diff --git a/lfs/openssl b/lfs/openssl
index bd7098039..6e17e79e6 100644
--- a/lfs/openssl
+++ b/lfs/openssl
@@ -131,6 +131,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
 	cd $(DIR_APP) && ./Configure $(CONFIGURE_OPTIONS) \
 		$(CFLAGS) $(LDFLAGS)
 
+	# Apply patch for changing DEFAULT cipher list (needed after configure)
+	cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/openssl-1.1.0g-weak-ciphers.patch
+
 	cd $(DIR_APP) && make depend
 	cd $(DIR_APP) && make
 
diff --git a/src/patches/openssl-1.1.0g-weak-ciphers.patch b/src/patches/openssl-1.1.0g-weak-ciphers.patch
new file mode 100644
index 000000000..66dad2bee
--- /dev/null
+++ b/src/patches/openssl-1.1.0g-weak-ciphers.patch
@@ -0,0 +1,11 @@
+--- openssl-1.1.0g-orig/include/openssl/ssl.h	2017-11-02 15:29:05.000000000 +0100
++++ openssl-1.1.0g/include/openssl/ssl.h	2018-02-27 18:23:43.522649728 +0100
+@@ -194,7 +194,7 @@
+  * The following cipher list is used by default. It also is substituted when
+  * an application-defined cipher list string starts with 'DEFAULT'.
+  */
+-# define SSL_DEFAULT_CIPHER_LIST "ALL:!COMPLEMENTOFDEFAULT:!eNULL"
++# define SSL_DEFAULT_CIPHER_LIST "kEECDH+ECDSA:kEECDH:kEDH:HIGH:+SHA:+kRSA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!kECDH:!IDEA:!SEED:!RC4:!kDH:!DSS"
+ /*
+  * As of OpenSSL 1.0.0, ssl_create_cipher_list() in ssl/ssl_ciph.c always
+  * starts with a reasonable order, and all we have to do for DEFAULT is