diff --git a/sample/https-client.c b/sample/https-client.c
index a5f511f251..339f1de028 100644
--- a/sample/https-client.c
+++ b/sample/https-client.c
@@ -274,7 +274,7 @@ main(int argc, char **argv)
 	int timeout = -1;
 
 #ifdef USE_MBEDTLS
-	mbedtls_ssl_context ssl;
+	mbedtls_dyncontext* ssl = NULL;
 	mbedtls_ssl_config config;
 	mbedtls_ctr_drbg_context ctr_drbg;
 	mbedtls_entropy_context entropy;
@@ -297,7 +297,6 @@ main(int argc, char **argv)
 	mbedtls_ctr_drbg_init(&ctr_drbg);
 	mbedtls_entropy_init(&entropy);
 	mbedtls_ssl_config_init(&config);
-	mbedtls_ssl_init(&ssl);
 #else
 	enum { HTTP, HTTPS } type = HTTP;
 #endif
@@ -428,7 +427,7 @@ main(int argc, char **argv)
 		mbedtls_ssl_conf_ca_chain(&config, &cacert, NULL);
 	}
 
-	mbedtls_ssl_setup(&ssl, &config);
+	ssl = bufferevent_mbedtls_dyncontext_new(&config);
 #else
 #if (OPENSSL_VERSION_NUMBER < 0x10100000L) || \
 	(defined(LIBRESSL_VERSION_NUMBER) && LIBRESSL_VERSION_NUMBER < 0x20700000L)
@@ -510,7 +509,7 @@ main(int argc, char **argv)
 	}
 
 #ifdef USE_MBEDTLS
-	mbedtls_ssl_set_hostname(&ssl, host);
+	mbedtls_ssl_set_hostname(ssl, host);
 #else
 	// Create OpenSSL bufferevent and stack evhttp on top of it
 	ssl = SSL_new(ssl_ctx);
@@ -528,16 +527,15 @@ main(int argc, char **argv)
 	if (strcasecmp(scheme, "http") == 0) {
 		bev = bufferevent_socket_new(base, -1, BEV_OPT_CLOSE_ON_FREE);
 	} else {
-#ifdef USE_MBEDTLS
-		bev = bufferevent_mbedtls_socket_new(base, -1, &ssl,
-											 BUFFEREVENT_SSL_CONNECTING,
-											 BEV_OPT_CLOSE_ON_FREE|BEV_OPT_DEFER_CALLBACKS);
-#else
+#ifndef USE_MBEDTLS
 		type = HTTPS;
-		bev = bufferevent_openssl_socket_new(base, -1, ssl,
+		bev = bufferevent_openssl_socket_new(
+#else
+		bev = bufferevent_mbedtls_socket_new(
+#endif
+			base, -1, ssl,
 			BUFFEREVENT_SSL_CONNECTING,
 			BEV_OPT_CLOSE_ON_FREE|BEV_OPT_DEFER_CALLBACKS);
-#endif
 	}
 
 	if (bev == NULL) {
@@ -639,7 +637,6 @@ main(int argc, char **argv)
 		event_base_free(base);
 
 #ifdef USE_MBEDTLS
-	mbedtls_ssl_free(&ssl);
 	mbedtls_ssl_config_free(&config);
 	mbedtls_ctr_drbg_free(&ctr_drbg);
 	mbedtls_x509_crt_free(&cacert);
diff --git a/sample/ssl-client-mbedtls.c b/sample/ssl-client-mbedtls.c
index a17c517912..4848ca8f2d 100644
--- a/sample/ssl-client-mbedtls.c
+++ b/sample/ssl-client-mbedtls.c
@@ -146,7 +146,7 @@ main(void)
 
 	mbedtls_entropy_context entropy;
 	mbedtls_ctr_drbg_context ctr_drbg;
-	mbedtls_ssl_context ssl;
+	mbedtls_dyncontext* ssl;
 	mbedtls_ssl_config conf;
 	mbedtls_x509_crt cacert;
 
