diff --git a/library/.gitignore b/library/.gitignore
index 9794129d94..92a33de2bc 100644
--- a/library/.gitignore
+++ b/library/.gitignore
@@ -4,6 +4,9 @@ libmbed*
 
 ###START_GENERATED_FILES###
 /error.c
+/mbedtls_config_check_before.h
+/mbedtls_config_check_final.h
+/mbedtls_config_check_user.h
 /version_features.c
 /ssl_debug_helpers_generated.c
 ###END_GENERATED_FILES###
diff --git a/library/CMakeLists.txt b/library/CMakeLists.txt
index 5b8dc80b53..b31d2ea70e 100644
--- a/library/CMakeLists.txt
+++ b/library/CMakeLists.txt
@@ -73,6 +73,39 @@ if(GEN_FILES)
             ${CMAKE_CURRENT_SOURCE_DIR}/../scripts/data_files/version_features.fmt
     )
 
+    execute_process(
+        COMMAND
+            ${MBEDTLS_PYTHON_EXECUTABLE}
+            ${MBEDTLS_DIR}/scripts/generate_config_checks.py
+            --list ""
+        WORKING_DIRECTORY
+            ${CMAKE_CURRENT_SOURCE_DIR}/..
+        OUTPUT_VARIABLE
+            MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS)
+    # Turn newline-terminated non-empty list into semicolon-separated list.
+    string(REPLACE "\n" ";"
+           MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS "${MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS}")
+    string(REGEX REPLACE ";\$" ""
+           MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS "${MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS}")
+    # Prepend the binary dir to all element of MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS,
+    # using features that exist in CMake 3.5.1.
+    string(REPLACE ";" ";${CMAKE_CURRENT_BINARY_DIR}/"
+           MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS
+           "${MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS}")
+    set(MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS
+        "${CMAKE_CURRENT_BINARY_DIR}/${MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS}")
+
+    add_custom_command(
+        OUTPUT ${MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS}
+        COMMAND
+            ${MBEDTLS_PYTHON_EXECUTABLE}
+                ${MBEDTLS_DIR}/scripts/generate_config_checks.py
+                ${CMAKE_CURRENT_BINARY_DIR}
+        DEPENDS
+            ${MBEDTLS_DIR}/scripts/generate_config_checks.py
+            ${MBEDTLS_FRAMEWORK_DIR}/scripts/mbedtls_framework/config_checks_generator.py
+    )
+
     add_custom_command(
         OUTPUT
             ${CMAKE_CURRENT_BINARY_DIR}/ssl_debug_helpers_generated.c
@@ -89,6 +122,7 @@ if(GEN_FILES)
     add_custom_target(${MBEDTLS_TARGET_PREFIX}mbedx509_generated_files_target
         DEPENDS
             ${CMAKE_CURRENT_BINARY_DIR}/error.c
+            ${MBEDTLS_GENERATED_CONFIG_CHECKS_HEADERS}
     )
 
     add_custom_target(${MBEDTLS_TARGET_PREFIX}mbedtls_generated_files_target
diff --git a/library/Makefile b/library/Makefile
index f8729344b4..f3667ba307 100644
--- a/library/Makefile
+++ b/library/Makefile
@@ -5,7 +5,12 @@ endif
 TF_PSA_CRYPTO_CORE_PATH = $(MBEDTLS_PATH)/tf-psa-crypto/core
 TF_PSA_CRYPTO_DRIVERS_BUILTIN_SRC_PATH = $(MBEDTLS_PATH)/tf-psa-crypto/drivers/builtin/src
 
+# List the generated files without running a script, so that this
+# works with no tooling dependencies when GEN_FILES is disabled.
 GENERATED_FILES := \
+	mbedtls_config_check_before.h \
+	mbedtls_config_check_final.h \
+	mbedtls_config_check_user.h \
 	error.c \
 	version_features.c \
 	ssl_debug_helpers_generated.c \
@@ -326,6 +331,14 @@ $(GENERATED_WRAPPER_FILES):
 
 $(TF_PSA_CRYPTO_CORE_PATH)/psa_crypto.o:$(TF_PSA_CRYPTO_CORE_PATH)/psa_crypto_driver_wrappers.h
 
+GENERATED_CONFIG_CHECK_FILES = $(shell $(PYTHON) ../scripts/generate_config_checks.py --list .)
+$(GENERATED_CONFIG_CHECK_FILES): $(gen_file_dep) \
+	$(TF_PSA_CRYPTO_CORE_PATH)/../scripts/generate_config_checks.py \
+	../framework/scripts/mbedtls_framework/config_checks_generator.py
+$(GENERATED_CONFIG_CHECK_FILES):
+	echo "  Gen   $(GENERATED_CONFIG_CHECK_FILES)"
+	$(PYTHON) ../scripts/generate_config_checks.py
+
 clean:
 ifndef WINDOWS
 	rm -f *.o *.s libmbed*