diff --git a/ChangeLog b/ChangeLog
index a162d2913..b6c6d23cf 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -6,6 +6,8 @@
      the ssh-rand-helper program. You can force the use of ssh-rand-helper
      using the --with-rand-helper configure argument
    - Simplify and clean up ssh-rand-helper configuration
+   - Add OpenSSL sanity check: verify that header version matches version
+     reported by library
  - (djm) Fix some bugs I introduced into ssh-rand-helper yesterday
 
 20020121
@@ -7154,4 +7156,4 @@
  - Wrote replacements for strlcpy and mkdtemp
  - Released 1.0pre1
 
-$Id: ChangeLog,v 1.1723 2002/01/22 10:58:27 djm Exp $
+$Id: ChangeLog,v 1.1724 2002/01/22 11:16:03 djm Exp $
diff --git a/configure.ac b/configure.ac
index 9cc7dc97c..966f81265 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1,4 +1,4 @@
-i# $Id: configure.ac,v 1.11 2002/01/22 10:57:54 djm Exp $
+i# $Id: configure.ac,v 1.12 2002/01/22 11:16:05 djm Exp $
 
 AC_INIT
 AC_CONFIG_SRCDIR([ssh.c])
@@ -812,6 +812,23 @@ else
 	fi
 fi
 
+# Sanity check OpenSSL headers
+AC_MSG_CHECKING([whether OpenSSL's headers match the library])
+AC_TRY_RUN(
+	[
+#include <string.h>
+#include <openssl/opensslv.h>
+int main(void) { return(SSLeay() == OPENSSL_VERSION_NUMBER ? 0 : 1); }
+	],
+	[
+		AC_MSG_RESULT(yes)
+	],
+	[
+		AC_MSG_RESULT(no)
+		AC_MSG_ERROR(Your OpenSSL headers do not match your library)
+	]
+)
+
 # Some Linux systems (Slackware) need crypt() from libcrypt, *not* the 
 # version in OpenSSL. Skip this for PAM
 if test "x$PAM_MSG" = "xno" -a "x$check_for_libcrypt_later" = "x1"; then