diff --git a/src/internal.c b/src/internal.c
index 4b69b06c6..6b9632649 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -2726,10 +2726,13 @@ static void BuildFinished(CYASSL* ssl, Hashes* hashes, const byte* sender)
     Sha384 sha384 = ssl->hashSha384;
 #endif
 
-    if (ssl->options.tls)
+#ifndef NO_TLS
+    if (ssl->options.tls) {
         BuildTlsFinished(ssl, hashes, sender);
+    }
+#endif
 #ifndef NO_OLD_TLS
-    else {
+    if (!ssl->options.tls) {
         BuildMD5(ssl, hashes, sender);
         BuildSHA(ssl, hashes, sender);
     }
@@ -6917,13 +6920,15 @@ int SetCipherList(Suites* s, const char* list)
                     int ret; 
                     XMEMCPY(ssl->arrays->masterSecret,
                             ssl->session.masterSecret, SECRET_LEN);
-                    #ifndef NO_OLD_TLS
-                        if (ssl->options.tls)
-                            ret = DeriveTlsKeys(ssl);
-                        else
-                            ret = DeriveKeys(ssl);
-                    #else
+                    #ifdef NO_OLD_TLS
                         ret = DeriveTlsKeys(ssl);
+                    #else
+                        #ifndef NO_TLS
+                            if (ssl->options.tls)
+                                ret = DeriveTlsKeys(ssl);
+                        #endif
+                            if (!ssl->options.tls)
+                                ret = DeriveKeys(ssl);
                     #endif
                     ssl->options.serverState = SERVER_HELLODONE_COMPLETE;
                     return ret;
@@ -9162,13 +9167,15 @@ int SetCipherList(Suites* s, const char* list)
                     ssl->session = *session; /* restore session certs. */
                 #endif
                 RNG_GenerateBlock(ssl->rng, ssl->arrays->serverRandom, RAN_LEN);
-                #ifndef NO_OLD_TLS
-                    if (ssl->options.tls)
-                        ret = DeriveTlsKeys(ssl);
-                    else
-                        ret = DeriveKeys(ssl);
-                #else
+                #ifdef NO_OLD_TLS
                     ret = DeriveTlsKeys(ssl);
+                #else
+                    #ifndef NO_TLS
+                        if (ssl->options.tls)
+                            ret = DeriveTlsKeys(ssl);
+                    #endif
+                        if (!ssl->options.tls)
+                            ret = DeriveKeys(ssl);
                 #endif
                 ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
 
@@ -9379,13 +9386,15 @@ int SetCipherList(Suites* s, const char* list)
                     ssl->session = *session; /* restore session certs. */
                 #endif
                 RNG_GenerateBlock(ssl->rng, ssl->arrays->serverRandom, RAN_LEN);
-                #ifndef NO_OLD_TLS
-                    if (ssl->options.tls)
-                        ret = DeriveTlsKeys(ssl);
-                    else
-                        ret = DeriveKeys(ssl);
-                #else
+                #ifdef NO_OLD_TLS
                     ret = DeriveTlsKeys(ssl);
+                #else
+                    #ifndef NO_TLS
+                        if (ssl->options.tls)
+                            ret = DeriveTlsKeys(ssl);
+                    #endif
+                        if (!ssl->options.tls)
+                            ret = DeriveKeys(ssl);
                 #endif
                 ssl->options.clientState = CLIENT_KEYEXCHANGE_COMPLETE;
 
diff --git a/src/tls.c b/src/tls.c
index 2269825ca..0e8021efd 100644
--- a/src/tls.c
+++ b/src/tls.c
@@ -620,34 +620,5 @@ void TLS_hmac(CYASSL* ssl, byte* digest, const byte* in, word32 sz,
 
 
 #endif /* NO_CYASSL_SERVER */
-
-#else /* NO_TLS */
-
-/* catch CyaSSL programming errors */
-void BuildTlsFinished(CYASSL* ssl, Hashes* hashes, const byte* sender)
-{
-   
-}
-
-
-int DeriveTlsKeys(CYASSL* ssl)
-{
-    return NOT_COMPILED_IN;
-}
-
-
-int MakeTlsMasterSecret(CYASSL* ssl)
-{ 
-    return NOT_COMPILED_IN;
-}
-
-
-int CyaSSL_make_eap_keys(CYASSL* ssl, void* msk, unsigned int len, 
-                         const char* label)
-{
-    return NOT_COMPILED_IN;
-}
-
-
 #endif /* NO_TLS */