 100644
index 7fdc3a96a..000000000
--- a/repos/ports/src/app/lighttpd/disable_gethostbyaddr_fcntl.patch
+++ /dev/null
@@ -1,75 +0,0 @@
-+++ src/app/lighttpd/src/fdevent_poll.c
-@@ -193,7 +193,7 @@ int fdevent_poll_init(fdevents *ev) {
- int fdevent_poll_init(fdevents *ev) {
- 	UNUSED(ev);
- 
--	log_error_write(srv, __FILE__, __LINE__,
-+	log_error_write(ev->srv, __FILE__, __LINE__,
- 		"s", "poll is not supported, try to set server.event-handler = \"select\"");
- 
- 	return -1;
-+++ src/app/lighttpd/src/http-header-glue.c
-@@ -172,6 +172,7 @@ int http_response_redirect_to_directory(server *srv, connection *con) {
- 			break;
- #endif
- 		case AF_INET:
-+#if 0
- 			if (NULL == (he = gethostbyaddr((char *)&our_addr.ipv4.sin_addr, sizeof(struct in_addr), AF_INET))) {
- 				log_error_write(srv, __FILE__, __LINE__,
- 						"SdS", "NOTICE: gethostbyaddr failed: ",
-@@ -181,6 +182,8 @@ int http_response_redirect_to_directory(server *srv, connection *con) {
- 			} else {
- 				buffer_append_string(o, he->h_name);
- 			}
-+#endif
-+			buffer_append_string(o, inet_ntoa(our_addr.ipv4.sin_addr));
- 			break;
- 		default:
- 			log_error_write(srv, __FILE__, __LINE__,
-+++ src/app/lighttpd/src/network.c
-@@ -323,6 +323,7 @@ static int network_server_init(server *srv, buffer *host_token, specific_config
- 		if (host == NULL) {
- 			srv_socket->addr.ipv4.sin_addr.s_addr = htonl(INADDR_ANY);
- 		} else {
-+#if 0
- 			struct hostent *he;
- 			if (NULL == (he = gethostbyname(host))) {
- 				log_error_write(srv, __FILE__, __LINE__,
-@@ -342,6 +343,7 @@ static int network_server_init(server *srv, buffer *host_token, specific_config
- 			}
- 
- 			memcpy(&(srv_socket->addr.ipv4.sin_addr.s_addr), he->h_addr_list[0], he->h_length);
-+#endif
- 		}
- 		srv_socket->addr.ipv4.sin_port = htons(port);
- 
-+++ src/app/lighttpd/src/fdevent.c
-@@ -201,15 +201,18 @@
- }
- 
- void fd_close_on_exec(int fd) {
-+#if 0
- #ifdef FD_CLOEXEC
- 	if (fd < 0) return;
- 	force_assert(-1 != fcntl(fd, F_SETFD, FD_CLOEXEC));
- #else
- 	UNUSED(fd);
- #endif
-+#endif
- }
- 
- int fdevent_fcntl_set(fdevents *ev, int fd) {
-+#if 0
- 	fd_close_on_exec(fd);
- 	if ((ev) && (ev->fcntl_set)) return ev->fcntl_set(ev, fd);
- #ifdef O_NONBLOCK
-@@ -217,6 +220,9 @@
- #else
- 	return 0;
- #endif
-+#else
-+	return 0;
-+#endif
- }
- 
- 
diff --git a/repos/ports/src/app/lighttpd/fd_cloexec.patch b/repos/ports/src/app/lighttpd/fd_cloexec.patch
new file mode 100644
index 000000000..95ad90dee
--- /dev/null
+++ b/repos/ports/src/app/lighttpd/fd_cloexec.patch
@@ -0,0 +1,73 @@
++++ src/app/lighttpd/src/fdevent.c
+@@ -453,7 +453,7 @@ void * fdevent_get_context(fdevents *ev, int fd) {
+ }
+ 
+ void fdevent_setfd_cloexec(int fd) {
+-#ifdef FD_CLOEXEC
++#if 0
+ 	if (fd < 0) return;
+ 	force_assert(-1 != fcntl(fd, F_SETFD, FD_CLOEXEC));
+ #else
+@@ -462,7 +462,7 @@ void fdevent_setfd_cloexec(int fd) {
+ }
+ 
+ void fdevent_clrfd_cloexec(int fd) {
+-#ifdef FD_CLOEXEC
++#if 0
+ 	if (fd >= 0) force_assert(-1 != fcntl(fd, F_SETFD, 0));
+ #else
+ 	UNUSED(fd);
+@@ -499,7 +499,7 @@ int fdevent_socket_cloexec(int domain, int type, int protocol) {
+ 		return socket(domain, type | SOCK_CLOEXEC, protocol);
