diff --git a/BUILD.gn b/BUILD.gn
index 3c78142a25..d03f7c4246 100644
--- a/BUILD.gn
+++ b/BUILD.gn
@@ -695,6 +695,12 @@ if (rtc_include_tests && !build_with_chromium) {
       ]
       shard_timeout = 900
     }
+
+    # Link unit tests against OpenSSL when not building with BoringSSL.
+    ldflags = []
+    if (!rtc_build_ssl) {
+      ldflags += [ "-lssl" ]
+    }
   }
 
   if (rtc_enable_google_benchmarks) {
diff --git a/rtc_base/BUILD.gn b/rtc_base/BUILD.gn
index f095b228ee..486e7f4009 100644
--- a/rtc_base/BUILD.gn
+++ b/rtc_base/BUILD.gn
@@ -18,6 +18,8 @@ if (!rtc_build_ssl) {
     assert(rtc_ssl_root != "",
            "You must specify rtc_ssl_root when rtc_build_ssl==0.")
     include_dirs = [ rtc_ssl_root ]
+
+    # Note: do not link against OpenSSL here.
   }
 }
 
@@ -1585,6 +1587,7 @@ rtc_library("ssl") {
       "openssl_identity.cc",
       "openssl_identity.h",
     ]
+    deps += [ ":crypto_random" ]
 
     configs += [ ":external_ssl_library" ]
   }