diff --git a/bind-9.11-pk11.patch b/bind-9.11-pk11.patch
new file mode 100644
index 0000000..d802314
--- /dev/null
+++ b/bind-9.11-pk11.patch
@@ -0,0 +1,27 @@
+diff --git a/lib/dns/dst_internal.h b/lib/dns/dst_internal.h
+index 640519a..fc40472 100644
+--- a/lib/dns/dst_internal.h
++++ b/lib/dns/dst_internal.h
+@@ -59,6 +59,9 @@
+ #include <openssl/objects.h>
+ #include <openssl/rsa.h>
+ #endif
++#if PKCS11CRYPTO
++#include <pk11/pk11.h>
++#endif
+ 
+ ISC_LANG_BEGINDECLS
+ 
+diff --git a/lib/isc/include/pk11/internal.h b/lib/isc/include/pk11/internal.h
+index aa8907a..603712a 100644
+--- a/lib/isc/include/pk11/internal.h
++++ b/lib/isc/include/pk11/internal.h
+@@ -13,6 +13,8 @@
+ #ifndef PK11_INTERNAL_H
+ #define PK11_INTERNAL_H 1
+ 
++#include <pk11/pk11.h>
++
+ /*! \file pk11/internal.h */
+ 
+ ISC_LANG_BEGINDECLS
diff --git a/bind.spec b/bind.spec
index 05bac39..511ec18 100644
--- a/bind.spec
+++ b/bind.spec
@@ -52,7 +52,7 @@ Summary:  The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv
 Name:     bind
 License:  MPLv2.0
 Version:  9.11.4
-Release:  2%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
+Release:  3%{?PATCHVER:.%{PATCHVER}}%{?PREVER:.%{PREVER}}%{?dist}
 Epoch:    32
 Url:      http://www.isc.org/products/BIND/
 #
@@ -111,6 +111,7 @@ Patch145:bind-9.11-rh1205168.patch
 Patch149:bind-9.11-kyua-pkcs11.patch
 Patch153:bind-9.11-export-suffix.patch
 Patch154:bind-9.11-oot-manual.patch
+Patch155:bind-9.11-pk11.patch
 
 # SDB patches
 Patch11: bind-9.3.2b2-sdbsrc.patch
@@ -445,6 +446,7 @@ are used for building ISC DHCP.
 %patch145 -p1 -b .rh1205168
 %patch153 -p1 -b .export_suffix
 %patch154 -p1 -b .oot-man
+%patch155 -p1 -b .pk11-internal
 
 %if %{with PKCS11}
 cp -r bin/named{,-pkcs11}
@@ -543,11 +545,11 @@ export LIBDIR_SUFFIX
   --enable-filter-aaaa \
   --with-pic \
   --disable-static \
-  --disable-openssl-version-check \
   --includedir=%{_includedir}/bind9 \
   --with-tuning=large \
   --with-geoip \
   --with-libidn2 \
+  --enable-openssl-hash \
 %if %{with PKCS11}
   --enable-native-pkcs11 \
   --with-pkcs11=%{_libdir}/pkcs11/libsofthsm2.so \
@@ -635,6 +637,7 @@ export LIBDIR_SUFFIX
         --libdir=%{_libdir}%{_export_dir} \
         --includedir=%{_includedir}%{_export_dir}/ \
         --disable-threads \
+        --enable-openssl-hash \
 %if %{with GSSTSIG}
         --with-gssapi=yes \
         --disable-isc-spnego \
@@ -1402,6 +1405,9 @@ rm -rf ${RPM_BUILD_ROOT}
 
 
 %changelog
+* Thu Aug 02 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-3
+- Use OpenSSL for digest operations (#1611537)
+
 * Tue Jul 31 2018 Petr Menšík <pemensik@redhat.com> - 32:9.11.4-2
 - Install generated manual pages