diff --git a/CMakeLists.txt b/CMakeLists.txt
index 1a488a5..adc96c1 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -14,6 +14,7 @@ option(TINYLDAP_BUILD_TOOLS "Build tinyldap command line tools" ON)
 option(TINYLDAP_BUILD_TESTS "Build tinyldap test programs" ${PROJECT_IS_TOP_LEVEL})
 option(TINYLDAP_RUN_TESTS "Register non-interactive tinyldap tests with CTest" ${PROJECT_IS_TOP_LEVEL})
 option(TINYLDAP_INSTALL "Install tinyldap libraries, headers and tools" ON)
+option(TINYLDAP_ALLOW_SYSTEM_OPENSSL "Allow fallback to system OpenSSL Crypto when MatrixSSL compat is not available" ON)
 
 set(TINYLDAP_OUTPUT_NAME "tinyldap" CACHE STRING "Library basename and default server name, e.g. nwdirectory builds libnwdirectory and nwdirectory")
 set(TINYLDAP_SERVER_NAME "" CACHE STRING "Installed server executable name. Defaults to TINYLDAP_OUTPUT_NAME")
@@ -189,7 +190,27 @@ else()
   endif()
 endif()
 
+
+function(tinyldap_write_matrixssl_md5_compat)
+  file(MAKE_DIRECTORY "${TINYLDAP_COMPAT_INCLUDE_DIR}/openssl")
+  file(WRITE "${TINYLDAP_COMPAT_INCLUDE_DIR}/openssl/md5.h" "#pragma once
+#include <stddef.h>
+#include <stdint.h>
+#include <crypto/cryptoApi.h>
+typedef psMd5_t MD5_CTX;
+#define MD5Init MD5_Init
+#define MD5Update MD5_Update
+#define MD5Final MD5_Final
+static inline int MD5_Init(MD5_CTX *c) { return psMd5Init(c) >= 0 ? 1 : 0; }
+static inline int MD5_Update(MD5_CTX *c, const void *data, size_t len) { psMd5Update(c, (const unsigned char *)data, (uint32_t)len); return 1; }
+static inline int MD5_Final(unsigned char *md, MD5_CTX *c) { psMd5Final(c, md); return 1; }
+")
+endfunction()
+
 if(TARGET OpenSSL::Crypto)
+  if(TARGET MATRIXSSL::matrixssl OR TARGET matrixssl OR TARGET matrixssl_static)
+    tinyldap_write_matrixssl_md5_compat()
+  endif()
   set(TINYLDAP_CRYPTO_TARGET OpenSSL::Crypto)
 elseif(NOT TINYLDAP_MATRIXSSL_BUILD_DIR STREQUAL "")
   if(TINYLDAP_MATRIXSSL_INCLUDE_SUBDIR STREQUAL "")
@@ -214,25 +235,19 @@ elseif(NOT TINYLDAP_MATRIXSSL_BUILD_DIR STREQUAL "")
   if(NOT TINYLDAP_MATRIXSSL_OPENSSL_INCLUDE_ROOT)
     message(FATAL_ERROR "Could not find MatrixSSL OpenSSL compatibility include root in ${TINYLDAP_MATRIXSSL_BUILD_DIR}")
   endif()
-  file(MAKE_DIRECTORY "${TINYLDAP_COMPAT_INCLUDE_DIR}/openssl")
   if(NOT EXISTS "${TINYLDAP_MATRIXSSL_OPENSSL_INCLUDE_ROOT}/openssl/md5.h")
-    file(WRITE "${TINYLDAP_COMPAT_INCLUDE_DIR}/openssl/md5.h" "#pragma once
-#include <stddef.h>
-#include <crypto/cryptoApi.h>
-typedef psMd5_t MD5_CTX;
-static inline int MD5_Init(MD5_CTX *c) { return psMd5Init(c) >= 0 ? 1 : 0; }
-static inline int MD5_Update(MD5_CTX *c, const void *data, size_t len) { psMd5Update(c, (const unsigned char *)data, (uint32_t)len); return 1; }
-static inline int MD5_Final(unsigned char *md, MD5_CTX *c) { psMd5Final(c, md); return 1; }
-")
+    tinyldap_write_matrixssl_md5_compat()
   endif()
   add_library(tinyldap_matrixssl_crypto_external UNKNOWN IMPORTED)
   set_target_properties(tinyldap_matrixssl_crypto_external PROPERTIES
     IMPORTED_LOCATION "${TINYLDAP_MATRIXSSL_CRYPTO_LIBRARY}"
     INTERFACE_INCLUDE_DIRECTORIES "${TINYLDAP_MATRIXSSL_OPENSSL_INCLUDE_ROOT}")
   set(TINYLDAP_CRYPTO_TARGET tinyldap_matrixssl_crypto_external)
-else()
+elseif(TINYLDAP_ALLOW_SYSTEM_OPENSSL)
   find_package(OpenSSL REQUIRED COMPONENTS Crypto)
   set(TINYLDAP_CRYPTO_TARGET OpenSSL::Crypto)
+else()
+  message(FATAL_ERROR "TinyLDAP requires MatrixSSL OpenSSL-compat target OpenSSL::Crypto when TINYLDAP_ALLOW_SYSTEM_OPENSSL=OFF")
 endif()
 
 find_library(TINYLDAP_CRYPT_LIBRARY crypt)
diff --git a/cmake/tinyldap-config.cmake.in b/cmake/tinyldap-config.cmake.in
index 07e676b..a60ca54 100644
--- a/cmake/tinyldap-config.cmake.in
+++ b/cmake/tinyldap-config.cmake.in
@@ -1,5 +1,7 @@
 @PACKAGE_INIT@
 include(CMakeFindDependencyMacro)
 find_dependency(libowfat CONFIG)
-find_dependency(OpenSSL COMPONENTS Crypto)
+if(NOT TARGET OpenSSL::Crypto)
+  find_dependency(OpenSSL COMPONENTS Crypto)
+endif()
 include("${CMAKE_CURRENT_LIST_DIR}/tinyldap-targets.cmake")