diff --git a/sbin/hastctl/Makefile b/sbin/hastctl/Makefile
index e0d6b5b7223..301493cec79 100644
--- a/sbin/hastctl/Makefile
+++ b/sbin/hastctl/Makefile
@@ -25,8 +25,13 @@ CFLAGS+=-DINET6
 # This is needed to have WARNS > 1.
 CFLAGS+=-DYY_NO_UNPUT
 
-DPADD=	${LIBCRYPTO} ${LIBL}
-LDADD=	-lcrypto -ll
+DPADD=	${LIBL}
+LDADD=	-ll
+.if ${MK_OPENSSL} != "no"
+DPADD+=	${LIBCRYPTO}
+LDADD+=	-lcrypto
+CFLAGS+=-DHAVE_CRYPTO
+.endif
 
 YFLAGS+=-v
 
diff --git a/sbin/hastd/Makefile b/sbin/hastd/Makefile
index 8153c3a0f4b..bfb62f4f11f 100644
--- a/sbin/hastd/Makefile
+++ b/sbin/hastd/Makefile
@@ -26,9 +26,13 @@ CFLAGS+=-DINET6
 # This is needed to have WARNS > 1.
 CFLAGS+=-DYY_NO_UNPUT
 
-DPADD=	${LIBCRYPTO} ${LIBGEOM} ${LIBBSDXML} ${LIBSBUF} ${LIBL} \
-	${LIBPTHREAD} ${LIBUTIL}
-LDADD=	-lcrypto -lgeom -lbsdxml -lsbuf -ll -lpthread -lutil
+DPADD=	${LIBGEOM} ${LIBBSDXML} ${LIBSBUF} ${LIBL} ${LIBPTHREAD} ${LIBUTIL}
+LDADD=	-lgeom -lbsdxml -lsbuf -ll -lpthread -lutil
+.if ${MK_OPENSSL} != "no"
+DPADD+=	${LIBCRYPTO}
+LDADD+=	-lcrypto
+CFLAGS+=-DHAVE_CRYPTO
+.endif
 
 YFLAGS+=-v
 
diff --git a/sbin/hastd/hast_proto.c b/sbin/hastd/hast_proto.c
index 6e660069ef9..348dfc887bb 100644
--- a/sbin/hastd/hast_proto.c
+++ b/sbin/hastd/hast_proto.c
@@ -37,7 +37,9 @@ __FBSDID("$FreeBSD$");
 #include <string.h>
 #include <strings.h>
 
+#ifdef HAVE_CRYPTO
 #include <openssl/sha.h>
+#endif
 
 #include <hast.h>
 #include <ebuf.h>
@@ -67,14 +69,18 @@ static int compression_send(struct hast_resource *res, struct nv *nv,
     void **datap, size_t *sizep, bool *freedatap);
 static int compression_recv(struct hast_resource *res, struct nv *nv,
     void **datap, size_t *sizep, bool *freedatap);
+#ifdef HAVE_CRYPTO
 static int checksum_send(struct hast_resource *res, struct nv *nv,
     void **datap, size_t *sizep, bool *freedatap);
 static int checksum_recv(struct hast_resource *res, struct nv *nv,
     void **datap, size_t *sizep, bool *freedatap);
+#endif
 
 static struct hast_pipe_stage pipeline[] = {
 	{ "compression", compression_send, compression_recv },
+#ifdef HAVE_CRYPTO
 	{ "checksum", checksum_send, checksum_recv }
+#endif
 };
 
 static int
@@ -161,6 +167,7 @@ compression_recv(struct hast_resource *res, struct nv *nv, void **datap,
 	return (0);
 }
 
+#ifdef HAVE_CRYPTO
 static int
 checksum_send(struct hast_resource *res, struct nv *nv, void **datap,
     size_t *sizep, bool *freedatap __unused)
@@ -221,6 +228,7 @@ checksum_recv(struct hast_resource *res, struct nv *nv, void **datap,
 
 	return (0);
 }
+#endif	/* HAVE_CRYPTO */
 
 /*
  * Send the given nv structure via conn.