diff --git a/Dockerfile b/Dockerfile
index 355429f28..e819c3f93 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,6 +1,12 @@
 FROM golang:1.13.6-buster
 LABEL maintainer="Steven Allen <steven@stebalien.com>"
 
+# Install deps
+RUN apt-get update && apt-get install -y \
+  libssl-dev \
+  ca-certificates \
+  fuse
+
 ENV SRC_DIR /go-ipfs
 
 # Download packages first so they can be cached.
@@ -14,7 +20,7 @@ COPY . $SRC_DIR
 # Also: fix getting HEAD commit hash via git rev-parse.
 RUN cd $SRC_DIR \
   && mkdir .git/objects \
-  && make build
+  && make build GOFLAGS=-tags=openssl
 
 # Get su-exec, a very minimal tool for dropping privileges,
 # and tini, a very minimal init daemon for containers
@@ -30,12 +36,6 @@ RUN set -x \
   && wget -q -O tini https://github.com/krallin/tini/releases/download/$TINI_VERSION/tini \
   && chmod +x tini
 
-# Get the TLS CA certificates, they're not provided by busybox.
-RUN apt-get update && apt-get install -y ca-certificates
-
-# Install FUSE
-RUN apt-get update && apt-get install -y fuse
-
 # Now comes the actual target image, which aims to be as small as possible.
 FROM busybox:1.31.0-glibc
 LABEL maintainer="Steven Allen <stven@stebalien.com>"
@@ -55,6 +55,10 @@ RUN chmod 4755 /usr/local/bin/fusermount
 # This shared lib (part of glibc) doesn't seem to be included with busybox.
 COPY --from=0 /lib/x86_64-linux-gnu/libdl.so.2 /lib/libdl.so.2
 
+# Copy over SSL libraries.
+COPY --from=0 /usr/lib/x86_64-linux-gnu/libssl.so* /usr/lib/
+COPY --from=0 /usr/lib/x86_64-linux-gnu/libcrypto.so* /usr/lib/
+
 # Swarm TCP; should be exposed to the public
 EXPOSE 4001
 # Daemon API; must not be exposed publicly but to client services under you control