+ #endif
+ 	if (-1 != (fd = socket(domain, type, protocol))) {
+-#ifdef FD_CLOEXEC
++#if 0
+ 		force_assert(-1 != fcntl(fd, F_SETFD, FD_CLOEXEC));
+ #endif
+ 	}
+@@ -513,7 +513,7 @@ int fdevent_socket_nb_cloexec(int domain, int type, int protocol) {
+ 		return socket(domain, type | SOCK_CLOEXEC | SOCK_NONBLOCK, protocol);
+ #endif
+ 	if (-1 != (fd = socket(domain, type, protocol))) {
+-#ifdef FD_CLOEXEC
++#if 0
+ 		force_assert(-1 != fcntl(fd, F_SETFD, FD_CLOEXEC));
+ #endif
+ #ifdef O_NONBLOCK
+@@ -532,7 +532,7 @@ int fdevent_open_cloexec(const char *pathname, int flags, mode_t mode) {
+ 	return open(pathname, flags | O_CLOEXEC | O_NOCTTY, mode);
+ #else
+ 	int fd = open(pathname, flags | O_NOCTTY, mode);
+-#ifdef FD_CLOEXEC
++#if 0
+ 	if (fd != -1)
+ 		force_assert(-1 != fcntl(fd, F_SETFD, FD_CLOEXEC));
+ #endif
+@@ -626,7 +626,7 @@ extern char **environ;
+ char ** fdevent_environ (void) { return environ; }
+ 
+ 
+-#ifdef FD_CLOEXEC
++#if 0
+ static int fdevent_dup2_close_clrfd_cloexec(int oldfd, int newfd) {
+     if (oldfd >= 0) {
+         if (oldfd != newfd) {
+@@ -654,7 +654,7 @@ static int fdevent_dup2_close_clrfd_cloexec(int oldfd, int newfd, int reuse) {
+ 
+ 
+ int fdevent_set_stdin_stdout_stderr(int fdin, int fdout, int fderr) {
+-  #ifdef FD_CLOEXEC
++  #if 0
+     if (STDIN_FILENO != fdevent_dup2_close_clrfd_cloexec(fdin, STDIN_FILENO))
+         return -1;
+     if (STDOUT_FILENO != fdevent_dup2_close_clrfd_cloexec(fdout, STDOUT_FILENO))
+@@ -696,7 +696,7 @@ pid_t fdevent_fork_execve(const char *name, char *argv[], char *envp[], int fdin
+     }
+ 
+     if (0 != fdevent_set_stdin_stdout_stderr(fdin, fdout, fderr)) _exit(errno);
+-  #ifdef FD_CLOEXEC
++  #if 0
+     /*(might not be sufficient for open fds, but modern OS have FD_CLOEXEC)*/
+     for (int i = 3; i < 256; ++i) close(i);
+   #endif
diff --git a/repos/ports/src/app/lighttpd/plugin-static.h b/repos/ports/src/app/lighttpd/plugin-static.h
index 6eb196623..19849420d 100644
--- a/repos/ports/src/app/lighttpd/plugin-static.h
+++ b/repos/ports/src/app/lighttpd/plugin-static.h
@@ -2,3 +2,4 @@ PLUGIN_INIT(mod_indexfile)
 PLUGIN_INIT(mod_dirlisting)
 PLUGIN_INIT(mod_staticfile)
 PLUGIN_INIT(mod_access)
+PLUGIN_INIT(mod_openssl)
diff --git a/repos/ports/src/app/lighttpd/stat_cache.c.patch b/repos/ports/src/app/lighttpd/stat_cache.c.patch
new file mode 100644
index 000000000..e66b84985
--- /dev/null
+++ b/repos/ports/src/app/lighttpd/stat_cache.c.patch
@@ -0,0 +1,10 @@
++++ src/app/lighttpd/src/stat_cache.c
+@@ -796,7 +796,7 @@
+ 	#ifndef O_NOFOLLOW
+ 	#define O_NOFOLLOW 0
+ 	#endif
+-	const int oflags = O_BINARY | O_LARGEFILE | O_NOCTTY | O_NONBLOCK
++	const int oflags = O_BINARY | O_LARGEFILE | O_NOCTTY //| O_NONBLOCK
+ 			 | (con->conf.follow_symlink ? 0 : O_NOFOLLOW);
+ 	const int fd = fdevent_open_cloexec(name->ptr, O_RDONLY | oflags, 0);
+ 	if (fd >= 0) {
diff --git a/repos/ports/src/app/lighttpd/target.inc b/repos/ports/src/app/lighttpd/target.inc
index 0d3b316a6..fc01b6bfc 100644
--- a/repos/ports/src/app/lighttpd/target.inc
+++ b/repos/ports/src/app/lighttpd/target.inc
@@ -1,6 +1,22 @@
 LIGHTTPD_DIR := $(call select_from_ports,lighttpd)/src/app/lighttpd
 
