diff --git a/.gitmodules b/.gitmodules
index de1f943..1e6165f 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -2,3 +2,6 @@
 	path = libcli
 	url = forgejo@lohic.dev:loic/libcli.git
 
+[submodule "libft_ssl"]
+	path = libft_ssl
+	url = forgejo@lohic.dev:loic/libft_ssl.git
diff --git a/Makefile.am b/Makefile.am
index a267dd6..18d2b35 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1,7 +1,11 @@
 ACLOCAL_AMFLAGS = -I m4
 
-if BUILD_BUNDLED_LIBCLI
-SUBDIRS = libcli src
-else
 SUBDIRS = src
+
+if BUILD_BUNDLED_LIBCLI
+SUBDIRS += libcli
+endif
+
+if BUILD_BUNDLED_LIBFT_SSL
+SUBDIRS += libft_ssl
 endif
diff --git a/configure.ac b/configure.ac
index cfaf55d..82ebb4b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -5,9 +5,21 @@ AC_CONFIG_MACRO_DIRS([m4])
 AM_INIT_AUTOMAKE([foreign -Wall -Werror subdir-objects])
 
 AC_PROG_CC
-if test "x$ac_cv_env_CFLAGS_set" != "xset"; then
-	CFLAGS="-O2"
+# Compiler: prefer clang
+AC_PROG_CC
+if test "x$GCC" = "xyes" && test "x$CC" = "xgcc"; then
+	AC_CHECK_PROG([CLANG], [clang], [clang])
+	if test -n "$CLANG"; then
+		CC="clang"
+		AC_MSG_NOTICE([Using clang])
+	fi
 fi
+if test "x$ac_cv_env_CFLAGS_set" != "xset"; then
+	CFLAGS=""
+fi
+
+STRICT_CFLAGS="-Wall -Wextra -Werror -pipe -Wpedantic -Wconversion -Wshadow -Wvla"
+AC_SUBST([STRICT_CFLAGS])
 
 AM_PROG_AR
 
@@ -16,6 +28,22 @@ LT_INIT
 
 PKG_PROG_PKG_CONFIG
 
+# --enable-debug
+AC_ARG_ENABLE(
+			  [debug],
+			  [AS_HELP_STRING([--enable-debug], [Enable debug build: -g -O0 (default: no)])],
+			  [enable_debug=$enableval],
+			  [enable_debug=no]
+			  )
+AM_CONDITIONAL([ENABLE_DEBUG], [test "x$enable_debug" = "xyes"])
+AS_IF([test "x$enable_debug" = "xyes"],
+	  [CFLAGS="-g -O0"],
+	  [CFLAGS="-O2"],
+	  )
+
+AC_SUBST([DEBUG_CFLAGS])
+
+
 AC_ARG_WITH([bundled-libcli],
 			AS_HELP_STRING(
 						   [--with-bundled-libcli],
@@ -41,6 +69,39 @@ AS_IF([test "x$have_system_libcli" != "xyes"], [
 	   AC_CONFIG_SUBDIRS([libcli])
 	   ])
 
+
+///
+
+AC_ARG_WITH([bundled-libft_ssl],
+			AS_HELP_STRING(
+						   [--with-bundled-libft_ssl],
+						   [force using bundled ./libft_ssl (ignore system)]),
+						   [],
+						   [with_bundled_libft_ssl=no])
+
+have_system_libft_ssl=no
+AS_IF([test "x$with_bundled_libft_ssl" != "xyes"], [
+	   PKG_CHECK_MODULES([LIBFT_SSL], [libft_ssl >= 0.1.0],
+						 [have_system_libft_ssl=yes],
+						 [have_system_libft_ssl=no]
+						 )
+	   ])
+
+AM_CONDITIONAL([USE_SYSTEM_LIBFT_SSL], [test "x$have_system_libft_ssl" = "xyes"])
+AM_CONDITIONAL([BUILD_BUNDLED_LIBFT_SSL], [test "x$have_system_libft_ssl" != "xyes"])
+
+AC_SUBST([LIBFT_SSL_CFLAGS])
+AC_SUBST([LIBFT_SSL_LIBS])
+
+AS_IF([test "x$have_system_libft_ssl" != "xyes"], [
+	   AC_CONFIG_SUBDIRS([libft_ssl])
+	   ])
+
+
+
+////
+
+
 AC_CONFIG_FILES([
 				 Makefile
 				 src/Makefile
@@ -51,8 +112,9 @@ AC_MSG_NOTICE([
 
