diff --git a/ChangeLog b/ChangeLog
index 37f9f4866..3754146b6 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -44,6 +44,8 @@
      from draft6 of the spec and will not be in the RFC when published.  Patch
      from mdb at juniper net via bz#2023, ok markus.
  - (dtucker) [myproposal.h] Remove trailing backslash to fix compile error.
+ - (dtucker) [key.c] ifdef out sha256 key types on platforms that don't have
+   the required functions in libcrypto.
 
 20120628
  - (dtucker) [openbsd-compat/getrrsetbyname-ldns.c] bz #2022: prevent null
diff --git a/key.c b/key.c
index 8ef0b7e3c..7e9099703 100644
--- a/key.c
+++ b/key.c
@@ -342,9 +342,11 @@ key_fingerprint_raw(Key *k, enum fp_type dgst_type, u_int *dgst_raw_length)
 	case SSH_FP_SHA1:
 		md = EVP_sha1();
 		break;
+#ifdef HAVE_EVP_SHA256
 	case SSH_FP_SHA256:
 		md = EVP_sha256();
 		break;
+#endif
 	default:
 		fatal("key_fingerprint_raw: bad digest type %d",
 		    dgst_type);