diff --git a/lib/ConnectionConfig.js b/lib/ConnectionConfig.js
index 06f4399c5..241fdee1e 100644
--- a/lib/ConnectionConfig.js
+++ b/lib/ConnectionConfig.js
@@ -49,6 +49,8 @@ function ConnectionConfig(options) {
   }
 
   if (this.ssl) {
+    this.ssl = cloneSsl(this.ssl);
+
     // Default rejectUnauthorized to true
     this.ssl.rejectUnauthorized = this.ssl.rejectUnauthorized !== false;
   }
@@ -63,6 +65,20 @@ function ConnectionConfig(options) {
   this.clientFlags = ConnectionConfig.mergeFlags(defaultFlags, options.flags);
 }
 
+function cloneSsl(ssl) {
+  if (typeof ssl !== 'object') {
+    return ssl;
+  }
+
+  var clone = {};
+
+  for (var key in ssl) {
+    clone[key] = ssl[key];
+  }
+
+  return clone;
+}
+
 ConnectionConfig.mergeFlags = function mergeFlags(defaultFlags, userFlags) {
   var allFlags = ConnectionConfig.parseFlagList(defaultFlags);
   var newFlags = ConnectionConfig.parseFlagList(userFlags);
diff --git a/test/unit/test-ConnectionConfig.js b/test/unit/test-ConnectionConfig.js
index 67e573468..fb6bb6a8c 100644
--- a/test/unit/test-ConnectionConfig.js
+++ b/test/unit/test-ConnectionConfig.js
@@ -169,6 +169,17 @@ test('ConnectionConfig#Constructor.ssl', {
     assert.equal(config.ssl, false);
   },
 
+  'does not mutate ssl options object': function() {
+    var ssl = {};
+    var config = new ConnectionConfig({
+      ssl: ssl
+    });
+
+    assert.notEqual(config.ssl, ssl);
+    assert.deepEqual(ssl, {});
+    assert.equal(config.ssl.rejectUnauthorized, true);
+  },
+
   'string "Amazon RDS" loads valid profile': function() {
     var config = new ConnectionConfig({
       ssl: 'Amazon RDS'
@@ -189,6 +200,21 @@ test('ConnectionConfig#Constructor.ssl', {
     });
   },
 
+  'string "Amazon RDS" does not mutate profile object': function() {
+    var SSLProfiles = require(common.lib + '/protocol/constants/ssl_profiles');
+    var profile = SSLProfiles['Amazon RDS'];
+
+    delete profile.rejectUnauthorized;
+
+    var config = new ConnectionConfig({
+      ssl: 'Amazon RDS'
+    });
+
+    assert.notEqual(config.ssl, profile);
+    assert.equal(profile.rejectUnauthorized, undefined);
+    assert.equal(config.ssl.rejectUnauthorized, true);
+  },
+
   'throws on unknown profile name': function() {
     var config;
     var error;