diff --git a/common/rfb/Makefile.am b/common/rfb/Makefile.am
index e936a4f..401b431 100644
--- a/common/rfb/Makefile.am
+++ b/common/rfb/Makefile.am
@@ -1,11 +1,17 @@
 noinst_LTLIBRARIES = librfb.la
 
+VENCRYPT_HDRS = CSecurityStack.h CSecurityTLS.h CSecurityTLSBase.h \
+	CSecurityVeNCrypt.h SSecurityPlain.h SSecurityStack.h SSecurityTLS.h \
+	SSecurityTLSBase.h SSecurityVeNCrypt.h
+
+VENCRYPT_SRCS = CSecurityStack.cxx CSecurityTLS.cxx CSecurityTLSBase.cxx \
+	CSecurityVeNCrypt.cxx SSecurityPlain.cxx SSecurityStack.cxx \
+	SSecurityTLS.cxx SSecurityTLSBase.cxx SSecurityVeNCrypt.cxx
+
 HDRS = Blacklist.h CapsContainer.h CapsList.h CConnection.h \
 	CMsgHandler.h CMsgReader.h CMsgReaderV3.h CMsgWriter.h \
 	CMsgWriterV3.h ColourCube.h ColourMap.h ComparingUpdateTracker.h \
 	Configuration.h ConnParams.h CSecurity.h CSecurityNone.h \
-	CSecurityStack.h CSecurityTLS.h CSecurityTLSBase.h \
-	CSecurityVeNCrypt.h \
 	CSecurityVncAuth.h Cursor.h Decoder.h d3des.h Encoder.h \
 	encodings.h Exception.h hextileConstants.h hextileDecode.h \
 	HextileDecoder.h hextileEncodeBetter.h hextileEncode.h \
@@ -15,10 +21,8 @@
 	PixelFormat.h PixelFormat.inl Pixel.h RawDecoder.h RawEncoder.h \
 	Rect.h Region.h rreDecode.h RREDecoder.h rreEncode.h RREEncoder.h \
 	ScaledPixelBuffer.h ScaleFilters.h SConnection.h ScreenSet.h \
-	screenTypes.h SDesktop.h ServerCore.h SMsgHandler.h \
-	SMsgReader.h SMsgReaderV3.h SMsgWriter.h SMsgWriterV3.h \
-	SSecurity.h SSecurityNone.h SSecurityPlain.h \
-	SSecurityStack.h SSecurityTLS.h SSecurityTLSBase.h SSecurityVeNCrypt.h \
+	screenTypes.h SDesktop.h ServerCore.h SMsgHandler.h SMsgReader.h \
+	SMsgReaderV3.h SMsgWriter.h SMsgWriterV3.h SSecurity.h SSecurityNone.h \
 	SSecurityVncAuth.h Threading.h tightDecode.h \
 	TightDecoder.h tightEncode.h TightEncoder.h TightPalette.h Timer.h \
 	TransImageGetter.h transInitTempl.h transTempl.h TrueColourMap.h \
@@ -28,8 +32,6 @@
 
 librfb_la_SOURCES = $(HDRS) Blacklist.cxx CConnection.cxx CMsgHandler.cxx \
 	CMsgReader.cxx CMsgReaderV3.cxx CMsgWriter.cxx CMsgWriterV3.cxx \
-	CSecurityStack.cxx CSecurityTLS.cxx CSecurityTLSBase.cxx \
-	CSecurityVeNCrypt.cxx \
 	CSecurityVncAuth.cxx CapsContainer.cxx CapsList.cxx \
 	ComparingUpdateTracker.cxx Configuration.cxx ConnParams.cxx \
 	Cursor.cxx Decoder.cxx d3des.c Encoder.cxx \
@@ -39,15 +41,17 @@
 	RREEncoder.cxx RREDecoder.cxx RawDecoder.cxx RawEncoder.cxx \
 	Region.cxx SConnection.cxx SMsgHandler.cxx \
 	SMsgReader.cxx SMsgReaderV3.cxx SMsgWriter.cxx SMsgWriterV3.cxx \
-	ServerCore.cxx Security.cxx SSecurityPlain.cxx SSecurityStack.cxx \
-	SSecurityTLS.cxx SSecurityTLSBase.cxx SSecurityVeNCrypt.cxx \
-	SSecurityVncAuth.cxx \
+	ServerCore.cxx Security.cxx SSecurityVncAuth.cxx \
 	ScaledPixelBuffer.cxx ScaleFilters.cxx Timer.cxx TightDecoder.cxx \
 	TightEncoder.cxx TightPalette.cxx TransImageGetter.cxx \
 	UpdateTracker.cxx VNCSConnectionST.cxx \
 	VNCServerST.cxx ZRLEEncoder.cxx ZRLEDecoder.cxx encodings.cxx \
 	util.cxx
 
