(Posting so that someone else can find it here when they're bitten by it)
CONFIG_OPENSSL_WITH_DEPRECATED=y
Yes, alas, you can't disable the deprecated APIs in libopenssl if you want to build the mosquitto variants with TLS. From a recent build of mosquitto-client-ssl
../lib/libmosquitto.so.1: undefined reference to `ERR_remove_state'
../lib/libmosquitto.so.1: undefined reference to `BN_num_bytes'
Amusingly, or annoyingly, as you might see it, https://www.openssl.org/docs/man1.1.0/crypto/ERR_remove_state.html states
[ERR_remove_state is] now deprecated and do[es] nothing, as the OpenSSL libraries now normally do all thread initialisation and deinitialisation automatically (see OPENSSL_init_crypto).