We evaluated PolarSSL at FoundationDB while adding TLS support to our 2.0 release. In the end I think our primary deciding factor was a lack of support for hardware accelerated AES-GCM using AES-NI and PCLMUL on modern hardware, although I understand they are working on it.
The library as a whole was relatively well documented and pleasant to use. I am not going to even pretend to be enough of a crypto expert to have my own opinion of its security quality, though.
EDIT: I suppose I should add, for completeness, that we eventually decided to use GnuTLS for our TLS plugin implementation. Just in time to catch the latest GnuTLS security problem, but we avoided heartbleed.
Oh, that's great news! Unfortunately I'm on other projects now and likely won't have a chance to reevaluate in the short term, but I'd like to take a look at some point.
GnuTLS was not the most pleasant API to use, but it did hit some very impressive throughput numbers in our use cases, and seemed to deliver on the theoretical promised instructions/byte that Intel talks about in their whitepaper(s) about AES-GCM.
The library as a whole was relatively well documented and pleasant to use. I am not going to even pretend to be enough of a crypto expert to have my own opinion of its security quality, though.
EDIT: I suppose I should add, for completeness, that we eventually decided to use GnuTLS for our TLS plugin implementation. Just in time to catch the latest GnuTLS security problem, but we avoided heartbleed.