diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index ff494a9..587f4ad 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -108,7 +108,7 @@ jobs:
           CIBW_ARCHS: ${{ matrix.arch }}
           CIBW_BEFORE_BUILD: python scripts/build-libsrtp.py /tmp/vendor
           CIBW_BEFORE_BUILD_WINDOWS: scripts\build-libsrtp.bat C:\cibw\vendor
-          CIBW_ENVIRONMENT: CFLAGS=-I/tmp/vendor/include LDFLAGS=-L/tmp/vendor/lib
+          CIBW_ENVIRONMENT: CFLAGS=-I/tmp/vendor/include LDFLAGS=-L/tmp/vendor/lib PKG_CONFIG_PATH=/tmp/vendor/lib/pkgconfig
           CIBW_ENVIRONMENT_WINDOWS: INCLUDE=C:\\cibw\\vendor\\include LIB=C:\\cibw\\vendor\\lib
           CIBW_SKIP: '*-musllinux*'
           CIBW_TEST_COMMAND: python -m unittest discover -s {project}/tests
diff --git a/scripts/build-libsrtp.bat b/scripts/build-libsrtp.bat
index fec0e68..76d5e25 100644
--- a/scripts/build-libsrtp.bat
+++ b/scripts/build-libsrtp.bat
@@ -1,6 +1,8 @@
 set destdir=%1
 
-for %%d in (libsrtp %destdir%) do (
+python scripts\fetch-vendor.py %destdir%
+
+for %%d in (libsrtp) do (
     if exist %%d (
         rmdir /s /q %%d
     )
@@ -15,7 +17,7 @@ if "%PYTHON_ARCH%" == "64" (
 ) else (
     set CMAKE_OPTIONS=-A Win32
 )
-cmake . -G "Visual Studio 17 2022" %CMAKE_OPTIONS%
+cmake . -G "Visual Studio 17 2022" %CMAKE_OPTIONS% -DENABLE_OPENSSL=ON
 cmake --build . --config Release
 
 mkdir %destdir%
diff --git a/scripts/build-libsrtp.py b/scripts/build-libsrtp.py
index 76ccc4e..f82ae9e 100644
--- a/scripts/build-libsrtp.py
+++ b/scripts/build-libsrtp.py
@@ -11,7 +11,7 @@
 dest_dir = sys.argv[1]
 build_dir = os.path.abspath("build")
 
-for d in [build_dir, dest_dir]:
+for d in [build_dir]:
     if os.path.exists(d):
         shutil.rmtree(d)
 
@@ -25,11 +25,14 @@ def run(cmd):
     "-DCMAKE_INSTALL_PREFIX=" + dest_dir,
     "-DCMAKE_POSITION_INDEPENDENT_CODE=ON",
     "-DCMAKE_VERBOSE_MAKEFILE:BOOL=ON",
+    "-DENABLE_OPENSSL=ON",
 ]
 if platform.system() == "Darwin" and "ARCHFLAGS" in os.environ:
     archs = [x for x in os.environ["ARCHFLAGS"].split() if x != "-arch"]
     cmake_args.append("-DCMAKE_OSX_ARCHITECTURES=" + ";".join(archs))
 
+run(["python", "scripts/fetch-vendor.py", dest_dir])
+
 run(["git", "clone", "https://github.com/cisco/libsrtp/", build_dir])
 os.chdir(build_dir)
 run(["git", "checkout", "-qf", "v2.5.0"])
diff --git a/scripts/fetch-vendor.json b/scripts/fetch-vendor.json
new file mode 100644
index 0000000..1ae2063
--- /dev/null
+++ b/scripts/fetch-vendor.json
@@ -0,0 +1,3 @@
+{
+    "urls": ["https://github.com/aiortc/aioquic-openssl/releases/download/3.2.0-1/openssl-{platform}.tar.gz"]
+}
diff --git a/scripts/fetch-vendor.py b/scripts/fetch-vendor.py
new file mode 100644
index 0000000..3ea3a0c
--- /dev/null
+++ b/scripts/fetch-vendor.py
@@ -0,0 +1,64 @@
+import argparse
+import logging
+import json
+import os
+import platform
+import shutil
+import struct
+import subprocess
+
+
+def get_platform():
+    system = platform.system()
+    machine = platform.machine()
+    if system == "Linux":
+        return f"manylinux_{machine}"
+    elif system == "Darwin":
+        # cibuildwheel sets ARCHFLAGS:
+        # https://github.com/pypa/cibuildwheel/blob/5255155bc57eb6224354356df648dc42e31a0028/cibuildwheel/macos.py#L207-L220
+        if "ARCHFLAGS" in os.environ:
+            machine = os.environ["ARCHFLAGS"].split()[1]
+        return f"macosx_{machine}"
+    elif system == "Windows":
+        if struct.calcsize("P") * 8 == 64:
+            return "win_amd64"
+        else:
+            return "win32"
+    else:
+        raise Exception(f"Unsupported system {system}")
+
+
+parser = argparse.ArgumentParser(description="Fetch and extract tarballs")
+parser.add_argument("destination_dir")
+parser.add_argument("--cache-dir", default="tarballs")
+parser.add_argument("--config-file", default=os.path.splitext(__file__)[0] + ".json")
+args = parser.parse_args()
+logging.basicConfig(level=logging.INFO)
+
+# read config file
+with open(args.config_file, "r") as fp:
+    config = json.load(fp)
+
+# create fresh destination directory
+logging.info("Creating directory %s" % args.destination_dir)
+if os.path.exists(args.destination_dir):
+    shutil.rmtree(args.destination_dir)
+os.makedirs(args.destination_dir)
+
+for url_template in config["urls"]:
+    tarball_url = url_template.replace("{platform}", get_platform())
+
+    # download tarball
+    tarball_name = tarball_url.split("/")[-1]
+    tarball_file = os.path.join(args.cache_dir, tarball_name)
+    if not os.path.exists(tarball_file):
+        logging.info("Downloading %s" % tarball_url)
+        if not os.path.exists(args.cache_dir):
+            os.mkdir(args.cache_dir)
+        subprocess.check_call(
+            ["curl", "--location", "--output", tarball_file, "--silent", tarball_url]
+        )
+
+    # extract tarball
+    logging.info("Extracting %s" % tarball_name)
+    subprocess.check_call(["tar", "-C", args.destination_dir, "-xf", tarball_file])
diff --git a/src/_cffi_src/build_srtp.py b/src/_cffi_src/build_srtp.py
index 9e5a880..e75d5d5 100644
--- a/src/_cffi_src/build_srtp.py
+++ b/src/_cffi_src/build_srtp.py
@@ -4,7 +4,9 @@
 
 libraries = ["srtp2"]
 if sys.platform == "win32":
-    libraries += ["ws2_32"]
+    libraries += ["libcrypto", "advapi32", "crypt32", "gdi32", "user32", "ws2_32"]
+else:
+    libraries += ["crypto"]
 
 ffibuilder = FFI()
 ffibuilder.set_source(