diff --git a/packages/security/openssl/package.mk b/packages/security/openssl/package.mk
index d686980837..a3176a5edf 100644
--- a/packages/security/openssl/package.mk
+++ b/packages/security/openssl/package.mk
@@ -2,32 +2,27 @@
 # Copyright (C) 2016-present Team LibreELEC (https://libreelec.tv)
 
 PKG_NAME="openssl"
-PKG_VERSION="1.0.2r"
-PKG_SHA256="ae51d08bba8a83958e894946f15303ff894d75c2b8bbd44a852b64e3fe11d0d6"
+PKG_VERSION="1.1.1a"
+PKG_SHA256="fc20130f8b7cbd2fb918b2f14e2f429e109c31ddd0fb38fc5d71d9ffed3f9f41"
 PKG_LICENSE="BSD"
 PKG_SITE="https://www.openssl.org"
 PKG_URL="https://www.openssl.org/source/$PKG_NAME-$PKG_VERSION.tar.gz"
 PKG_DEPENDS_HOST="ccache:host"
 PKG_DEPENDS_TARGET="toolchain"
 PKG_LONGDESC="The Open Source toolkit for Secure Sockets Layer and Transport Layer Security"
+PKG_TOOLCHAIN="configure"
 PKG_BUILD_FLAGS="-parallel"
 
 PKG_CONFIGURE_OPTS_SHARED="--libdir=lib \
                            shared \
                            threads \
                            no-ec2m \
-                           no-gmp \
-                           no-jpake \
-                           no-krb5 \
-                           no-libunbound \
                            no-md2 \
                            no-rc5 \
-                           no-rfc3779
+                           no-rfc3779 \
                            no-sctp \
                            no-ssl-trace \
-                           no-ssl2 \
                            no-ssl3 \
-                           no-store \
                            no-unit-test \
                            no-weak-ssl-ciphers \
                            no-zlib \
@@ -39,6 +34,10 @@ PKG_CONFIGURE_OPTS_HOST="--prefix=$TOOLCHAIN \
 PKG_CONFIGURE_OPTS_TARGET="--prefix=/usr \
                            --openssldir=/etc/ssl"
 
+post_unpack() {
+  find $PKG_BUILD/apps -type f | xargs -n 1 -t sed 's|./demoCA|/etc/ssl|' -i
+}
+
 pre_configure_host() {
   mkdir -p $PKG_BUILD/.$HOST_NAME
   cp -a $PKG_BUILD/* $PKG_BUILD/.$HOST_NAME/
@@ -77,10 +76,8 @@ configure_target() {
 }
 
 makeinstall_target() {
-  make INSTALL_PREFIX=$INSTALL install_sw
-  make INSTALL_PREFIX=$SYSROOT_PREFIX install_sw
-  chmod 755 $INSTALL/usr/lib/*.so*
-  chmod 755 $INSTALL/usr/lib/engines/*.so
+  make DESTDIR=$INSTALL install_sw
+  make DESTDIR=$SYSROOT_PREFIX install_sw
 }
 
 post_makeinstall_target() {
diff --git a/packages/security/openssl/patches/openssl-0001-ca-dir.patch b/packages/security/openssl/patches/openssl-0001-ca-dir.patch
deleted file mode 100644
index 55692f0aff..0000000000
--- a/packages/security/openssl/patches/openssl-0001-ca-dir.patch
+++ /dev/null
@@ -1,33 +0,0 @@
---- openssl-1.0.2j/apps/CA.pl.in	2006-04-28 02:30:49.000000000 +0200
-+++ openssl-1.0.2j/apps/CA.pl.in	2010-04-01 00:35:02.600553509 +0200
-@@ -53,7 +53,7 @@
- $X509="$openssl x509";
- $PKCS12="$openssl pkcs12";
- 
--$CATOP="./demoCA";
-+$CATOP="/etc/ssl";
- $CAKEY="cakey.pem";
- $CAREQ="careq.pem";
- $CACERT="cacert.pem";
---- openssl-1.0.2j/apps/CA.sh	2009-10-15 19:27:47.000000000 +0200
-+++ openssl-1.0.2j/apps/CA.sh	2010-04-01 00:35:02.600553509 +0200
-@@ -68,7 +68,7 @@
- X509="$OPENSSL x509"
- PKCS12="openssl pkcs12"
- 
--if [ -z "$CATOP" ] ; then CATOP=./demoCA ; fi
-+if [ -z "$CATOP" ] ; then CATOP=/etc/ssl ; fi
- CAKEY=./cakey.pem
- CAREQ=./careq.pem
- CACERT=./cacert.pem
---- openssl-1.0.2j/apps/openssl.cnf	2009-04-04 20:09:43.000000000 +0200
-+++ openssl-1.0.2j/apps/openssl.cnf	2010-04-01 00:35:02.607220681 +0200
-@@ -39,7 +39,7 @@
- ####################################################################
- [ CA_default ]
- 
--dir		= ./demoCA		# Where everything is kept
-+dir		= /etc/ssl		# Where everything is kept
- certs		= $dir/certs		# Where the issued certs are kept
- crl_dir		= $dir/crl		# Where the issued crl are kept
- database	= $dir/index.txt	# database index file.