diff --git a/src/core/debug/trace.c b/src/core/debug/trace.c
index b8eb755bffc..6f84ee2c305 100644
--- a/src/core/debug/trace.c
+++ b/src/core/debug/trace.c
@@ -83,6 +83,8 @@ static void parse(const char *s) {
       grpc_trace_bits |= GRPC_TRACE_SECURE_ENDPOINT;
     } else if (0 == strcmp(s, "http")) {
       grpc_trace_bits |= GRPC_TRACE_HTTP;
+    } else if (0 == strcmp(s, "ssl")) {
+      grpc_trace_bits |= GRPC_TRACE_SSL;
     } else if (0 == strcmp(s, "all")) {
       grpc_trace_bits = -1;
     } else {
diff --git a/src/core/debug/trace.h b/src/core/debug/trace.h
index bf9b8a3642c..a653fad2bbb 100644
--- a/src/core/debug/trace.h
+++ b/src/core/debug/trace.h
@@ -46,7 +46,8 @@ typedef enum {
   GRPC_TRACE_CHANNEL = 1 << 1,
   GRPC_TRACE_TCP = 1 << 2,
   GRPC_TRACE_SECURE_ENDPOINT = 1 << 3,
-  GRPC_TRACE_HTTP = 1 << 4
+  GRPC_TRACE_HTTP = 1 << 4,
+  GRPC_TRACE_SSL = 1 << 5
 } grpc_trace_bit_value;
 
 #if GRPC_ENABLE_TRACING
diff --git a/src/core/tsi/ssl_transport_security.c b/src/core/tsi/ssl_transport_security.c
index 9ca8e6ddc98..c13b2d5ea18 100644
--- a/src/core/tsi/ssl_transport_security.c
+++ b/src/core/tsi/ssl_transport_security.c
@@ -39,6 +39,7 @@
 #include <grpc/support/sync.h>
 #include <grpc/support/thd.h>
 #include <grpc/support/useful.h>
+#include "src/core/debug/trace.h"
 #include "src/core/tsi/transport_security.h"
 
 #include <openssl/bio.h>
@@ -162,7 +163,7 @@ static const char* ssl_error_string(int error) {
 /* TODO(jboeuf): Remove when we are past the debugging phase with this code. */
 static void ssl_log_where_info(const SSL* ssl, int where, int flag,
                                const char* msg) {
-  if (where & flag) {
+  if ((where & flag) && (grpc_trace_bits & GRPC_TRACE_SSL)) {
     gpr_log(GPR_INFO, "%20.20s - %30.30s  - %5.10s", msg,
             SSL_state_string_long(ssl), SSL_state_string(ssl));
   }