diff --git a/mysql-test/valgrind.supp b/mysql-test/valgrind.supp
index 0c75b4facab..c05611d35f1 100644
--- a/mysql-test/valgrind.supp
+++ b/mysql-test/valgrind.supp
@@ -1094,6 +1094,18 @@
    fun:row_drop_table_for_mysql
 }
 
+{
+   OpenSSL still reachable.
+   Memcheck:Leak
+   fun:*alloc
+   fun:CRYPTO_malloc
+   fun:sk_new
+   obj:*libssl*
+   fun:SSL_COMP_get_compression_methods
+   fun:SSL_library_init
+}
+
+
 {
   Problem with udf and libresolve
   Memcheck:Cond
diff --git a/sql/mysqld.cc b/sql/mysqld.cc
index 393296bd471..dde5dcc447e 100644
--- a/sql/mysqld.cc
+++ b/sql/mysqld.cc
@@ -2207,6 +2207,9 @@ bool one_thread_per_connection_end(THD *thd, bool put_in_cache)
   /* It's safe to broadcast outside a lock (COND... is not deleted here) */
   DBUG_PRINT("signal", ("Broadcasting COND_thread_count"));
   DBUG_LEAVE;                                   // Must match DBUG_ENTER()
+#ifndef EMBEDDED_LIBRARY
+  ERR_remove_state(0);
+#endif
   my_thread_end();
   (void) pthread_cond_broadcast(&COND_thread_count);
 
@@ -3857,6 +3860,7 @@ static void init_ssl()
 					  opt_ssl_ca, opt_ssl_capath,
 					  opt_ssl_cipher, &error);
     DBUG_PRINT("info",("ssl_acceptor_fd: 0x%lx", (long) ssl_acceptor_fd));
+    ERR_remove_state(0);
     if (!ssl_acceptor_fd)
     {
       sql_print_warning("Failed to setup SSL");
diff --git a/sql/slave.cc b/sql/slave.cc
index a40b7cdcc48..cf238ca3a25 100644
--- a/sql/slave.cc
+++ b/sql/slave.cc
@@ -3031,6 +3031,7 @@ err_during_init:
 
   DBUG_LEAVE;                                   // Must match DBUG_ENTER()
   my_thread_end();
+  ERR_remove_state(0);
   pthread_exit(0);
   return 0;                                     // Avoid compiler warnings
 }
@@ -3433,6 +3434,7 @@ err_during_init:
 
   DBUG_LEAVE;                                   // Must match DBUG_ENTER()
   my_thread_end();
+  ERR_remove_state(0);
   pthread_exit(0);
   return 0;                                     // Avoid compiler warnings
 }
diff --git a/vio/vio.c b/vio/vio.c
index 486fe63da05..7b2cf45142f 100644
--- a/vio/vio.c
+++ b/vio/vio.c
@@ -250,5 +250,11 @@ void vio_end(void)
 {
 #ifdef HAVE_YASSL
   yaSSL_CleanUp();
+#elif defined(HAVE_OPENSSL)
+  // This one is needed on the client side
+  ERR_remove_state(0);
+  ERR_free_strings();
+  EVP_cleanup();
+  CRYPTO_cleanup_all_ex_data();
 #endif
 }