diff --git a/modules/openssl b/modules/openssl
index a712d46d..0c4c93f4 100644
--- a/modules/openssl
+++ b/modules/openssl
@@ -10,6 +10,8 @@ openssl_hash := 6c13d2bf38fdf31eac3ce2a347073673f5d63263398f1f69d0df4a41253e4b3e
 # hack to provide path to libgcc
 LIBGCC_DIR := $(dir $(shell $(heads_cc) -print-libgcc-file-name))
 
+# The only optional algorithm that's enabled is SM3.  tpm2-tss uses SHA, AES,
+# and SM3.
 openssl_configure := \
 	$(CROSS_TOOLS) \
 	CFLAGS="-Os" \
@@ -18,6 +20,33 @@ openssl_configure := \
 		--prefix="/" \
 		no-tests \
 		linux-$(strip $(arch)) \
+		no-aria \
+		no-bf \
+		no-blake2 \
+		no-camellia \
+		no-cast \
+		no-chacha \
+		no-cmac \
+		no-des \
+		no-dh \
+		no-dsa \
+		no-ecdh \
+		no-ecdsa \
+		no-idea \
+		no-md4 \
+		no-mdc2 \
+		no-ocb \
+		no-poly1305 \
+		no-rc2 \
+		no-rc4 \
+		no-rmd160 \
+		no-scrypt \
+		no-seed \
+		no-siphash \
+		no-siv \
+		no-sm2 \
+		no-sm4 \
+		no-whirlpool \
 
 openssl_target := $(MAKE_JOBS) \
 	build_programs \