Index: src/libs/zbxcrypto/tls.c
===================================================================
--- src/libs/zbxcrypto/tls.c	(revision 56748)
+++ src/libs/zbxcrypto/tls.c	(working copy)
@@ -59,6 +59,10 @@
 
 #if defined(HAVE_POLARSSL) || defined(HAVE_GNUTLS) || defined(HAVE_OPENSSL)
 extern unsigned char			program_type;
+
+extern int				CONFIG_PASSIVE_FORKS;
+extern int				CONFIG_ACTIVE_FORKS;
+
 extern char				*CONFIG_TLS_CONNECT;
 extern char				*CONFIG_TLS_ACCEPT;
 extern char				*CONFIG_TLS_CA_FILE;
@@ -612,11 +616,11 @@
  *           CONFIG_TLS_PSK_FILE - are defined and not empty or none of them, *
  *           (if CONFIG_TLS_PSK_IDENTITY is defined it must be a valid UTF-8  *
  *           string),                                                         *
- *         - in agentd, active proxy, zabbix_get, and zabbix_sender the       *
+ *         - in active agent, active proxy, zabbix_get, and zabbix_sender the *
  *           certificate and PSK parameters must match the value of           *
  *           CONFIG_TLS_CONNECT parameter,                                    *
- *         - in agentd and passive proxy the certificate and PSK parameters   *
- *           must match the value of CONFIG_TLS_ACCEPT parameter.             *
+ *         - in passive agent and passive proxy the certificate and PSK       *
+ *           parameters must match the value of CONFIG_TLS_ACCEPT parameter.  *
  *                                                                            *
  ******************************************************************************/
 void	zbx_tls_validate_config(void)
@@ -740,14 +744,13 @@
 	if (NULL != CONFIG_TLS_PSK_IDENTITY && SUCCEED != zbx_is_utf8(CONFIG_TLS_PSK_IDENTITY))
 		zbx_tls_validation_error(ZBX_TLS_VALIDATION_UTF8, &CONFIG_TLS_PSK_IDENTITY, NULL);
 
-	/* agentd, active proxy, zabbix_get, and zabbix_sender specific validation */
+	/* active agentd, active proxy, zabbix_get, and zabbix_sender specific validation */
 
-	if (0 != (program_type & (ZBX_PROGRAM_TYPE_AGENTD | ZBX_PROGRAM_TYPE_PROXY_ACTIVE | ZBX_PROGRAM_TYPE_GET |
-				ZBX_PROGRAM_TYPE_SENDER)))
+	if ((0 != (program_type & ZBX_PROGRAM_TYPE_AGENTD) && 0 != CONFIG_ACTIVE_FORKS) ||
+			(0 != (program_type & (ZBX_PROGRAM_TYPE_PROXY_ACTIVE | ZBX_PROGRAM_TYPE_GET |
+					ZBX_PROGRAM_TYPE_SENDER))))
 	{
 		/* 'TLSConnect' is the master parameter to be matched by certificate and PSK parameters. */
-		/* 'TLSConnect' will be silently ignored on agentd, if active checks are not configured */
-		/* (i.e. 'ServerActive' is not specified). */
 
 		if (NULL != CONFIG_TLS_CERT_FILE && NULL == CONFIG_TLS_CONNECT)
 		{
@@ -774,9 +777,10 @@
 		}
 	}
 
-	/* agentd and passive proxy specific validation */
+	/* passive agentd and passive proxy specific validation */
 
-	if (0 != (program_type & (ZBX_PROGRAM_TYPE_AGENTD | ZBX_PROGRAM_TYPE_PROXY_PASSIVE)))
+	if ((0 != (program_type & ZBX_PROGRAM_TYPE_AGENTD) && 0 != CONFIG_PASSIVE_FORKS) ||
+			0 != (program_type & ZBX_PROGRAM_TYPE_PROXY_PASSIVE))
 	{
 		/* 'TLSAccept' is the master parameter to be matched by certificate and PSK parameters */
 
Index: src/zabbix_agent/zabbix_agent.c
===================================================================
--- src/zabbix_agent/zabbix_agent.c	(revision 56748)
+++ src/zabbix_agent/zabbix_agent.c	(working copy)
@@ -64,6 +64,9 @@
 	NULL	/* end of text */
 };
 
+int	CONFIG_PASSIVE_FORKS		= 0;	/* not used in zabbix_agent, just for linking with tls.c */
+int	CONFIG_ACTIVE_FORKS		= 0;	/* not used in zabbix_agent, just for linking with tls.c */
+
 static struct zbx_option	longopts[] =
 {
 	{"config",	1,	NULL,	'c'},
Index: src/zabbix_get/zabbix_get.c
===================================================================
--- src/zabbix_get/zabbix_get.c	(revision 56748)
+++ src/zabbix_get/zabbix_get.c	(working copy)
@@ -133,6 +133,9 @@
 char	*CONFIG_TLS_PSK_IDENTITY	= NULL;
 char	*CONFIG_TLS_PSK_FILE		= NULL;
 
+int	CONFIG_PASSIVE_FORKS		= 0;	/* not used in zabbix_get, just for linking with tls.c */
+int	CONFIG_ACTIVE_FORKS		= 0;	/* not used in zabbix_get, just for linking with tls.c */
+
 /* COMMAND LINE OPTIONS */
 
 /* long options */
Index: src/zabbix_sender/zabbix_sender.c
===================================================================
--- src/zabbix_sender/zabbix_sender.c	(revision 56748)
+++ src/zabbix_sender/zabbix_sender.c	(working copy)
@@ -185,7 +185,7 @@
 unsigned int	configured_tls_accept_modes = ZBX_TCP_SEC_UNENCRYPTED;	/* not used in zabbix_sender, just for */
 									/* linking with tls.c */
 char	*CONFIG_TLS_CONNECT		= NULL;
-char	*CONFIG_TLS_ACCEPT		= NULL; /* not used in zabbix_sender, just for linking with tls.c */
+char	*CONFIG_TLS_ACCEPT		= NULL;	/* not used in zabbix_sender, just for linking with tls.c */
 char	*CONFIG_TLS_CA_FILE		= NULL;
 char	*CONFIG_TLS_CRL_FILE		= NULL;
 char	*CONFIG_TLS_SERVER_CERT_ISSUER	= NULL;
@@ -195,6 +195,9 @@
 char	*CONFIG_TLS_PSK_IDENTITY	= NULL;
 char	*CONFIG_TLS_PSK_FILE		= NULL;
 
+int	CONFIG_PASSIVE_FORKS		= 0;	/* not used in zabbix_sender, just for linking with tls.c */
+int	CONFIG_ACTIVE_FORKS		= 0;	/* not used in zabbix_sender, just for linking with tls.c */
+
 /* COMMAND LINE OPTIONS */
 
 /* long options */
