diff --git a/.sai.json b/.sai.json
index bac40cc04..6bb9de042 100644
--- a/.sai.json
+++ b/.sai.json
@@ -21,6 +21,10 @@
 			"build": "mkdir build;cd build;export CCACHE_DISABLE=1;export SAI_CPACK=\"-G DEB\";cmake .. ${cmake} && make -j3 && make -j DESTDIR=../destdir install && ctest -j3 --output-on-failure ${cpack}",
 			"default": false
 		},
+		"android-aarch64": {
+			"build": "mkdir build;cd build;cmake .. -DCMAKE_TOOLCHAIN_FILE=../libwebsockets/contrib/cross-aarch64-android.cmake ${cmake} && make -j",
+			"default": false
+		},
 		"iOS": {
 			"build": "mkdir build destdir; cd build; export SAI_CPACK=\"-G ZIP\";cmake .. -DCMAKE_MAKE_PROGRAM=/usr/bin/make -DCMAKE_IOS_DEVELOPER_ROOT=/opt/Xcode-beta.app/Contents/Developer/Platforms/iPhoneOS.platform/Developer -DCMAKE_TOOLCHAIN_FILE=contrib/iOS.cmake -DIOS_PLATFORM=OS ${cmake} && make -j",
 			"default": false
@@ -76,6 +80,10 @@
 			# no distro -devel package for libuv
 			"platforms":	"not linux-centos-8-x8664"
 		},
+		"justmbedtls": {
+			"cmake": "-DLWS_WITH_MBEDTLS=1 -DLWS_WITHOUT_TESTAPPS=1",
+			"platforms": "none, android-aarch64"
+		},
 		"mbedtls": {
 			"cmake":	"-DLWS_WITH_MBEDTLS=1 -DLWS_WITH_HTTP2=1 -DLWS_WITH_LWSWS=1 -DLWS_WITH_MINIMAL_EXAMPLES=1 -DLWS_WITH_JOSE=1 -DCMAKE_BUILD_TYPE=DEBUG",
 			# no distro -devel package for mbedtls
diff --git a/READMEs/README.build-android.md b/READMEs/README.build-android.md
new file mode 100644
index 000000000..be7a980d7
--- /dev/null
+++ b/READMEs/README.build-android.md
@@ -0,0 +1,77 @@
+# Building for Android NDK
+
+If you have the ndk and prebuilt toolchains with that, you can simply build
+lws library for your android app from one cmake and one make command.
+
+However if you want a tls lib, you have to take care of building and pointing
+to that first.  But if it's a cmake project like mbedtls, that also is just a
+matter of one cmake and one make.
+
+## Installing NDK pieces
+
+There's probably a more direct way but the official way is install the whole
+Android Studio and then run `sdkmanager` to install a recent NDK.
+
+I installed the sdk and ndk pieces into /opt/android/ and that's how the
+`./contrib/cross-aarch64-android.cmake` toolchain file is shipped.  You can
+adapt some settings at the top of that file including the path if needed.
+
+## Fetching lws (needed first for cross toolchain file)
+
+It doesn't care where you put these projects, but for simplicity they should
+be in the same parent dir, like
+
+```
+ - /home/someone
+  - /home/someone/libwebsockets
+  - /home/someone/mbedtls
+```
+
+The reason is that building mbedtls need the cross toolchain file from
+libwebsockets, that's also why we have to get libwebsockets first now but
+build it later.
+
+```
+$ git clone https://libwebsockets.org/repo/libwebsockets
+```
+
+## Building mbedtls
+
+```
+$ git clone https://github.com/ARMmbed/mbedtls.git
+$ cd mbedtls
+$ mkdir build
+$ cd build
+$ rm -f CMakeCache.txt && \
+  cmake .. -DCMAKE_TOOLCHAIN_FILE=../libwebsockets/contrib/cross-aarch64-android.cmake \
+  -DUSE_SHARED_MBEDTLS_LIBRARY=1 \
+  -DENABLE_PROGRAMS=0 \
+  -Wno-dev && \
+  make -j && \
+  cmake --install .
+```
+
+The lws toolchain file sets the path to install into as the cross root path, so
+despite it looks like the destination dir is missing for the install, it will
+go into, eg `/opt/android/ndk/21.1.6352462/platforms/android-24/arch-arm64/lib/libmbedcrypto.a`
+where lws will look for it
+
+## Building lws
+
+You don't need to explain where mbedtls can be found... lws will build with the
+same toolchain file that sets the cross root to the same place as mbedtls, it
+will easily find them there without any further hints.
+
+```
+$ mkdir build
+$ cd build
+$ rm -f CMakeCache.txt && \
+  cmake .. -DCMAKE_TOOLCHAIN_FILE=../libwebsockets/contrib/cross-aarch64-android.cmake \
+  -DLWS_WITH_MBEDTLS=1 \
+  -DLWS_WITHOUT_TESTAPPS=1 && \
+  make && \
+  cmake --install .
+```
+
+That's it, both mbedtls and lws library and header files are installed into the
+ndk cross root.
diff --git a/contrib/android-make-script.sh b/contrib/android-make-script.sh
deleted file mode 100755
index 1ef86074f..000000000
--- a/contrib/android-make-script.sh
+++ /dev/null
@@ -1,116 +0,0 @@
-#!/bin/bash
-
-#
