how does one make packages link against openssl from pkgsrc?

[Harry Waddell <waddell%caravan-epub.com@localhost>]

I have a system that I currently can't upgrade, but I need 
nginx to use tls 1.1 or higher, so nginx must link with the newer 
openssl libs from pkgsrc. 

Using the latest stable pkgsrc:
----
The following variables will affect the build process of this package,
nginx-1.4.4.  Their current value is shown below:

        * NGINX_DATADIR = /var/db/nginx
        * NGINX_LOGDIR = /var/log/nginx
        * NGINX_PIDDIR = /var/run
        * SSLBASE = /usr
        * SSLCERTS = /etc/openssl/certs
        * SSLDIR = /etc/openssl
        * SSLKEYS = /etc/openssl/private
        * VARBASE = /var
-----

options.mk does include 

-----
.if !empty(PKG_OPTIONS:Mssl)
.include "../../security/openssl/buildlink3.mk"
CONFIGURE_ARGS+=        --with-mail_ssl_module
CONFIGURE_ARGS+=        --with-http_ssl_module
.endif
------

but somewhere in the makefile magic, it always decides to link with the 
systems libssl instead. 

On my latest netbsd 6.1.2 systems this isn't an issue as much since they have a 
newer openssl 
lib already, but for older systems, is there something I can do to get them to 
link packages 
against the openssl from pkgsrc? I couldn't find anything similar to what we do 
with X11 in 
doc/pkgsrc.txt or find anything obvious in the output of "make -d A configure", 
so 
I'm hoping someone on the list can point me in the right direction. It would be 
preferable for the 
correct -R flag to get passed in the build rather than me trying to hint ld.so 
at run time, etc... 

Thanks, 

Harry Waddell