diff --git a/programs/test/query_compile_time_config.c b/programs/test/query_compile_time_config.c
index a6eaf61590..6d92de3100 100644
--- a/programs/test/query_compile_time_config.c
+++ b/programs/test/query_compile_time_config.c
@@ -29,13 +29,14 @@
 #endif
 
 #define USAGE                                                                \
-    "usage: %s <MBEDTLS_CONFIG>\n\n"                                         \
+    "usage: %s [ <MBEDTLS_CONFIG> | -l ]\n\n"                                \
     "This program takes one command line argument which corresponds to\n"    \
     "the string representation of a Mbed TLS compile time configuration.\n"  \
     "The value 0 will be returned if this configuration is defined in the\n" \
     "Mbed TLS build and the macro expansion of that configuration will be\n" \
-    "printed (if any). Otherwise, 1 will be returned.\n"
-
+    "printed (if any). Otherwise, 1 will be returned.\n"                     \
+    "-l\tPrint all available configuration.\n"
+#include <string.h>
 #include "query_config.h"
 
 int main( int argc, char *argv[] )
@@ -46,5 +47,11 @@ int main( int argc, char *argv[] )
         return( MBEDTLS_EXIT_FAILURE );
     }
 
+    if( strcmp( argv[1], "-l" ) == 0 )
+    {
+        list_config();
+        return( 0 );
+    }
+
     return( query_config( argv[1] ) );
 }
diff --git a/programs/test/query_config.h b/programs/test/query_config.h
index 0fad886d14..290100f36f 100644
--- a/programs/test/query_config.h
+++ b/programs/test/query_config.h
@@ -35,4 +35,12 @@
  */
 int query_config( const char *config );
 
+/** List all enabled configuration symbols
+ *
+ * \note            This function is defined in `programs/test/query_config.c`
+ *                  which is automatically generated by
+ *                  `scripts/generate_query_config.pl`.
+ */
+void list_config( void );
+
 #endif /* MBEDTLS_PROGRAMS_TEST_QUERY_CONFIG_H */
diff --git a/scripts/data_files/query_config.fmt b/scripts/data_files/query_config.fmt
index ffa816ecee..8b0057cb00 100644
--- a/scripts/data_files/query_config.fmt
+++ b/scripts/data_files/query_config.fmt
@@ -99,6 +99,10 @@
 #define MACRO_NAME_TO_STR(macro)                                        \
     mbedtls_printf( "%s", strlen( #macro "" ) > 0 ? #macro "\n" : "" )
 
+#define STRINGIFY(macro)  #macro
+#define OUTPUT_MACRO_NAME_VALUE(macro) mbedtls_printf( #macro "%s\n",   \
+    ( STRINGIFY(macro) "" )[0] != 0 ? "=" STRINGIFY(macro) : "" )
+
 #if defined(_MSC_VER)
 /*
  * Visual Studio throws the warning 4003 because many Mbed TLS feature macros
@@ -118,6 +122,10 @@ CHECK_CONFIG    /* If the symbol is not found, return an error */
     return( 1 );
 }
 
+void list_config( void )
+{
+    LIST_CONFIG
+}
 #if defined(_MSC_VER)
 #pragma warning(pop)
 #endif /* _MSC_VER */
diff --git a/scripts/generate_query_config.pl b/scripts/generate_query_config.pl
index 7855c7caa4..b2ce8fc4c6 100755
--- a/scripts/generate_query_config.pl
+++ b/scripts/generate_query_config.pl
@@ -68,6 +68,7 @@ open(CONFIG_FILE, "$config_file") or die "Opening config file '$config_file': $!
 # This variable will contain the string to replace in the CHECK_CONFIG of the
 # format file
 my $config_check = "";
+my $list_config = "";
 
 while (my $line = <CONFIG_FILE>) {
     if ($line =~ /^(\/\/)?\s*#\s*define\s+(MBEDTLS_\w+).*/) {
@@ -84,6 +85,11 @@ while (my $line = <CONFIG_FILE>) {
         $config_check .= "    }\n";
         $config_check .= "#endif /* $name */\n";
         $config_check .= "\n";
+
+        $list_config .= "#if defined($name)\n";
+        $list_config .= "    OUTPUT_MACRO_NAME_VALUE($name);\n";
+        $list_config .= "#endif /* $name */\n";
+        $list_config .= "\n";
     }
 }
 
@@ -95,6 +101,7 @@ close(FORMAT_FILE);
 
 # Replace the body of the query_config() function with the code we just wrote
 $query_config_format =~ s/CHECK_CONFIG/$config_check/g;
+$query_config_format =~ s/LIST_CONFIG/$list_config/g;
 
 # Rewrite the query_config.c file
 open(QUERY_CONFIG_FILE, ">$query_config_file") or die "Opening destination file '$query_config_file': $!";
diff --git a/tests/ssl-opt.sh b/tests/ssl-opt.sh
index 8d94521770..691c0e7d5b 100755
--- a/tests/ssl-opt.sh
+++ b/tests/ssl-opt.sh
@@ -45,6 +45,7 @@ fi
 : ${P_SRV:=../programs/ssl/ssl_server2}
 : ${P_CLI:=../programs/ssl/ssl_client2}
 : ${P_PXY:=../programs/test/udp_proxy}
+: ${P_QUERY:=../programs/test/query_compile_time_config}
 : ${OPENSSL_CMD:=openssl} # OPENSSL would conflict with the build system
 : ${GNUTLS_CLI:=gnutls-cli}
 : ${GNUTLS_SERV:=gnutls-serv}
@@ -194,10 +195,7 @@ esac
 # testing. Skip non-boolean options (with something other than spaces
 # and a comment after "#define SYMBOL"). The variable contains a
 # space-separated list of symbols.
-CONFIGS_ENABLED=" $(<"$CONFIG_H" \
-                    sed -n 's!^ *#define  *\([A-Za-z][0-9A-Z_a-z]*\) *\(/*\)*!\1!p' |
-                    tr '\n' ' ')"
-
+CONFIGS_ENABLED=" $(echo `$P_QUERY -l` )"
 # Skip next test; use this macro to skip tests which are legitimate
 # in theory and expected to be re-introduced at some point, but
 # aren't expected to succeed at the moment due to problems outside
@@ -209,7 +207,7 @@ skip_next_test() {
 # skip next test if the flag is not enabled in mbedtls_config.h
 requires_config_enabled() {
     case $CONFIGS_ENABLED in
-        *" $1 "*) :;;
+        *" $1"[\ =]*) :;;
         *) SKIP_NEXT="YES";;
     esac
 }
@@ -217,7 +215,7 @@ requires_config_enabled() {
 # skip next test if the flag is enabled in mbedtls_config.h
 requires_config_disabled() {
     case $CONFIGS_ENABLED in
-        *" $1 "*) SKIP_NEXT="YES";;
+        *" $1"[\ =]*) SKIP_NEXT="YES";;
     esac
 }