diff --git a/Library/Homebrew/cmd/link.rb b/Library/Homebrew/cmd/link.rb
index f4ef16e8ad..d7ea2427ca 100644
--- a/Library/Homebrew/cmd/link.rb
+++ b/Library/Homebrew/cmd/link.rb
@@ -24,7 +24,16 @@ module Homebrew
     mode.dry_run = true if ARGV.dry_run?
 
     ARGV.kegs.each do |keg|
-      if keg.linked?
+      if HOMEBREW_PREFIX.to_s == "/usr/local" && keg.name == "openssl"
+        opoo <<-EOS.undent
+          Refusing to link: openssl
+          Linking keg-only OpenSSL means you may end up linking against the insecure,
+          deprecated system version while using the headers from the Homebrew version.
+          Instead, pass the full include/library paths to your compiler e.g.:
+            -I#{HOMEBREW_PREFIX}/opt/openssl/include -L#{HOMEBREW_PREFIX}/opt/openssl/lib
+        EOS
+        next
+      elsif keg.linked?
         opoo "Already linked: #{keg}"
         puts "To relink: brew unlink #{keg.name} && brew link #{keg.name}"
         next