diff --git a/.github/workflows/ccpp.yml b/.github/workflows/ccpp.yml
index 8ed70959..2e7b2b60 100644
--- a/.github/workflows/ccpp.yml
+++ b/.github/workflows/ccpp.yml
@@ -37,18 +37,18 @@ jobs:
     - name: make test
       run: make test_tsan_mbedtls
 
-  windows_mbedtls:
+  windows_openssl:
     runs-on: windows-latest
     steps:
     - uses: actions/checkout@v1
     - uses: seanmiddleditch/gha-setup-vsdevenv@master
     - run: |
         vcpkg install zlib:x64-windows
-        vcpkg install mbedtls:x64-windows
+        vcpkg install openssl:x64-windows
     - run: |
         mkdir build
         cd build
-        cmake -DCMAKE_TOOLCHAIN_FILE=c:/vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_CXX_COMPILER=cl.exe -DUSE_MBED_TLS=1 -DUSE_TLS=1 -DUSE_WS=1 -DUSE_TEST=1 ..
+        cmake -DCMAKE_TOOLCHAIN_FILE=c:/vcpkg/scripts/buildsystems/vcpkg.cmake -DCMAKE_CXX_COMPILER=cl.exe -DUSE_TLS=1 -DUSE_WS=1 -DUSE_TEST=1 ..
     - run: cmake --build build
 
     # Running the unittest does not work, the binary cannot be found
diff --git a/CMakeLists.txt b/CMakeLists.txt
index bf437739..377eff3d 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -118,9 +118,9 @@ if (USE_TLS)
     option(USE_OPEN_SSL "Use OpenSSL" OFF)
     option(USE_SECURE_TRANSPORT "Use Secure Transport" OFF)
 
-    # default to mbedtls on windows if nothing is configured
-    if (WIN32 AND NOT USE_OPEN_SSL AND NOT USE_MBED_TLS)
-      option(USE_MBED_TLS "Use Mbed TLS" ON)
+    # default to OpenSSL on windows if nothing is configured
+    if (WIN32 AND NOT USE_MBED_TLS)
+      option(USE_OPEN_SSL "Use OpenSSL" ON)
     endif()
 
     # default to securetranport on windows if nothing is configured
@@ -164,6 +164,10 @@ endif()
 if (WIN32)
   target_link_libraries(ixwebsocket wsock32 ws2_32 shlwapi)
   add_definitions(-D_CRT_SECURE_NO_WARNINGS)
+
+  if (USE_TLS)
+    target_link_libraries(ixwebsocket Crypt32)
+  endif()
 endif()
 
 if (UNIX)
diff --git a/docs/CHANGELOG.md b/docs/CHANGELOG.md
index 1d9838ba..3a8df868 100644
--- a/docs/CHANGELOG.md
+++ b/docs/CHANGELOG.md
@@ -1,6 +1,10 @@
 # Changelog
 All changes to this project will be documented in this file.
 
+## [9.5.0] - 2020-04-25
+
+(ssl) Default to OpenSSL on Windows, since it can load the system certificates by default
+
 ## [9.4.1] - 2020-04-25
 
 (header) Add a space between header name and header value since most http parsers expects it, although it it not required. Cf #184 and #155
diff --git a/docs/build.md b/docs/build.md
index 2fe80fa3..897e4432 100644
--- a/docs/build.md
+++ b/docs/build.md
@@ -18,8 +18,8 @@ There is a unittest which can be executed by typing `make test`.
 Options for building:
 
 * `-DUSE_TLS=1` will enable TLS support
-* `-DUSE_OPEN_SSL=1` will use [openssl](https://www.openssl.org/) for the TLS support (default on Linux)
-* `-DUSE_MBED_TLS=1` will use [mbedlts](https://tls.mbed.org/) for the TLS support (default on Windows)
+* `-DUSE_OPEN_SSL=1` will use [openssl](https://www.openssl.org/) for the TLS support (default on Linux and Windows)
+* `-DUSE_MBED_TLS=1` will use [mbedlts](https://tls.mbed.org/) for the TLS support
 * `-DUSE_WS=1` will build the ws interactive command line tool
 * `-DUSE_TEST=1` will build the unittest
 
diff --git a/ixwebsocket/IXWebSocketVersion.h b/ixwebsocket/IXWebSocketVersion.h
index 66a59960..56ea9eed 100644
--- a/ixwebsocket/IXWebSocketVersion.h
+++ b/ixwebsocket/IXWebSocketVersion.h
@@ -6,4 +6,4 @@
 
 #pragma once
 
-#define IX_WEBSOCKET_VERSION "9.4.1"
+#define IX_WEBSOCKET_VERSION "9.5.0"