diff --git a/boot/arm-trusted-firmware/arm-trusted-firmware.mk b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
index e8d1c6205b..4bac916e31 100644
--- a/boot/arm-trusted-firmware/arm-trusted-firmware.mk
+++ b/boot/arm-trusted-firmware/arm-trusted-firmware.mk
@@ -55,6 +55,19 @@ ARM_TRUSTED_FIRMWARE_MAKE_TARGETS = all
 
 ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_FIP),y)
 ARM_TRUSTED_FIRMWARE_MAKE_TARGETS += fip
+ARM_TRUSTED_FIRMWARE_DEPENDENCIES += host-openssl
+# fiptool only exists in newer (>= 1.3) versions of ATF, so we build
+# it conditionally. We need to explicitly build it as it requires
+# OpenSSL, and therefore needs to be passed proper variables to find
+# the host OpenSSL.
+define ARM_TRUSTED_FIRMWARE_BUILD_FIPTOOL
+	if test -d $(@D)/tools/fiptool; then \
+		$(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D)/tools/fiptool \
+			$(ARM_TRUSTED_FIRMWARE_MAKE_OPTS) \
+			CPPFLAGS="$(HOST_CPPFLAGS)" \
+			LDLIBS="$(HOST_LDFLAGS) -lcrypto" ; \
+	fi
+endef
 endif
 
 ifeq ($(BR2_TARGET_ARM_TRUSTED_FIRMWARE_BL31),y)
@@ -62,6 +75,7 @@ ARM_TRUSTED_FIRMWARE_MAKE_TARGETS += bl31
 endif
 
 define ARM_TRUSTED_FIRMWARE_BUILD_CMDS
+	$(ARM_TRUSTED_FIRMWARE_BUILD_FIPTOOL)
 	$(TARGET_CONFIGURE_OPTS) \
 		$(MAKE) -C $(@D) $(ARM_TRUSTED_FIRMWARE_MAKE_OPTS) \
 			$(ARM_TRUSTED_FIRMWARE_MAKE_TARGETS)