-# Build libwebsockets static library for Android
-#
-
-# path to NDK
-export NDK=/opt/ndk_r17/android-ndk-r17-beta2-linux-x86_64/android-ndk-r17-beta2
-export ANDROID_NDK=${NDK}
-export TOOLCHAIN=${NDK}/toolchain
-export CORSS_SYSROOT=${NDK}/sysroot
-export SYSROOT=${NDK}/platforms/android-22/arch-arm
-set -e
-
-# Download packages libz, libuv, mbedtls and libwebsockets
-#zlib-1.2.8
-#libuv-1.x
-#mbedtls-2.11.0
-#libwebsockets-3.0.0
-
-
-# create a local android toolchain
-API=${3:-24}
-
-$NDK/build/tools/make-standalone-toolchain.sh \
- --toolchain=arm-linux-androideabi-4.9 \
- --arch=arm \
- --install-dir=`pwd`/android-toolchain-arm \
- --platform=android-$API \
- --stl=libc++ \
- --force \
- --verbose
-
-# setup environment to use the gcc/ld from the android toolchain
-export INSTALL_PATH=/opt/libwebsockets_android/android-toolchain-arm
-export TOOLCHAIN_PATH=`pwd`/android-toolchain-arm
-export TOOL=arm-linux-androideabi
-export NDK_TOOLCHAIN_BASENAME=${TOOLCHAIN_PATH}/bin/${TOOL}
-export PATH=`pwd`/android-toolchain-arm/bin:$PATH
-export CC=$NDK_TOOLCHAIN_BASENAME-gcc
-export CXX=$NDK_TOOLCHAIN_BASENAME-g++
-export LINK=${CXX}
-export LD=$NDK_TOOLCHAIN_BASENAME-ld
-export AR=$NDK_TOOLCHAIN_BASENAME-ar
-export RANLIB=$NDK_TOOLCHAIN_BASENAME-ranlib
-export STRIP=$NDK_TOOLCHAIN_BASENAME-strip
-export PLATFORM=android
-export CFLAGS="D__ANDROID_API__=$API"
-
-# configure and build libuv
-[ ! -f ./android-toolchain-arm/lib/libuv.so ] && {
-cd libuv
-echo "=============================================>> build libuv"
-
-PATH=$TOOLCHAIN_PATH:$PATH make clean
-PATH=$TOOLCHAIN_PATH:$PATH make
-PATH=$TOOLCHAIN_PATH:$PATH make install
-echo "<<============================================= build libuv"
-cd ..
-}
-
-# configure and build zlib
-[ ! -f ./android-toolchain-arm/lib/libz.so ] && {
-cd zlib-1.2.8
-echo "=============================================>> build libz"
-
-PATH=$TOOLCHAIN_PATH:$PATH make clean 
-PATH=$TOOLCHAIN_PATH:$PATH make
-PATH=$TOOLCHAIN_PATH:$PATH make install
-echo "<<============================================= build libz"
-cd ..
-}
-
-# configure and build mbedtls
-[ ! -f ./android-toolchain-arm/lib/libmbedtls.so ] && {
-echo "=============================================>> build mbedtls"
-PREFIX=$TOOLCHAIN_PATH
-cd mbedtls-2.11.0
-[ ! -d build ] && mkdir build
-cd build
-export CFLAGS="$CFLAGS -fomit-frame-pointer"
-
-PATH=$TOOLCHAIN_PATH:$PATH cmake .. -DCMAKE_TOOLCHAIN_FILE=`pwd`/../cross-arm-android-gnueabi.cmake \
-  -DCMAKE_INSTALL_PREFIX:PATH=${INSTALL_PATH} \
-  -DCMAKE_BUILD_TYPE=RELEASE -DUSE_SHARED_MBEDTLS_LIBRARY=On
-  
-PATH=$TOOLCHAIN_PATH:$PATH make clean
-PATH=$TOOLCHAIN_PATH:$PATH make SHARED=1
-PATH=$TOOLCHAIN_PATH:$PATH make install
-echo "<<============================================= build mbedtls"
-cd ../..
-}
-
-# configure and build libwebsockets
-[ ! -f ./android-toolchain-arm/lib/libwebsockets.so ] && {
-cd libwebsockets
-[ ! -d build ] && mkdir build
-cd build
-echo "=============================================>> build libwebsockets"
-
-PATH=$TOOLCHAIN_PATH:$PATH cmake .. -DCMAKE_TOOLCHAIN_FILE=`pwd`/../cross-arm-android-gnueabi.cmake \
-  -DCMAKE_INSTALL_PREFIX:PATH=${INSTALL_PATH} \
-  -DLWS_WITH_LWSWS=1 \
-  -DLWS_WITH_MBEDTLS=1 \
-  -DLWS_WITHOUT_TESTAPPS=1 \
-  -DLWS_MBEDTLS_LIBRARIES="${INSTALL_PATH}/lib/libmbedcrypto.a;${INSTALL_PATH}/lib/libmbedtls.a;${INSTALL_PATH}/lib/libmbedx509.a" \
-  -DLWS_MBEDTLS_INCLUDE_DIRS=${INSTALL_PATH}/include \
-  -DLWS_LIBUV_LIBRARIES=${INSTALL_PATH}/lib/libuv.so \
-  -DLWS_LIBUV_INCLUDE_DIRS=${INSTALL_PATH}/include \
-  -DLWS_ZLIB_LIBRARIES=${INSTALL_PATH}/lib/libz.so \
-  -DLWS_ZLIB_INCLUDE_DIRS=${INSTALL_PATH}/include 
-PATH=$TOOLCHAIN_PATH:$PATH make
-PATH=$TOOLCHAIN_PATH:$PATH make install
-echo "<<============================================= build libwebsockets"
-cd ../..
-}
diff --git a/contrib/cross-aarch64-android.cmake b/contrib/cross-aarch64-android.cmake
index efd004f10..a0b3f4e60 100644
--- a/contrib/cross-aarch64-android.cmake
+++ b/contrib/cross-aarch64-android.cmake
@@ -3,16 +3,27 @@
 #
 # This can be used when running cmake in the following way:
 #  cd build/
-#  cmake .. -DCMAKE_TOOLCHAIN_FILE=../cross-aarch64-android.cmake
+#  cmake .. -DCMAKE_TOOLCHAIN_FILE=contrib/cross-aarch64-android.cmake
 #
 