-FILTER_OUT = lempar.c lighttpd-angel.c lemon.c
+FILTER_OUT = lempar.c lighttpd-angel.c lemon.c \
+             mod_accesslog.c mod_alias.c \
+             mod_authn_file.c mod_authn_gssapi.c mod_authn_ldap.c \
+             mod_authn_mysql.c mod_authn_pam.c mod_authn_sasl.c \
+             mod_cgi.c mod_cml.c mod_cml_funcs.c mod_cml_lua.c \
+             mod_compress.c mod_deflate.c \
+             mod_evasive.c mod_evhost.c mod_expire.c mod_extforward.c \
+             mod_fastcgi.c mod_flv_streaming.c mod_geoip.c \
+             mod_magnet.c mod_magnet_cache.c mod_mysql_vhost.c \
+             mod_proxy.c mod_redirect.c mod_rewrite.c mod_rrdtool.c \
+             mod_scgi.c mod_secdownload.c mod_setenv.c mod_simple_vhost.c \
+             mod_skeleton.c mod_sockproxy.c mod_ssi.c mod_ssi_expr.c \
+             mod_ssi_exprparser.c mod_status.c \
+             mod_trigger_b4_dl.c mod_uploadprogress.c mod_userdir.c \
+             mod_usertrack.c mod_vhostdb.c mod_vhostdb_dbi.c \
+             mod_vhostdb_ldap.c mod_vhostdb_mysql.c mod_vhostdb_pgsql.c \
+             mod_webdav.c mod_wstunnel.c
 SRC_C = $(filter-out $(FILTER_OUT),$(notdir $(wildcard $(LIGHTTPD_DIR)/src/*.c)))
 
 vpath %.c $(LIGHTTPD_DIR)/src
@@ -23,6 +39,7 @@ CC_OPT += -DLIGHTTPD_VERSION_ID='($(LIGHTTPD_MAIN) << 16 | $(LIGHTTPD_MAJOR) <<
 CC_OPT += -DPACKAGE_VERSION="\"$(LIGHTTPD_MAIN).$(LIGHTTPD_MAJOR).$(LIGHTTPD_MINOR)\""
 CC_OPT += -DLIBRARY_DIR="\"/lib\""
 CC_OPT += -DLIGHTTPD_STATIC
+CC_OPT += -DHAVE_LIBSSL -DUSE_OPENSSL -DUSE_OPENSSL_CRYPTO
 
 CC_WARN = -Wall -Wno-unused-variable -Wno-unused-function
 
@@ -31,3 +48,4 @@ INC_DIR += $(LIGHTTPD_DIR)/src
 
 LIBS += posix
 LIBS += zlib
+LIBS += libcrypto libssl