diff --git a/CHANGES b/CHANGES
index 5b2059d7c0..5366c9f679 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,6 @@
+2214.	[bug]		Deregister OpenSSL lock callback when cleaning
+			up. [RT #17098]
+
 2213.	[bug]		SIG0 diagnostic failure messages were looking at the
 			wrong status code. [RT #17101]
 
diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
index 525905c188..51fda69530 100644
--- a/lib/dns/openssl_link.c
+++ b/lib/dns/openssl_link.c
@@ -18,7 +18,7 @@
 
 /*
  * Principal Author: Brian Wellington
- * $Id: openssl_link.c,v 1.1.4.3 2006/05/23 23:51:03 marka Exp $
+ * $Id: openssl_link.c,v 1.1.4.4 2007/08/27 03:12:53 marka Exp $
  */
 #ifdef OPENSSL
 
@@ -171,6 +171,7 @@ dst__openssl_init() {
 	mem_free(rm);
 #endif
  cleanup_mutexinit:
+	CRYPTO_set_locking_callback(NULL);
 	DESTROYMUTEXBLOCK(locks, nlocks);
  cleanup_mutexalloc:
 	mem_free(locks);
@@ -186,12 +187,13 @@ dst__openssl_destroy() {
 		e = NULL;
 	}
 #endif
+	if (rm != NULL)
+		mem_free(rm);
 	if (locks != NULL) {
+		CRYPTO_set_locking_callback(NULL);
 		DESTROYMUTEXBLOCK(locks, nlocks);
 		mem_free(locks);
 	}
-	if (rm != NULL)
-		mem_free(rm);
 }
 
 isc_result_t