diff --git a/Modules/Setup.dist b/Modules/Setup.dist
index 5e69a60734..90be91ec79 100644
--- a/Modules/Setup.dist
+++ b/Modules/Setup.dist
@@ -211,10 +211,10 @@ GLHACK=-Dclear=__GLclear
 
 # Socket module helper for SSL support; you must comment out the other
 # socket line above, and possibly edit the SSL variable:
-#SSL=/usr/local/ssl
-#_ssl _ssl.c \
-#	-DUSE_SSL -I$(SSL)/include -I$(SSL)/include/openssl \
-#	-L$(SSL)/lib -lssl -lcrypto
+SSL=/usr
+_ssl _ssl.c \
+	-DUSE_SSL -I$(SSL)/include -I$(SSL)/include/openssl \
+	-L$(SSL)/lib -lssl -lcrypto
 
 # The crypt module is now disabled by default because it breaks builds
 # on many systems (where -lcrypt is needed), e.g. Linux (I believe).
diff --git a/Modules/_ssl.c b/Modules/_ssl.c
index 4b0958a6bb..54bac16062 100644
--- a/Modules/_ssl.c
+++ b/Modules/_ssl.c
@@ -300,8 +300,10 @@ newPySSLObject(PySocketSockObject *Sock, char *key_file, char *cert_file,
 		self->ctx = SSL_CTX_new(TLSv1_method()); /* Set up context */
 	else if (proto_version == PY_SSL_VERSION_SSL3)
 		self->ctx = SSL_CTX_new(SSLv3_method()); /* Set up context */
+#ifndef OPENSSL_NO_SSL2
 	else if (proto_version == PY_SSL_VERSION_SSL2)
 		self->ctx = SSL_CTX_new(SSLv2_method()); /* Set up context */
+#endif
 	else if (proto_version == PY_SSL_VERSION_SSL23)
 		self->ctx = SSL_CTX_new(SSLv23_method()); /* Set up context */
 	PySSL_END_ALLOW_THREADS
diff --git a/setup.py b/setup.py
index 13d0687f67..21d8f328b1 100644
--- a/setup.py
+++ b/setup.py
@@ -353,6 +353,7 @@ def detect_modules(self):
         lib_dirs = self.compiler.library_dirs + [
             '/lib64', '/usr/lib64',
             '/lib', '/usr/lib',
+            '/usr/lib/x86_64-linux-gnu'
             ]
         inc_dirs = self.compiler.include_dirs + ['/usr/include']
         exts = []
@@ -615,7 +616,8 @@ def detect_modules(self):
                 ssl_incs += krb5_h
         ssl_libs = find_library_file(self.compiler, 'ssl',lib_dirs,
                                      ['/usr/local/ssl/lib',
-                                      '/usr/contrib/ssl/lib/'
+                                      '/usr/contrib/ssl/lib/',
+                                      'x86_64-linux-gnu'
                                      ] )
 
         if (ssl_incs is not None and