diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
index b5b8afed45..e326a00571 100644
--- a/.wolfssl_known_macro_extras
+++ b/.wolfssl_known_macro_extras
@@ -199,6 +199,8 @@ CONFIG_WOLFSSL_APPLE_HOMEKIT
 CONFIG_WOLFSSL_ASN_ALLOW_0_SERIAL
 CONFIG_WOLFSSL_CERTIFICATE_BUNDLE
 CONFIG_WOLFSSL_CERTIFICATE_BUNDLE_DEFAULT_NONE
+CONFIG_WOLFSSL_CERT_EXT
+CONFIG_WOLFSSL_CERT_GEN
 CONFIG_WOLFSSL_CHACHA_POLY
 CONFIG_WOLFSSL_CRYPTO_CB
 CONFIG_WOLFSSL_CRYPTO_ONLY
@@ -249,6 +251,7 @@ CONFIG_WOLFSSL_TARGET_HOST
 CONFIG_WOLFSSL_TARGET_PORT
 CONFIG_WOLFSSL_TLS_VERSION_1_2
 CONFIG_WOLFSSL_TLS_VERSION_1_3
+CONFIG_WOLFSSL_USER_IO
 CONFIG_WOLFSSL_XMSS
 CONFIG_WOLFTPM
 CONFIG_WOLFTPM_EXAMPLE_NAME_ESPRESSIF
diff --git a/zephyr/Kconfig b/zephyr/Kconfig
index 233db23b9f..85ed5b352b 100644
--- a/zephyr/Kconfig
+++ b/zephyr/Kconfig
@@ -516,6 +516,31 @@ config WOLFSSL_OPENSSL_EXTRA_X509_SMALL
     helpers (wolfSSL_X509_free, wolfSSL_get_verify_result, ...) without
     the rest of OPENSSL_EXTRA.
 
+config WOLFSSL_USER_IO
+  bool "wolfSSL transport supplied by the application"
+  depends on !WOLFSSL_HAS_SETTINGS_FILE
+  help
+    Define WOLFSSL_USER_IO. Leaves the built-in socket send/receive
+    callbacks out of the build, for an application that installs its own
+    with wolfSSL_CTX_SetIOSend()/SetIORecv(). Without a transport of its
+    own such a build cannot do TLS at all; with one it needs no network
+    stack, so CONFIG_NETWORKING can stay off.
+
+config WOLFSSL_CERT_GEN
+  bool "wolfSSL certificate generation"
+  depends on !WOLFSSL_HAS_SETTINGS_FILE
+  help
+    Define WOLFSSL_CERT_GEN. Builds wc_InitCert(), wc_MakeCert() and
+    wc_SignCert(), so the application can issue X.509 certificates.
+
+config WOLFSSL_CERT_EXT
+  bool "wolfSSL certificate extensions"
+  depends on WOLFSSL_CERT_GEN
+  help
+    Define WOLFSSL_CERT_EXT. Adds the v3 extension setters -
+    wc_SetKeyUsage(), wc_SetExtKeyUsage(), wc_SetSubjectKeyId...() and
+    wc_SetAuthKeyId...() - to certificate generation.
+
 config WOLFCRYPT_ASM
 	bool "wolfCrypt assembly optimisations"
 	depends on WOLFSSL_BUILTIN && !WOLFSSL_HAS_SETTINGS_FILE
diff --git a/zephyr/user_settings.h b/zephyr/user_settings.h
index 0eabe162ef..70cca90ab6 100644
--- a/zephyr/user_settings.h
+++ b/zephyr/user_settings.h
@@ -56,7 +56,9 @@ extern "C" {
 
 /* Network stack */
 /* Default is POSIX sockets */
-//#define WOLFSSL_USER_IO /* Use the SetIO callbacks, not the internal wolfio.c socket code */
+#if defined(CONFIG_WOLFSSL_USER_IO)
+    #define WOLFSSL_USER_IO /* Use the SetIO callbacks, not the internal wolfio.c socket code */
+#endif
 //#define WOLFSSL_LWIP
 //#define WOLFSSL_LWIP_NATIVE
 //#define FREERTOS_TCP
@@ -498,11 +500,17 @@ extern "C" {
 /* Optional Features */
 #define WOLFSSL_BASE64_ENCODE /* Enable Base64 encoding */
 //#define WC_NO_CACHE_RESISTANT /* systems with cache should enable this for AES, ECC, RSA and DH */
-//#define WOLFSSL_CERT_GEN
 //#define WOLFSSL_CERT_REQ
-//#define WOLFSSL_CERT_EXT
 //#define NO_PWDBASED
 
+/* Certificate generation */
+#if defined(CONFIG_WOLFSSL_CERT_GEN)
+    #define WOLFSSL_CERT_GEN
+#endif
+#if defined(CONFIG_WOLFSSL_CERT_EXT)
+    #define WOLFSSL_CERT_EXT
+#endif
+
 
 /* Disable Algorithms */
 #define NO_DSA