diff --git a/configure.ac b/configure.ac
index df101b700..c89ddd4d8 100644
--- a/configure.ac
+++ b/configure.ac
@@ -10,6 +10,10 @@ AC_INIT([wolfssl],[3.6.8],[https://github.com/wolfssl/wolfssl/issues],[wolfssl],
 
 AC_CONFIG_AUX_DIR([build-aux])
 
+# The following sets CFLAGS to empty if unset on command line. We do not want
+# the default "-g -O2" that AC_PROG_CC sets automatically.
+: ${CFLAGS=""}
+
 AC_CANONICAL_HOST
 AC_CANONICAL_BUILD
 
diff --git a/m4/ax_harden_compiler_flags.m4 b/m4/ax_harden_compiler_flags.m4
index 018ffcbd6..31137d065 100644
--- a/m4/ax_harden_compiler_flags.m4
+++ b/m4/ax_harden_compiler_flags.m4
@@ -62,7 +62,8 @@
 # AX_APPEND_COMPILE_FLAGS([-floop-parallelize-all],,[$ax_append_compile_cflags_extra]) -- causes RSA verify problem on x64
 # AX_APPEND_COMPILE_FLAGS([-Wunreachable-code],,[$ax_append_compile_cflags_extra])  -- older clang and when gcc had it are buggy
 
-#serial 4.1
+#serial 4.2
+# changes: deleted the clearing of CFLAGS
 
   AC_DEFUN([AX_HARDEN_LINKER_FLAGS], [
       AC_REQUIRE([AX_VCS_CHECKOUT])
@@ -97,7 +98,6 @@
 
       AC_LANG_PUSH([C])
 
-      CFLAGS=
       ac_cv_warnings_as_errors=no
       ax_append_compile_cflags_extra=
       AS_IF([test "$ac_cv_vcs_checkout" = "yes"],[