diff --git a/ta/pkcs11/sub.mk b/ta/pkcs11/sub.mk
index e9eebac2da1..9ce6b6944fe 100644
--- a/ta/pkcs11/sub.mk
+++ b/ta/pkcs11/sub.mk
@@ -16,7 +16,7 @@ CFG_PKCS11_TA_CHECK_VALUE_ATTRIBUTE ?= y
 # When enabled, embed support for CKM_RSA_X_509 (a.k.a. Raw RSA) ciphering
 # and authentication. The feature can be needed for some TLS v1.2 connections.
 # Raw RSA can be unsafe if client uses a weak clear data padding scheme.
-CFG_PKCS11_TA_RSA_X_509 ?= y
+CFG_PKCS11_TA_RSA_X_509 ?= n
 
 global-incdirs-y += include
 global-incdirs-y += src