diff --git a/internal/rosa/all.go b/internal/rosa/all.go
index 2b0727c..04ac522 100644
--- a/internal/rosa/all.go
+++ b/internal/rosa/all.go
@@ -45,6 +45,7 @@ const (
 	NSS
 	NSSCACert
 	Ninja
+	OpenSSL
 	Packaging
 	Patch
 	Perl
@@ -129,6 +130,7 @@ func ResolveName(name string) (p PArtifact, ok bool) {
 		"nss":               NSS,
 		"nss-cacert":        NSSCACert,
 		"ninja":             Ninja,
+		"openssl":           OpenSSL,
 		"packaging":         Packaging,
 		"patch":             Patch,
 		"perl":              Perl,
diff --git a/internal/rosa/openssl.go b/internal/rosa/openssl.go
new file mode 100644
index 0000000..6921a8d
--- /dev/null
+++ b/internal/rosa/openssl.go
@@ -0,0 +1,38 @@
+package rosa
+
+import "hakurei.app/internal/pkg"
+
+func (t Toolchain) newOpenSSL() pkg.Artifact {
+	const (
+		version  = "3.5.5"
+		checksum = "I2Hp1LxcTR8j4G6LFEQMVy6EJH-Na1byI9Ti-ThBot6EMLNRnjGXGq-WXrim3Fkz"
+	)
+	return t.New("openssl-"+version, 0, []pkg.Artifact{
+		t.Load(Perl),
+		t.Load(Make),
+
+		t.Load(Zlib),
+		t.Load(KernelHeaders),
+	}, nil, []string{
+		"CC=cc",
+	}, `
+cd "$(mktemp -d)"
+/usr/src/openssl/Configure \
+	--prefix=/system
+make \
+	"-j$(nproc)" \
+	HARNESS_JOBS=256 \
+	test
+make DESTDIR=/work install
+
+mv \
+	/work/system/lib64 \
+	/work/system/lib
+`, pkg.Path(AbsUsrSrc.Append("openssl"), false, pkg.NewHTTPGetTar(
+		nil, "https://github.com/openssl/openssl/releases/download/"+
+			"openssl-"+version+"/openssl-"+version+".tar.gz",
+		mustDecode(checksum),
+		pkg.TarGzip,
+	)))
+}
+func init() { artifactsF[OpenSSL] = Toolchain.newOpenSSL }