+if HAVE_GNUTLS
+librfb_la_SOURCES += $(VENCRYPT_HDRS) $(VENCRYPT_SRCS)
+endif
+
 librfb_la_CPPFLAGS = -I$(top_srcdir)/common -I$(top_srcdir)/win @GNUTLS_CFLAGS@
 librfb_la_LIBADD = @GNUTLS_LIBS@
 
diff --git a/common/rfb/SSecurityPlain.cxx b/common/rfb/SSecurityPlain.cxx
index d1f9264..6b7bd9e 100644
--- a/common/rfb/SSecurityPlain.cxx
+++ b/common/rfb/SSecurityPlain.cxx
@@ -17,6 +17,14 @@
  * USA.
  */
 
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#ifndef HAVE_GNUTLS
+#error "This source should not be compiled without HAVE_GNUTLS defined"
+#endif
+
 #include <rfb/SSecurityPlain.h>
 #include <rfb/SConnection.h>
 #include <rfb/Exception.h>
diff --git a/common/rfb/SSecurityPlain.h b/common/rfb/SSecurityPlain.h
index 610ef5b..ecdd618 100644
--- a/common/rfb/SSecurityPlain.h
+++ b/common/rfb/SSecurityPlain.h
@@ -20,6 +20,14 @@
 #ifndef __RFB_SSECURITYPLAIN_H__
 #define __RFB_SSECURITYPLAIN_H__
 
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#ifndef HAVE_GNUTLS
+#error "This header should not be included without HAVE_GNUTLS defined"
+#endif
+
 #include <rfb/SConnection.h>
 #include <rfb/SSecurity.h>
 #include <rfb/SSecurityVeNCrypt.h>
diff --git a/common/rfb/SSecurityTLS.cxx b/common/rfb/SSecurityTLS.cxx
index f54158e..52fc9cb 100644
--- a/common/rfb/SSecurityTLS.cxx
+++ b/common/rfb/SSecurityTLS.cxx
@@ -23,7 +23,9 @@
 #include <config.h>
 #endif
 
-#ifdef HAVE_GNUTLS
+#ifndef HAVE_GNUTLS
+#error "This source should not be compiled without HAVE_GNUTLS defined"
+#endif
 
 #include <rfb/SSecurityTLS.h>
 #include <rfb/Exception.h>
@@ -79,4 +81,3 @@
 
 }
 
-#endif /* HAVE_GNUTLS */
diff --git a/common/rfb/SSecurityTLS.h b/common/rfb/SSecurityTLS.h
index f137f31..253ae84 100644
--- a/common/rfb/SSecurityTLS.h
+++ b/common/rfb/SSecurityTLS.h
@@ -26,7 +26,9 @@
 #include <config.h>
 #endif
 
-#ifdef HAVE_GNUTLS
+#ifndef HAVE_GNUTLS
+#error "This header should not be included without HAVE_GNUTLS defined"
+#endif
 
 #include <rfb/SSecurityTLSBase.h>
 #include <rfb/SSecurityVeNCrypt.h>
@@ -50,6 +52,5 @@
   };
 
 }
-#endif /* HAVE_GNUTLS */
 
 #endif /* __S_SECURITY_TLS_H__ */
diff --git a/common/rfb/SSecurityTLSBase.cxx b/common/rfb/SSecurityTLSBase.cxx
index 2fec9bc..6801210 100644
--- a/common/rfb/SSecurityTLSBase.cxx
+++ b/common/rfb/SSecurityTLSBase.cxx
@@ -23,7 +23,9 @@
 #include <config.h>
 #endif
 
