diff --git a/Makefile b/Makefile
index 5ae460193..b499c36a5 100644
--- a/Makefile
+++ b/Makefile
@@ -30,6 +30,7 @@ export NGX_BUILD_NOPOOL ?= 0
 export NGX_BUILD_FSANITIZE ?=
 export NGX_BUILD_OPENRESTY ?=
 export NGX_BUILD_OPENSSL ?=
+export NGX_BUILD_OPENSSL_DEBUG ?= 0
 export NGX_BUILD_CLANG_ANALYZER ?= 0
 export NGX_BUILD_GCOV ?= 0
 export NGX_BUILD_FORCE ?= 0
diff --git a/util/_lib.sh b/util/_lib.sh
index 804604739..77bb711ca 100644
--- a/util/_lib.sh
+++ b/util/_lib.sh
@@ -126,14 +126,27 @@ install_openssl() {
         local dirname="openssl-lib-$OPENSSL_VER"
 
         if [ ! -d $dirname ]; then
-            notice "building OpenSSL..."
+            notice "building OpenSSL... (debug: $NGX_BUILD_OPENSSL_DEBUG)"
             local prefix="$(pwd)/$dirname"
+            local opts=""
+
+            if [[ "$NGX_BUILD_OPENSSL_DEBUG" == 1 ]]; then
+                opts+="no-asm \
+                       -fno-inline \
+                       -fno-omit-frame-pointer \
+                       -d \
+                       -g3 \
+                       -ggdb3 \
+                       -O0"
+            fi
+
             pushd openssl-$OPENSSL_VER
-                ./config \
-                    --prefix=$prefix \
-                    --openssldir=$prefix/openssl \
-                    shared \
-                    no-threads
+                eval ./config \
+                    "--prefix=$prefix" \
+                    "--openssldir=$prefix/openssl" \
+                    "shared" \
+                    "no-threads" \
+                    "$opts"
                 make -j$(n_jobs)
                 make install_sw
             popd