diff --git a/programs/ssl/query_config.c b/programs/ssl/query_config.c
index f2f7b46d6d..41535ef4dc 100644
--- a/programs/ssl/query_config.c
+++ b/programs/ssl/query_config.c
@@ -2586,6 +2586,14 @@ int query_config( const char *config )
     }
 #endif /* MBEDTLS_PLATFORM_GMTIME_R_ALT */
 
+#if defined(MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER)
+    if( strcmp( "MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER", config ) == 0 )
+    {
+        MACRO_EXPANSION_TO_STR( MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER );
+        return( 0 );
+    }
+#endif /* MBEDTLS_PSA_CRYPTO_KEY_FILE_ID_ENCODES_OWNER */
+
     /* If the symbol is not found, return an error */
     return( 1 );
 }
diff --git a/scripts/generate_query_config.pl b/scripts/generate_query_config.pl
index f15e03a358..cc49df4eb9 100755
--- a/scripts/generate_query_config.pl
+++ b/scripts/generate_query_config.pl
@@ -18,7 +18,9 @@
 
 use strict;
 
+my $include_crypto = 1;
 my $config_file = "./include/mbedtls/config.h";
+my $crypto_config_file = "./crypto/include/mbedtls/config.h";
 
 my $query_config_format_file = "./scripts/data_files/query_config.fmt";
 my $query_config_file = "./programs/ssl/query_config.c";
@@ -33,31 +35,52 @@ MBEDTLS_PARAM_FAILED
 );
 my $excluded_re = join '|', @excluded;
 
-open(CONFIG_FILE, "$config_file") or die "Opening config file '$config_file': $!";
 
 # This variable will contain the string to replace in the CHECK_CONFIG of the
 # format file
 my $config_check = "";
+my %defines_seen;
+my @files = ($config_file);
 
-while (my $line = <CONFIG_FILE>) {
-    if ($line =~ /^(\/\/)?\s*#\s*define\s+(MBEDTLS_\w+).*/) {
-        my $name = $2;
 
-        # Skip over the macro that prevents multiple inclusion
-        next if "MBEDTLS_CONFIG_H" eq $name;
+if( @ARGV ) {
+    die "Invalid number of arguments" if scalar @ARGV != 1;
+    ($include_crypto) = @ARGV;
+}
 
-        # Skip over the macro if it is in the ecluded list
-        next if $name =~ /$excluded_re/;
+if( $include_crypto ) {
+    push(@files, $crypto_config_file);
+}
 
-        $config_check .= "#if defined($name)\n";
-        $config_check .= "    if( strcmp( \"$name\", config ) == 0 )\n";
-        $config_check .= "    {\n";
-        $config_check .= "        MACRO_EXPANSION_TO_STR( $name );\n";
-        $config_check .= "        return( 0 );\n";
-        $config_check .= "    }\n";
-        $config_check .= "#endif /* $name */\n";
-        $config_check .= "\n";
+foreach my $file (@files) {
+    open(FILE, "$file") or die "Opening config file failed: '$file': $!";
+    while (my $line = <FILE>) {
+        if ($line =~ /^(\/\/)?\s*#\s*define\s+(MBEDTLS_\w+).*/) {
+            my $name = $2;
+
+            # Skip over the macro that prevents multiple inclusion
+            next if "MBEDTLS_CONFIG_H" eq $name;
+
+            # Skip over the macro if it is in the excluded list
+            next if $name =~ /$excluded_re/;
+
+            # Skip if this define is already added
+            if( $defines_seen{$name}++ ) {
+                print "Skipping $name, already added. \n";
+                next;
+            }
+
+            $config_check .= "#if defined($name)\n";
+            $config_check .= "    if( strcmp( \"$name\", config ) == 0 )\n";
+            $config_check .= "    {\n";
+            $config_check .= "        MACRO_EXPANSION_TO_STR( $name );\n";
+            $config_check .= "        return( 0 );\n";
+            $config_check .= "    }\n";
+            $config_check .= "#endif /* $name */\n";
+            $config_check .= "\n";
+        }
     }
+    close(FILE);
 }
 
 # Read the full format file into a string