diff --git a/pkgs/tools/networking/ntp/default.nix b/pkgs/tools/networking/ntp/default.nix
index fca6f2e34adc..4c0b893b91db 100644
--- a/pkgs/tools/networking/ntp/default.nix
+++ b/pkgs/tools/networking/ntp/default.nix
@@ -1,4 +1,4 @@
-{ stdenv, fetchurl, pkgconfig, libcap, openssl }:
+{ stdenv, fetchurl, libcap, autoreconfHook }:
 
 assert stdenv.isLinux -> libcap != null;
 
@@ -10,10 +10,16 @@ stdenv.mkDerivation rec {
     sha256 = "1vnqa1542d01xmlkw8f3rq57y360b2j7yxkkg9b11955nvw0v4if";
   };
 
-  nativeBuildInputs = [ pkgconfig ];
+  patches = [ ./no-openssl.patch ];
 
-  buildInputs = [ openssl ]
-    ++ stdenv.lib.optional stdenv.isLinux libcap;
+  configureFlags = ''
+    --without-crypto
+    ${if stdenv.isLinux then "--enable-linuxcaps" else ""}
+  '';
+
+  buildInputs = [ autoreconfHook ] ++ stdenv.lib.optional stdenv.isLinux libcap;
+
+  postInstall = "rm -rf $out/share/doc";
 
