diff --git a/src/ssl_sample.c b/src/ssl_sample.c
index 5509e1f..f1ee39d 100644
--- a/src/ssl_sample.c
+++ b/src/ssl_sample.c
@@ -1198,6 +1198,9 @@
 	char *src = NULL;
 	const char *sfx;
 
+	if (global_ssl.keylog <= 0)
+		return 0;
+
 	conn = (kw[4] != 'b') ? objt_conn(smp->sess->origin) :
 	       smp->strm ? cs_conn(objt_cs(smp->strm->si[1].end)) : NULL;
 
diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 3224c96..aeeb3c9 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -4467,7 +4467,9 @@
 	SSL_CTX_set_msg_callback(ctx, ssl_sock_msgcbk);
 #endif
 #ifdef HAVE_SSL_KEYLOG
-	SSL_CTX_set_keylog_callback(ctx, SSL_CTX_keylog);
+	/* only activate the keylog callback if it was required to prevent performance loss */
+	if (global_ssl.keylog > 0)
+		SSL_CTX_set_keylog_callback(ctx, SSL_CTX_keylog);
 #endif
 
 #if defined(OPENSSL_NPN_NEGOTIATED) && !defined(OPENSSL_NO_NEXTPROTONEG)