diff --git a/security/cyrus-sasl2/Makefile b/security/cyrus-sasl2/Makefile
index 2887b8c218dd..426ee46dbe8c 100644
--- a/security/cyrus-sasl2/Makefile
+++ b/security/cyrus-sasl2/Makefile
@@ -11,13 +11,14 @@ CYRUS_CONFIGURE_ARGS=	--with-saslauthd=${SASLAUTHD_RUNPATH}
 
 NO_OPTIONS_SORT=	yes
 OPTIONS_DEFINE=		ALWAYSTRUE AUTHDAEMOND DOCS KEEP_DB_OPEN \
-			OBSOLETE_CRAM_ATTR OBSOLETE_DIGEST_ATTR
+			OBSOLETE_CRAM_ATTR OBSOLETE_DIGEST_ATTR SSL
 OPTIONS_RADIO=		SASLDB
 OPTIONS_RADIO_SASLDB=	BDB1 BDB GDBM LMDB
 OPTIONS_GROUP=		PLUGIN
 OPTIONS_GROUP_PLUGIN=	ANONYMOUS CRAM DIGEST LOGIN NTLM OTP PLAIN SCRAM
 OPTIONS_DEFAULT=	ANONYMOUS AUTHDAEMOND BDB1 OBSOLETE_CRAM_ATTR CRAM \
-			OBSOLETE_DIGEST_ATTR DIGEST LOGIN NTLM OTP PLAIN SCRAM
+			OBSOLETE_DIGEST_ATTR DIGEST LOGIN NTLM OTP PLAIN SCRAM \
+			SSL
 OPTIONS_SUB=		yes
 ALWAYSTRUE_DESC=	Alwaystrue password verifier (discouraged)
 ALWAYSTRUE_CONFIGURE_ENABLE=alwaystrue
@@ -61,6 +62,8 @@ PLAIN_DESC=		PLAIN authentication
 PLAIN_CONFIGURE_ENABLE=	plain
 SCRAM_DESC=		SCRAM authentication
 SCRAM_CONFIGURE_ENABLE=	scram
+SSL_DESC=		Uncheck this to use system openssl libraries
+SSL_USES=		ssl
 
 DOCS=	AUTHORS COPYING ChangeLog INSTALL INSTALL.TXT README
 
diff --git a/security/cyrus-sasl2/Makefile.common b/security/cyrus-sasl2/Makefile.common
index 643675fdd133..9dc4dd9a2672 100644
--- a/security/cyrus-sasl2/Makefile.common
+++ b/security/cyrus-sasl2/Makefile.common
@@ -13,7 +13,6 @@ LICENSE_FILE=	${WRKSRC}/COPYING
 
 USES+=		gmake
 USE_LDCONFIG=	yes
-USES+=		ssl
 GNU_CONFIGURE=	yes
 
 CONFIGURE_ARGS+=--sysconfdir=${PREFIX}/etc \
@@ -74,6 +73,10 @@ PLIST_FILES+=	lib/sasl2/lib${CYRUS_BUILD_TARGET}.a \
 
 .include <bsd.port.pre.mk>
 
+.if ! ${PORT_OPTIONS:MSSL}
+OPENSSLBASE=	/usr
+.endif
+
 .if ${OPENSSLBASE} == /usr
 CONFIGURE_ARGS+=--with-openssl=yes
 .else