   meta = {
     homepage = http://www.ntp.org/;
diff --git a/pkgs/tools/networking/ntp/no-openssl.patch b/pkgs/tools/networking/ntp/no-openssl.patch
new file mode 100644
index 000000000000..3a7784016ffa
--- /dev/null
+++ b/pkgs/tools/networking/ntp/no-openssl.patch
@@ -0,0 +1,161 @@
+Fix ntp-keygen build without OpenSSL
+
+http://bk1.ntp.org/ntp-stable/?PAGE=patch&REV=5497b345z5MNTuNvJWuqPSje25NQTg
+
+Index: ntp-4.2.8/Makefile.am
+===================================================================
+--- ntp-4.2.8.orig/Makefile.am
++++ ntp-4.2.8/Makefile.am
+@@ -2,7 +2,10 @@ ACLOCAL_AMFLAGS = -I sntp/m4 -I sntp/lib
+ 
+ NULL =
+ 
++# moved sntp first to get libtool and libevent built.
++
+ SUBDIRS =		\
++	sntp		\
+ 	scripts		\
+ 	include		\
+ 	libntp		\
+@@ -17,7 +20,6 @@ SUBDIRS =		\
+ 	clockstuff	\
+ 	kernel		\
+ 	util		\
+-	sntp		\
+ 	tests		\
+ 	$(NULL)
+ 
+@@ -64,7 +66,6 @@ BUILT_SOURCES =				\
+ 	.gcc-warning			\
+ 	libtool				\
+ 	html/.datecheck			\
+-	sntp/built-sources-only		\
+ 	$(srcdir)/COPYRIGHT		\
+ 	$(srcdir)/.checkChangeLog	\
+ 	$(NULL)
+Index: ntp-4.2.8/configure.ac
+===================================================================
+--- ntp-4.2.8.orig/configure.ac
++++ ntp-4.2.8/configure.ac
+@@ -102,7 +102,7 @@ esac
+ enable_nls=no
+ LIBOPTS_CHECK_NOBUILD([sntp/libopts])
+ 
+-NTP_ENABLE_LOCAL_LIBEVENT
++NTP_LIBEVENT_CHECK_NOBUILD([2], [sntp/libevent])
+ 
+ NTP_LIBNTP
+ 
+@@ -771,6 +771,10 @@ esac
+ 
+ #### 
+ 
++AC_CHECK_FUNCS([arc4random_buf])
++
++#### 
++
+ saved_LIBS="$LIBS"
+ LIBS="$LIBS $LDADD_LIBNTP"
+ AC_CHECK_FUNCS([daemon])
+Index: ntp-4.2.8/libntp/ntp_crypto_rnd.c
+===================================================================
+--- ntp-4.2.8.orig/libntp/ntp_crypto_rnd.c
++++ ntp-4.2.8/libntp/ntp_crypto_rnd.c
+@@ -24,6 +24,21 @@
+ int crypto_rand_init = 0;
+ #endif
+ 
++#ifndef HAVE_ARC4RANDOM_BUF
++static void
++arc4random_buf(void *buf, size_t nbytes);
++
++void
++evutil_secure_rng_get_bytes(void *buf, size_t nbytes);
++
++static void
++arc4random_buf(void *buf, size_t nbytes)
++{
++	evutil_secure_rng_get_bytes(buf, nbytes);
++	return;
++}
++#endif
++
+ /*
+  * As of late 2014, here's how we plan to provide cryptographic-quality
+  * random numbers:
+Index: ntp-4.2.8/sntp/configure.ac
+===================================================================
+--- ntp-4.2.8.orig/sntp/configure.ac
++++ ntp-4.2.8/sntp/configure.ac
+@@ -97,11 +97,14 @@ esac
+ enable_nls=no
+ LIBOPTS_CHECK
+ 
+-AM_COND_IF(
+-    [BUILD_SNTP],
+-    [NTP_LIBEVENT_CHECK],
+-    [NTP_LIBEVENT_CHECK_NOBUILD]
+-)
++# From when we only used libevent for sntp:
++#AM_COND_IF(
++#    [BUILD_SNTP],
++#    [NTP_LIBEVENT_CHECK],
++#    [NTP_LIBEVENT_CHECK_NOBUILD]
++#)
++
++NTP_LIBEVENT_CHECK([2])
+ 
+ # Checks for libraries.
+ 
+Index: ntp-4.2.8/sntp/m4/ntp_libevent.m4
+===================================================================
+--- ntp-4.2.8.orig/sntp/m4/ntp_libevent.m4
++++ ntp-4.2.8/sntp/m4/ntp_libevent.m4
+@@ -1,4 +1,25 @@
+-dnl NTP_ENABLE_LOCAL_LIBEVENT				     -*- Autoconf -*-
++# SYNOPSIS						-*- Autoconf -*-
++#
++#  NTP_ENABLE_LOCAL_LIBEVENT
++#  NTP_LIBEVENT_CHECK([MINVERSION [, DIR]])
++#  NTP_LIBEVENT_CHECK_NOBUILD([MINVERSION [, DIR]])
++#
++# DESCRIPTION
++#
++# AUTHOR
++#
++#  Harlan Stenn
++#
++# LICENSE
++#
++#  This file is Copyright (c) 2014 Network Time Foundation
++# 
++#  Copying and distribution of this file, with or without modification, are
++#  permitted in any medium without royalty provided the copyright notice,
++#  author attribution and this notice are preserved.  This file is offered
++#  as-is, without any warranty.
++
++dnl NTP_ENABLE_LOCAL_LIBEVENT
+ dnl
+ dnl Provide only the --enable-local-libevent command-line option.
+ dnl
+@@ -29,7 +50,7 @@ dnl If NOBUILD is provided as the 3rd ar
+ dnl but DO NOT invoke DIR/configure if we are going to use our bundled
+ dnl version.  This may be the case for nested packages.
+ dnl
+-dnl provide --enable-local-libevent .
++dnl provides --enable-local-libevent .
+ dnl
+ dnl Examples:
+ dnl
+Index: ntp-4.2.8/util/Makefile.am
+===================================================================
+--- ntp-4.2.8.orig/util/Makefile.am
++++ ntp-4.2.8/util/Makefile.am
+@@ -19,6 +19,7 @@ AM_LDFLAGS = $(LDFLAGS_NTP)
+ LDADD=		../libntp/libntp.a $(LDADD_LIBNTP) $(LIBM) $(PTHREAD_LIBS)
+ tg2_LDADD=	../libntp/libntp.a $(LDADD_LIBNTP) $(LIBM)
+ ntp_keygen_LDADD  = version.o $(LIBOPTS_LDADD) ../libntp/libntp.a
++ntp_keygen_LDADD += $(LDADD_LIBEVENT)
+ ntp_keygen_LDADD += $(LDADD_LIBNTP) $(PTHREAD_LIBS) $(LDADD_NTP) $(LIBM)
+ ntp_keygen_SOURCES = ntp-keygen.c ntp-keygen-opts.c ntp-keygen-opts.h
+