diff --git a/CMakeLists.txt b/CMakeLists.txt
index eb998fb0f3..b97704bfef 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -448,8 +448,6 @@ if(CURL_USE_OPENSSL)
   if(NOT DEFINED HAVE_BORINGSSL)
     check_symbol_exists(OPENSSL_IS_BORINGSSL "openssl/base.h" HAVE_BORINGSSL)
   endif()
-
-  add_definitions(-DOPENSSL_SUPPRESS_DEPRECATED)
 endif()
 
 if(CURL_USE_MBEDTLS)
diff --git a/lib/curl_setup.h b/lib/curl_setup.h
index 0a4a159c08..a8cc71503e 100644
--- a/lib/curl_setup.h
+++ b/lib/curl_setup.h
@@ -862,4 +862,10 @@ int getpwuid_r(uid_t uid, struct passwd *pwd, char *buf,
 #  endif
 #endif
 
+/* OpenSSLv3 marks DES, MD5 and ENGINE functions deprecated but we have no
+   replacements (yet) so tell the compiler to not warn for them. */
+#ifdef USE_OPENSSL
+#define OPENSSL_SUPPRESS_DEPRECATED
+#endif
+
 #endif /* HEADER_CURL_SETUP_H */
diff --git a/m4/curl-amissl.m4 b/m4/curl-amissl.m4
index 4d59fcc790..4b80842b91 100644
--- a/m4/curl-amissl.m4
+++ b/m4/curl-amissl.m4
@@ -55,11 +55,6 @@ if test "$HAVE_PROTO_BSDSOCKET_H" = "1"; then
       AC_DEFINE_UNQUOTED(HAVE_OPENSSL3, 1, [Define to 1 if using OpenSSL 3 or later.])
       AC_CHECK_HEADERS(openssl/x509.h openssl/rsa.h openssl/crypto.h \
                        openssl/pem.h openssl/ssl.h openssl/err.h)
-      dnl OpenSSLv3 marks the DES functions deprecated but we have no
-      dnl replacements (yet) so tell the compiler to not warn for them
-      dnl
-      dnl Ask OpenSSL to suppress the warnings.
-      CPPFLAGS="$CPPFLAGS -DOPENSSL_SUPPRESS_DEPRECATED"
     ],[
       AC_MSG_RESULT([no])
     ])
diff --git a/m4/curl-openssl.m4 b/m4/curl-openssl.m4
index 199288165f..e41569f37a 100644
--- a/m4/curl-openssl.m4
+++ b/m4/curl-openssl.m4
@@ -310,11 +310,6 @@ if test "x$OPT_OPENSSL" != xno; then
       AC_MSG_RESULT([yes])
       AC_DEFINE_UNQUOTED(HAVE_OPENSSL3, 1,
         [Define to 1 if using OpenSSL 3 or later.])
-      dnl OpenSSLv3 marks the DES functions deprecated but we have no
-      dnl replacements (yet) so tell the compiler to not warn for them
-      dnl
-      dnl Ask OpenSSL to suppress the warnings.
-      CPPFLAGS="$CPPFLAGS -DOPENSSL_SUPPRESS_DEPRECATED"
       ssl_msg="OpenSSL v3+"
     ],[
       AC_MSG_RESULT([no])