diff --git a/third_party/openssl/BUILD b/third_party/openssl/BUILD
new file mode 100644
index 0000000000..7b4748f104
--- /dev/null
+++ b/third_party/openssl/BUILD
@@ -0,0 +1,7 @@
+licenses(["unencumbered"])
+
+filegroup(
+    name = "files",
+    srcs = ["openssl.cnf"],
+    visibility = ["//visibility:public"],
+)
diff --git a/third_party/openssl/openssl.cnf b/third_party/openssl/openssl.cnf
new file mode 100644
index 0000000000..d211288401
--- /dev/null
+++ b/third_party/openssl/openssl.cnf
@@ -0,0 +1 @@
+# An empty openssl.cnf file seems to be good enough for phantomjs
diff --git a/third_party/phantomjs/BUILD b/third_party/phantomjs/BUILD
index 60fe047d90..14561a6b89 100644
--- a/third_party/phantomjs/BUILD
+++ b/third_party/phantomjs/BUILD
@@ -26,6 +26,7 @@ sh_binary(
         "//third_party/fontconfig:config",
         "//third_party/fontconfig:libfontconfig_k8",
         "//third_party/freetype:libfreetype_k8",
+        "//third_party/openssl:files",
         "//third_party/png:libpng_k8",
     ],
 )
diff --git a/third_party/phantomjs/phantomjs.sh b/third_party/phantomjs/phantomjs.sh
index 6217961a57..671369ba36 100755
--- a/third_party/phantomjs/phantomjs.sh
+++ b/third_party/phantomjs/phantomjs.sh
@@ -34,6 +34,7 @@ export OPENSSL_CONF=/etc/ssl/
 export FONTCONFIG_PATH="${RUNFILES}/third_party/fontconfig"
 export XDG_DATA_HOME="${RUNFILES}"
 export XDG_CACHE_HOME="$(mktemp -d "${TMPDIR:-/tmp}/fontcache.XXXXXXXXXX")"
+export OPENSSL_CONF="${RUNFILES}/third_party/openssl/openssl.cnf"
 
 "${RUNFILES}/third_party/phantomjs/bin/phantomjs" "$@"
 rc="$?"