@@ -175,7 +175,6 @@ main(void)
 	 * 0. Initialize the RNG and the session data
 	 */
 	mbedtls_net_init(&server_fd);
-	mbedtls_ssl_init(&ssl);
 	mbedtls_ssl_config_init(&conf);
 	mbedtls_x509_crt_init(&cacert);
 	mbedtls_ctr_drbg_init(&ctr_drbg);
@@ -244,12 +243,9 @@ main(void)
 	mbedtls_ssl_conf_rng(&conf, mbedtls_ctr_drbg_random, &ctr_drbg);
 	mbedtls_ssl_conf_dbg(&conf, my_debug, stdout);
 
-	if ((ret = mbedtls_ssl_setup(&ssl, &conf)) != 0) {
-		mbedtls_printf(" failed\n  ! mbedtls_ssl_setup returned %d\n\n", ret);
-		goto exit;
-	}
+	ssl = bufferevent_mbedtls_dyncontext_new(&conf);
 
-	if ((ret = mbedtls_ssl_set_hostname(&ssl, SERVER_NAME)) != 0) {
+	if ((ret = mbedtls_ssl_set_hostname(ssl, SERVER_NAME)) != 0) {
 		mbedtls_printf(
 			" failed\n  ! mbedtls_ssl_set_hostname returned %d\n\n", ret);
 		goto exit;
@@ -265,7 +261,7 @@ main(void)
 
 	bev = bufferevent_socket_new(evbase, server_fd.fd, BEV_OPT_CLOSE_ON_FREE);
 	bevf = bufferevent_mbedtls_filter_new(
-		evbase, bev, &ssl, BUFFEREVENT_SSL_CONNECTING, BEV_OPT_CLOSE_ON_FREE);
+		evbase, bev, ssl, BUFFEREVENT_SSL_CONNECTING, BEV_OPT_CLOSE_ON_FREE);
 	bev = bevf;
 	bufferevent_setcb(bev, readcb, writecb, eventcb, NULL);
 
@@ -289,7 +285,6 @@ main(void)
 	mbedtls_net_free(&server_fd);
 
 	mbedtls_x509_crt_free(&cacert);
-	mbedtls_ssl_free(&ssl);
 	mbedtls_ssl_config_free(&conf);
 	mbedtls_ctr_drbg_free(&ctr_drbg);
 	mbedtls_entropy_free(&entropy);
diff --git a/test-export/test-export.c b/test-export/test-export.c
index 3dbeadb55b..c37f0d9d39 100644
--- a/test-export/test-export.c
+++ b/test-export/test-export.c
@@ -99,7 +99,7 @@ test()
 {
 	struct event_base *base = NULL;
 	mbedtls_ssl_config *conf = NULL;
-	mbedtls_ssl_context *ssl = NULL;
+	mbedtls_dyncontext *ssl = NULL;
 	struct bufferevent *bev;
 	int r = 1;
 
@@ -114,12 +114,7 @@ test()
 	}
 	mbedtls_ssl_config_init(conf);
 
-	ssl = malloc(sizeof(*ssl));
-	if (!ssl) {
-		goto error;
-	}
-	mbedtls_ssl_init(ssl);
-	mbedtls_ssl_setup(ssl, conf);
+	ssl = bufferevent_mbedtls_dyncontext_new(conf);
 
 	bev = bufferevent_mbedtls_socket_new(base, -1, ssl,
 		BUFFEREVENT_SSL_CONNECTING,
@@ -132,8 +127,7 @@ test()
 	if (base)
 		event_base_free(base);
 	if (ssl) {
-		mbedtls_ssl_free(ssl);
-		free(ssl);
+		bufferevent_mbedtls_dyncontext_free(ssl);
 	}
 	if (conf) {
 		mbedtls_ssl_config_free(conf);