I suspect #12047 (closed) missed this because OpenSSL is pulled in implicitly via the h2o dependency.