-#ifdef HAVE_GNUTLS
+#ifndef HAVE_GNUTLS
+#error "This source should not be compiled without HAVE_GNUTLS defined"
+#endif
 
 #include <rfb/SSecurityTLSBase.h>
 #include <rfb/SConnection.h>
@@ -143,4 +145,3 @@
   return true;
 }
 
-#endif /* HAVE_GNUTLS */
diff --git a/common/rfb/SSecurityTLSBase.h b/common/rfb/SSecurityTLSBase.h
index 4daad21..b1f2d44 100644
--- a/common/rfb/SSecurityTLSBase.h
+++ b/common/rfb/SSecurityTLSBase.h
@@ -26,7 +26,9 @@
 #include <config.h>
 #endif
 
-#ifdef HAVE_GNUTLS
+#ifndef HAVE_GNUTLS
+#error "This header should not be included without HAVE_GNUTLS defined"
+#endif
 
 #include <rfb/SSecurity.h>
 #include <rdr/InStream.h>
@@ -57,6 +59,4 @@
 
 }
 
-#endif /* HAVE_GNUTLS */
-
 #endif
diff --git a/common/rfb/SSecurityVeNCrypt.cxx b/common/rfb/SSecurityVeNCrypt.cxx
index 926edaa..860e440 100644
--- a/common/rfb/SSecurityVeNCrypt.cxx
+++ b/common/rfb/SSecurityVeNCrypt.cxx
@@ -26,6 +26,10 @@
 #include <config.h>
 #endif
 
+#ifndef HAVE_GNUTLS
+#error "This source should not be compiled without HAVE_GNUTLS defined"
+#endif
+
 #include <rfb/SSecurityVeNCrypt.h>
 #include <rfb/Exception.h>
 #include <rfb/LogWriter.h>
diff --git a/common/rfb/SSecurityVeNCrypt.h b/common/rfb/SSecurityVeNCrypt.h
index 526dad1..bedb6e2 100644
--- a/common/rfb/SSecurityVeNCrypt.h
+++ b/common/rfb/SSecurityVeNCrypt.h
@@ -25,6 +25,14 @@
 #ifndef __SSECURITYVENCRYPT_H__
 #define __SSECURITYVENCRYPT_H__
 
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#ifndef HAVE_GNUTLS
+#error "This header should not be included without HAVE_GNUTLS defined"
+#endif
+
 #include <rfb/SSecurityStack.h>
 #include <rfb/SConnection.h>
 
diff --git a/common/rfb/Security.cxx b/common/rfb/Security.cxx
index eb99f7c..7049439 100644
--- a/common/rfb/Security.cxx
+++ b/common/rfb/Security.cxx
@@ -1,4 +1,5 @@
 /* Copyright (C) 2002-2005 RealVNC Ltd.  All Rights Reserved.
+ * Copyright (C) 2010 TigerVNC Team
  * 
  * This is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -15,6 +16,11 @@
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307,
  * USA.
  */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
 #include <assert.h>
 #include <stdlib.h>
 #include <string.h>
@@ -29,7 +35,9 @@
 #include <rfb/Security.h>
 #include <rfb/SSecurityNone.h>
 #include <rfb/SSecurityVncAuth.h>
+#ifdef HAVE_GNUTLS
 #include <rfb/SSecurityVeNCrypt.h>
+#endif
 #include <rfb/util.h>
 
 using namespace rdr;
@@ -84,7 +92,9 @@
   switch (secType) {
   case secTypeNone: return new SSecurityNone();
   case secTypeVncAuth: return new SSecurityVncAuth();
+#ifdef HAVE_GNUTLS
   case secTypeVeNCrypt: return new SSecurityVeNCrypt();
+#endif
   }
 
 bail:
@@ -101,7 +111,9 @@
   switch (secType) {
   case secTypeNone: return new CSecurityNone();
   case secTypeVncAuth: return new CSecurityVncAuth();
+#ifdef HAVE_GNUTLS
   case secTypeVeNCrypt: return new CSecurityVeNCrypt();
+#endif
   }
 
 bail: