diff --git a/sandbox.d/10openssl b/sandbox.d/10openssl
new file mode 100644
index 0000000..db8a0f1
--- /dev/null
+++ b/sandbox.d/10openssl
@@ -0,0 +1 @@
+SANDBOX_PREDICT="/dev/crypto"
diff --git a/ssl/certs/README.RootCerts b/ssl/certs/README.RootCerts
new file mode 100644
index 0000000..c760b61
--- /dev/null
+++ b/ssl/certs/README.RootCerts
@@ -0,0 +1,4 @@
+The OpenSSL project does not (any longer) include root CA certificates.
+
+Please check out the FAQ:
+  * How can I set up a bundle of commercial root CA certificates?