diff --git a/krb5.spec b/krb5.spec
index 8fbe91f..4eab979 100644
--- a/krb5.spec
+++ b/krb5.spec
@@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.16
 # for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
-Release: 22%{?dist}
+Release: 23%{?dist}
 
 # lookaside-cached sources; two downloads and a build artifact
 Source0: https://web.mit.edu/kerberos/dist/krb5/1.16/krb5-%{version}%{prerelease}.tar.gz
@@ -350,6 +350,7 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`"
 	--with-dirsrv-account-locking \
 %endif
 	--enable-pkinit \
+	--with-crypto-impl=openssl \
 	--with-pkinit-crypto-impl=openssl \
 	--with-tls-impl=openssl \
 	--with-system-verto \
@@ -743,6 +744,10 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Mon Apr 23 2018 Robbie Harwood <rharwood@redhat.com> - 1.16-23
+- Explicitly use openssl rather than builtin crypto
+- Resolves: #1570910
+
 * Tue Apr 17 2018 Robbie Harwood <rharwood@redhat.com> - 1.16-22
 - Merge duplicate subsections in profile library