diff --git a/Cargo.toml b/Cargo.toml
index 4aba98970..34b18df76 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -32,7 +32,6 @@ leb128 = "0.2"
 libc = "0.2"
 log = "0.4"
 open = "1.2"
-openssl = "0.10"
 native-tls = "0.2"
 palette = "0.4"
 portable-pty = { path = "pty", features = ["serde_support"]}
@@ -59,6 +58,10 @@ mio-extras = "2.0"
 optional = true
 path = "deps/fontconfig"
 
+[dependencies.openssl]
+optional = true
+version = "0.10"
+
 # on linux, font-loader pulls in servo-font* crates which conflict with
 # our newer font related deps, so we avoid it on linux
 [target.'cfg(any(windows, target_os = "macos"))'.dependencies]
@@ -79,9 +82,9 @@ winapi = { version = "0.3", features = [
 [target.'cfg(any(target_os = "android", all(unix, not(target_os = "macos"))))'.dependencies]
 egli = "0.4"
 fontconfig = { path = "deps/fontconfig" }
+openssl = "0.10"
 x11 = {version ="2.18", features = ["xlib_xcb"]}
 
-
 [target.'cfg(all(unix, not(target_os = "macos")))'.dependencies]
 xcb = "0.8"
 xcb-util = { features = [ "icccm", "ewmh", "keysyms", ], version = "0.2" }
diff --git a/src/server/listener.rs b/src/server/listener.rs
index 577e8be10..0cf749686 100644
--- a/src/server/listener.rs
+++ b/src/server/listener.rs
@@ -7,9 +7,6 @@ use failure::{bail, err_msg, format_err, Error, Fallible};
 use libc::{mode_t, umask};
 use log::{debug, error, warn};
 use native_tls::{Identity, TlsAcceptor};
-use openssl::pkcs12::Pkcs12;
-use openssl::pkey::PKey;
-use openssl::x509::X509;
 use promise::{Executor, Future};
 use std::convert::{TryFrom, TryInto};
 use std::fs::{remove_file, DirBuilder};
@@ -81,6 +78,10 @@ impl TryFrom<IdentitySource> for Identity {
                     format_err!("error loading pkcs12 file '{}': {}", path.display(), e)
                 })
             }
+            #[cfg(not(feature = "openssl"))]
+            IdentitySource::PemFiles { .. } => bail!("recompile wezterm using --features openssl"),
+
+            #[cfg(feature = "openssl")]
             IdentitySource::PemFiles { key, cert, chain } => {
                 // This is a bit of a redundant dance around;
                 // the native_tls interface only allows for pkcs12
@@ -89,6 +90,9 @@ impl TryFrom<IdentitySource> for Identity {
                 // We can use openssl to convert the data to pkcs12
                 // so that we can then pass it on using the Identity
                 // type that native_tls requires.
+                use openssl::pkcs12::Pkcs12;
+                use openssl::pkey::PKey;
+                use openssl::x509::X509;
                 let key_bytes = read_bytes(&key)?;
                 let pkey = PKey::private_key_from_pem(&key_bytes)?;