diff --git a/package/netsnmp/Config.in b/package/netsnmp/Config.in
index 589f720fa0..47a53d7ead 100644
--- a/package/netsnmp/Config.in
+++ b/package/netsnmp/Config.in
@@ -49,4 +49,11 @@ config BR2_PACKAGE_NETSNMP_ENABLE_DEBUGGING
 	  support, including the ability to log with DEBUGMSG(),
 	  DEBUGMSGTL() and companion macros.
 
+config BR2_PACKAGE_NETSNMP_OPENSSL_INTERNAL
+	bool "Enable minimal internal OpenSSL code"
+	depends on !BR2_PACKAGE_OPENSSL
+	help
+	  Enable a minimal internal copy of OpenSSL usable for USM
+	  security. It will not enable the usage of SNMP over (D)TLS.
+
 endif
diff --git a/package/netsnmp/netsnmp.mk b/package/netsnmp/netsnmp.mk
index 58b52ef6f2..655552c455 100644
--- a/package/netsnmp/netsnmp.mk
+++ b/package/netsnmp/netsnmp.mk
@@ -54,6 +54,8 @@ ifeq ($(BR2_STATIC_LIBS),y)
 	# openssl uses zlib, so we need to explicitly link with it when static
 	NETSNMP_CONF_ENV += LIBS=-lz
 endif
+else ifeq ($(BR2_PACKAGE_NETSNMP_OPENSSL_INTERNAL),y)
+	NETSNMP_CONF_OPTS += --with-openssl=internal
 else
 	NETSNMP_CONF_OPTS += --without-openssl
 endif