-# Target operating system name.
-set(CMAKE_SYSTEM_NAME Linux)
-set(CMAKE_SYSTEM_PROCESSOR aarch64)
 
-# Name of C compiler.
-set(CMAKE_C_COMPILER "aarch64-linux-android-gcc")
-set(CMAKE_CXX_COMPILER "aarch64-linux-android-g++")
+set(ANDROID_API_VER 24)
+set(ABARCH1 arm64)
+set(CMAKE_SYSTEM_PROCESSOR aarch64)
+set(NDK /opt/android/ndk/21.1.6352462/)
+set(CROSS_SYSROOT "${NDK}/platforms/android-${ANDROID_API_VER}/arch-${ABARCH1}")
+set(BUILD_ARCH linux-x86_64)
+
+#
+# Rest should be computed from the above
+#
+set(TC_PATH ${NDK}/toolchains/llvm/prebuilt/${BUILD_ARCH})
+set(TC_BASE ${TC_PATH}/bin/${CMAKE_SYSTEM_PROCESSOR}-linux-android)
+set(PLATFORM android)
+set(CMAKE_SYSTEM_NAME Linux)
+set(CMAKE_C_COMPILER "${TC_BASE}${ANDROID_API_VER}-clang")
+set(CMAKE_CXX_COMPILER "${TC_BASE}${ANDROID_API_VER}-clang++")
+set(CMAKE_STAGING_PREFIX "${CROSS_SYSROOT}")
 
 #
 # Different build system distros set release optimization level to different
@@ -31,11 +42,10 @@ if (CMAKE_BUILD_TYPE MATCHES RELEASE OR CMAKE_BUILD_TYPE MATCHES Release OR CMAK
 endif()
 
 #-nostdlib
-SET(CMAKE_C_FLAGS "-DGCC_VER=\"\\\"$(GCC_VER)\\\"\" -DARM64=1 -D__LP64__=1 -Os -g3 -fpie -mstrict-align -fPIC -ffunction-sections -fdata-sections " CACHE STRING "" FORCE)
+SET(CMAKE_C_FLAGS "-DGCC_VER=\"\\\"$(GCC_VER)\\\"\" -DARM64=1 -D__LP64__=1 -Os -g3 -fpie -mstrict-align -fPIC -ffunction-sections -fdata-sections -D__ANDROID_API__=${ANDROID_API_VER} -Wno-pointer-sign" CACHE STRING "" FORCE)
 
 
-# Where to look for the target environment. (More paths can be added here)
-#set(CMAKE_FIND_ROOT_PATH "")
+set(CMAKE_FIND_ROOT_PATH "${CROSS_SYSROOT}")
 
 # Adjust the default behavior of the FIND_XXX() commands:
 # search programs in the host environment only.