diff --git a/c++/Makefile.am b/c++/Makefile.am
index 21f8a0fcfe..39c57b1aa2 100644
--- a/c++/Makefile.am
+++ b/c++/Makefile.am
@@ -219,10 +219,20 @@ includecapnpcompat_HEADERS =                                   \
   src/capnp/compat/json.h                                      \
   src/capnp/compat/json.capnp.h
 
+if BUILD_KJ_TLS
+MAYBE_KJ_TLS_LA=libkj-tls.la
+MAYBE_KJ_TLS_TESTS=                                            \
+  src/kj/compat/readiness-io-test.c++                          \
+  src/kj/compat/tls-test.c++
+else
+MAYBE_KJ_TLS_LA=
+MAYBE_KJ_TLS_TESTS=
+endif
+
 if LITE_MODE
 lib_LTLIBRARIES = libkj.la libkj-test.la libcapnp.la
 else
-lib_LTLIBRARIES = libkj.la libkj-test.la libkj-async.la libkj-http.la libcapnp.la libcapnp-rpc.la libcapnp-json.la libcapnpc.la
+lib_LTLIBRARIES = libkj.la libkj-test.la libkj-async.la libkj-http.la $(MAYBE_KJ_TLS_LA) libcapnp.la libcapnp-rpc.la libcapnp-json.la libcapnpc.la
 endif
 
 # Don't include security release in soname -- we want to replace old binaries
@@ -278,6 +288,13 @@ libkj_http_la_SOURCES=                                         \
   src/kj/compat/url.c++                                        \
   src/kj/compat/http.c++                                       \
   src/kj/compat/gzip.c++
+
+libkj_tls_la_LIBADD = libkj-async.la libkj.la -lssl -lcrypto $(ASYNC_LIBS) $(PTHREAD_LIBS)
+libkj_tls_la_LDFLAGS = -release $(SO_VERSION) -no-undefined
+libkj_tls_la_SOURCES=                                          \
+  src/kj/compat/readiness-io.c++                               \
+  src/kj/compat/tls.c++
+
 endif !LITE_MODE
 
 if !LITE_MODE
@@ -451,6 +468,7 @@ heavy_tests =                                                  \
   src/kj/compat/url-test.c++                                   \
   src/kj/compat/http-test.c++                                  \
   src/kj/compat/gzip-test.c++                                  \
+  $(MAYBE_KJ_TLS_TESTS)                                        \
   src/capnp/canonicalize-test.c++                              \
   src/capnp/capability-test.c++                                \
   src/capnp/membrane-test.c++                                  \
@@ -474,6 +492,7 @@ capnp_test_LDADD =                                             \
   libcapnp-json.la                                             \
   libcapnp.la                                                  \
   libkj-http.la                                                \
+  $(MAYBE_KJ_TLS_LA)                                           \
   libkj-async.la                                               \
   libkj-test.la                                                \
   libkj.la                                                     \
diff --git a/c++/configure.ac b/c++/configure.ac
index 65bd9ea225..4d2995b10a 100644
--- a/c++/configure.ac
+++ b/c++/configure.ac
@@ -22,6 +22,11 @@ AC_ARG_WITH([external-capnp],
      one (useful for cross-compiling)])],
   [external_capnp=yes],[external_capnp=no])
 
+AC_ARG_WITH([openssl],
+  [AS_HELP_STRING([--with-openssl],
+    [build libkj-tls by linking against openssl @<:@default=check@:>@])],
+  [],[with_openssl=check])
+
 AC_ARG_ENABLE([reflection], [
   AS_HELP_STRING([--disable-reflection], [
     compile Cap'n Proto in "lite mode", in which all reflection APIs (schema.h, dynamic.h, etc.)
@@ -135,5 +140,27 @@ AC_SUBST([PACKAGE_CMAKE_INSTALL_FULL_INCLUDEDIR])
 AC_CHECK_SIZEOF([void *])
 AC_SUBST(CMAKE_SIZEOF_VOID_P, $ac_cv_sizeof_void_p)
 
+# Detect presence of OpenSSL, if it was not specified explicitly.
+AS_IF([test "$with_openssl" = check], [
+  AC_CHECK_LIB(crypto, CRYPTO_new_ex_data, [:], [
+    with_openssl=no
+  ])
+  AC_CHECK_LIB(ssl, OPENSSL_init_ssl, [:], [
+    with_openssl=no
+  ], [-lcrypto])
+  AC_CHECK_HEADER([openssl/ssl.h], [:], [
+    with_openssl=no
+  ])
+  AS_IF([test "$with_openssl" = no], [
+    AC_MSG_WARN("could not find OpenSSL -- won't build libkj-tls")
+  ], [
+    with_openssl=yes
+  ])
+])
+AS_IF([test "$with_openssl" != no], [
+  CXXFLAGS="$CXXFLAGS -DKJ_HAS_OPENSSL"
+])
+AM_CONDITIONAL([BUILD_KJ_TLS], [test "$with_openssl" != no])
+
 AC_CONFIG_FILES([Makefile] CAPNP_PKG_CONFIG_FILES CAPNP_CMAKE_CONFIG_FILES)
 AC_OUTPUT