   ft_ssl $VERSION
   ---------------
-  prefix : $prefix
-  CC     : $CC
-  CFLAGS : $CFLAGS
-  libcli : system=$have_system_libcli (forced bundled=$with_bundled_libcli)
+  prefix    : $prefix
+  CC        : $CC
+  CFLAGS    : $STRICT_CFLAGS $CFLAGS
+  libcli    : system=$have_system_libcli (forced bundled=$with_bundled_libcli)
+  libft_ssl : system=$have_system_libft_ssl (forced bundled=$with_bundled_libft_ssl)
 ])
diff --git a/libft_ssl b/libft_ssl
new file mode 160000
index 0000000..303a1a6
--- /dev/null
+++ b/libft_ssl
@@ -0,0 +1 @@
+Subproject commit 303a1a67eda567c80eb24bb360237ddb3b970d27
diff --git a/src/Makefile.am b/src/Makefile.am
index df10d25..2c22450 100644
--- a/src/Makefile.am
+++ b/src/Makefile.am
@@ -1,8 +1,8 @@
-bin_PROGRAMS = ft_ssl
+bin_PROGRAMS				= ft_ssl
 
-FT_SSL_VERSION = 0.0.1
-BUILT_SOURCES = $(VERSION_HEADER)
-VERSION_HEADER = $(top_srcdir)/includes/version_gen.h
+FT_SSL_VERSION				= 0.0.1
+BUILT_SOURCES				= $(VERSION_HEADER)
+VERSION_HEADER				= $(top_srcdir)/includes/version_gen.h
 
 $(VERSION_HEADER): FORCE
 	@NEW_HEADER=$$(mktemp); \
@@ -11,7 +11,7 @@ $(VERSION_HEADER): FORCE
 		|| date -u '+%Y-%m-%d %H:%M:%S'); \
 	FT_SSL_GIT_COMMIT=$$(git -C $(top_srcdir) rev-parse --short HEAD 2>/dev/null \
 		|| echo "nogit"); \
-	if test "$$FT_SSL_GIT_COMMIT" = "nogit"; then \
+	if test "$$FT_SSL_GIT_COMMIT"				= "nogit"; then \
 		HAS_GIT=0; \
 	else \
 		HAS_GIT=1; \
@@ -37,21 +37,29 @@ $(VERSION_HEADER): FORCE
 FORCE:
 .PHONY: FORCE
 
-ft_ssl_SOURCES = \
-		main.c
+ft_ssl_SOURCES				= \
+							  main.c
 
-ft_ssl_CPPFLAGS = \
-		-I $(top_srcdir)/includes \
-		-D_GNU_SOURCE
+ft_ssl_CPPFLAGS				= \
+							  -I $(top_srcdir)/includes \
+							  -D_GNU_SOURCE
 
-BASE_CFLAGS = -std=c99 $(STRICT_CFLAGS)
+BASE_CFLAGS					= -std=c99 $(STRICT_CFLAGS)
 
-ft_ssl_LDADD = -lm
+ft_ssl_LDADD				= -lm
 
 if USE_SYSTEM_LIBCLI
-ft_ssl_CPPFLAGS += $(LIBCLI_CFLAGS)
-ft_ssl_LDADD += $(LIBCLI_LIBS)
+ft_ssl_CPPFLAGS				+= $(LIBCLI_CFLAGS)
+ft_ssl_LDADD				+= $(LIBCLI_LIBS)
 else
-ft_ssl_CPPFLAGS += -I $(top_srcdir)/libcli/include
-
+ft_ssl_CPPFLAGS				+= -I $(top_srcdir)/libcli/include
 endif
+
+
+if USE_SYSTEM_LIBFT_SSL
+ft_ssl_CPPFLAGS				+= $(LIBFT_SSL_CFLAGS)
+ft_ssl_LDADD				+= $(LIBFT_SSL_LIBS)
+else
+ft_ssl_CPPFLAGS				+= -I $(top_srcdir)/libft_ssl/include
+endif
+