diff --git a/doc/Changelog b/doc/Changelog
index 13ea25647..c01e6565b 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -7,6 +7,7 @@
 	- squelch TCP fast open error on FreeBSD when kernel has it disabled,
 	  unless verbosity is high.
 	- remove warning from windows compile.
+	- Fix compile with libnettle
 
 17 July 2017: Wouter
 	- Fix #1350: make cachedb backend configurable (from JINMEI Tatuya).
diff --git a/util/net_help.c b/util/net_help.c
index 621c02634..f6a3f3e9c 100644
--- a/util/net_help.c
+++ b/util/net_help.c
@@ -613,6 +613,7 @@ log_crypto_err(const char* str)
 int
 listen_sslctx_setup(void* ctxt)
 {
+#ifdef HAVE_SSL
 	SSL_CTX* ctx = (SSL_CTX*)ctxt;
 	/* no SSLv2, SSLv3 because has defects */
 	if((SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2) & SSL_OP_NO_SSLv2)
@@ -658,11 +659,15 @@ listen_sslctx_setup(void* ctxt)
 	SSL_CTX_set_security_level(ctx, 0);
 #endif
 	return 1;
+#else
+	(void)ctxt;
+#endif /* HAVE_SSL */
 }
 
 void
 listen_sslctx_setup_2(void* ctxt)
 {
+#ifdef HAVE_SSL
 	SSL_CTX* ctx = (SSL_CTX*)ctxt;
 	(void)ctx;
 #if HAVE_DECL_SSL_CTX_SET_ECDH_AUTO
@@ -682,6 +687,9 @@ listen_sslctx_setup_2(void* ctxt)
 		}
 	}
 #endif
+#else
+	(void)ctxt;
+#endif /* HAVE_SSL */
 }
 
 void* listen_sslctx_create(char* key, char* pem, char* verifypem)