diff --git a/Cargo.lock b/Cargo.lock
index 3b91e24..086ac48 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -2988,6 +2988,7 @@ dependencies = [
  "ipnet",
  "libc",
  "openssl",
+ "openssl-sys",
  "snxcore",
  "tokio",
  "tracing",
diff --git a/snx-rs/Cargo.toml b/snx-rs/Cargo.toml
index 7aed099..793647f 100644
--- a/snx-rs/Cargo.toml
+++ b/snx-rs/Cargo.toml
@@ -20,6 +20,7 @@ libc = "0.2"
 tracing-subscriber = "0.3"
 clap = { version = "4.5.4", features = ["derive"] }
 ipnet = {  version = "2", features = ["serde"] }
+openssl-sys = "0.9"
 openssl = "0.10"
 
 [features]
diff --git a/snx-rs/build.rs b/snx-rs/build.rs
new file mode 100644
index 0000000..d0401bb
--- /dev/null
+++ b/snx-rs/build.rs
@@ -0,0 +1,8 @@
+fn main() {
+    if let Ok(v) = std::env::var("DEP_OPENSSL_VERSION_NUMBER") {
+        let version = u64::from_str_radix(&v, 16).unwrap();
+        if version >= 0x3000_0000 {
+            println!("cargo:rustc-cfg=openssl3");
+        }
+    }
+}
diff --git a/snx-rs/src/main.rs b/snx-rs/src/main.rs
index fbfd005..485b2f3 100644
--- a/snx-rs/src/main.rs
+++ b/snx-rs/src/main.rs
@@ -1,13 +1,10 @@
-use std::{
-    collections::VecDeque,
-    future::Future,
-    sync::{Arc, OnceLock},
-};
+#![allow(unexpected_cfgs)]
+
+use std::{collections::VecDeque, future::Future, sync::Arc};
 
 use anyhow::anyhow;
 use clap::Parser;
 use futures::pin_mut;
-use openssl::provider::Provider;
 use tokio::{
     signal::unix,
     sync::{mpsc, oneshot},
@@ -61,6 +58,20 @@ where
     }
 }
 
+fn init_openssl() {
+    #[cfg(openssl3)]
+    {
+        use openssl::provider::Provider;
+        use std::sync::OnceLock;
+
+        static LEGACY_PROVIDER: OnceLock<Provider> = OnceLock::new();
+
+        if let Ok(provider) = Provider::try_load(None, "legacy", true) {
+            let _ = LEGACY_PROVIDER.set(provider);
+        }
+    }
+}
+
 #[tokio::main]
 async fn main() -> anyhow::Result<()> {
     let cmdline_params = CmdlineParams::parse();
@@ -69,11 +80,7 @@ async fn main() -> anyhow::Result<()> {
         return Err(anyhow!("Please run me as a root user!"));
     }
 
-    static LEGACY_PROVIDER: OnceLock<Provider> = OnceLock::new();
-
-    if let Ok(provider) = Provider::try_load(None, "legacy", true) {
-        let _ = LEGACY_PROVIDER.set(provider);
-    }
+    init_openssl();
 
     let mode = cmdline_params.mode;