diff --git a/ssl/s3_cbc.c b/ssl/s3_cbc.c
index 2c87b27eb1..da53a6da3b 100644
--- a/ssl/s3_cbc.c
+++ b/ssl/s3_cbc.c
@@ -339,7 +339,9 @@ static void tls1_sha1_final_raw(void* ctx, unsigned char *md_out)
 	l2n(sha1->h3, md_out);
 	l2n(sha1->h4, md_out);
 	}
+#define LARGEST_DIGEST_CTX SHA_CTX
 
+#ifndef OPENSSL_NO_SHA256
 static void tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
 	{
 	SHA256_CTX *sha256 = ctx;
@@ -350,7 +352,11 @@ static void tls1_sha256_final_raw(void* ctx, unsigned char *md_out)
 		l2n(sha256->h[i], md_out);
 		}
 	}
+#undef  LARGEST_DIGEST_CTX
+#define LARGEST_DIGEST_CTX SHA256_CTX
+#endif
 
+#ifndef OPENSSL_NO_SHA512
 static void tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
 	{
 	SHA512_CTX *sha512 = ctx;
@@ -361,6 +367,9 @@ static void tls1_sha512_final_raw(void* ctx, unsigned char *md_out)
 		l2n8(sha512->h[i], md_out);
 		}
 	}
+#undef  LARGEST_DIGEST_CTX
+#define LARGEST_DIGEST_CTX SHA512_CTX
+#endif
 
 /* ssl3_cbc_record_digest_supported returns 1 iff |ctx| uses a hash function
  * which ssl3_cbc_digest_record supports. */
@@ -374,10 +383,14 @@ char ssl3_cbc_record_digest_supported(const EVP_MD_CTX *ctx)
 		{
 		case NID_md5:
 		case NID_sha1:
+#ifndef OPENSSL_NO_SHA256
 		case NID_sha224:
 		case NID_sha256:
+#endif
+#ifndef OPENSSL_NO_SHA512
 		case NID_sha384:
 		case NID_sha512:
+#endif
 			return 1;
 		default:
 			return 0;
@@ -416,7 +429,7 @@ void ssl3_cbc_digest_record(
 	char is_sslv3)
 	{
 	union {	double align;
-		unsigned char c[sizeof(SHA512_CTX)]; } md_state;
+		unsigned char c[sizeof(LARGEST_DIGEST_CTX)]; } md_state;
 	void (*md_final_raw)(void *ctx, unsigned char *md_out);
 	void (*md_transform)(void *ctx, const unsigned char *block);
 	unsigned md_size, md_block_size = 64;
@@ -454,6 +467,7 @@ void ssl3_cbc_digest_record(
 			md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA1_Transform;
 			md_size = 20;
 			break;
+#ifndef OPENSSL_NO_SHA256
 		case NID_sha224:
 			SHA224_Init((SHA256_CTX*)md_state.c);
 			md_final_raw = tls1_sha256_final_raw;
@@ -466,6 +480,8 @@ void ssl3_cbc_digest_record(
 			md_transform = (void(*)(void *ctx, const unsigned char *block)) SHA256_Transform;
 			md_size = 32;
 			break;
+#endif
+#ifndef OPENSSL_NO_SHA512
 		case NID_sha384:
 			SHA384_Init((SHA512_CTX*)md_state.c);
 			md_final_raw = tls1_sha512_final_raw;
@@ -482,6 +498,7 @@ void ssl3_cbc_digest_record(
 			md_block_size = 128;
 			md_length_size = 16;
 			break;
+#endif
 		default:
 			/* ssl3_cbc_record_digest_supported should have been
 			 * called first to check that the hash function is