--- a/python/mozbuild/mozbuild/vendor_rust.py
+++ b/python/mozbuild/mozbuild/vendor_rust.py
@@ -49,31 +49,60 @@ class VendorRust(MozbuildObject):
                      '''You have uncommitted changes to the following files:
 
 {files}
 
 Please commit or stash these changes before vendoring, or re-run with `--ignore-modified`.
 '''.format(files='\n'.join(sorted(modified))))
             sys.exit(1)
 
+    def check_openssl(self):
+        '''
+        Set environment flags for building with openssl.
+
+        MacOS doesn't include openssl, but the openssl-sys crate used by
+        mach-vendor expects one of the system. It's common to have one
+        installed in /usr/local/opt/openssl by homebrew, but custom link
+        flags are necessary to build against it.
+        '''
+
+        test_paths = ['/usr/include', '/usr/local/include']
+        if any([os.path.exists(os.path.join(path, 'openssl/ssl.h')) for path in test_paths]):
+            # Assume we can use one of these system headers.
+            return None
+
+        if os.path.exists('/usr/local/opt/openssl/include/openssl/ssl.h'):
+            # Found a likely homebrew install.
+            self.log(logging.INFO, 'openssl', {},
+                    'Using OpenSSL in /usr/local/opt/openssl')
+            return {
+                 'OPENSSL_INCLUDE_DIR': '/usr/local/opt/openssl/include',
+                 'DEP_OPENSSL_INCLUDE': '/usr/local/opt/openssl/include',
+            }
+
+        self.log(logging.ERROR, 'openssl', {}, "OpenSSL not found!")
+        return None
+
     def vendor(self, ignore_modified=False):
         self.populate_logger()
         self.log_manager.enable_unstructured()
         if not ignore_modified:
             self.check_modified_files()
         cargo = self.get_cargo_path()
         if not self.check_cargo_version(cargo):
             self.log(logging.ERROR, 'cargo_version', {}, 'Cargo >= 0.13 required (install Rust 1.12 or newer)')
             return
         else:
             self.log(logging.DEBUG, 'cargo_version', {}, 'cargo is new enough')
         have_vendor = any(l.strip() == 'vendor' for l in subprocess.check_output([cargo, '--list']).splitlines())
         if not have_vendor:
             self.log(logging.INFO, 'installing', {}, 'Installing cargo-vendor')
-            self.run_process(args=[cargo, 'install', 'cargo-vendor'])
+            env = self.check_openssl()
+            self.run_process(args=[cargo, 'install', 'cargo-vendor'],
+                             append_env=env)
         else:
             self.log(logging.DEBUG, 'cargo_vendor', {}, 'cargo-vendor already intalled')
         vendor_dir = mozpath.join(self.topsrcdir, 'third_party/rust')
         self.log(logging.INFO, 'rm_vendor_dir', {}, 'rm -rf %s' % vendor_dir)
         mozfile.remove(vendor_dir)
         # Once we require a new enough cargo to switch to workspaces, we can
         # just do this once on the workspace root crate.
         for crate_root in ('toolkit/library/rust/',