diff --git a/libekmfweb/Makefile b/libekmfweb/Makefile
index 5d0b1b92..1af233de 100644
--- a/libekmfweb/Makefile
+++ b/libekmfweb/Makefile
@@ -49,7 +49,9 @@ check-dep-libekmfweb: detect-openssl-version.dep
 		"libekmfweb", \
 		"curl/curl.h", \
 		"libcurl-devel", \
-		"HAVE_LIBCURL=0")
+		"HAVE_LIBCURL=0" \
+		`curl-config --cflags` `curl-config --libs`)
+	curl-config --ssl-backends | grep OpenSSL >/dev/null 2>&1 || { echo "Error: libcurl is not built with the OpenSSL backend"; exit 1; }
 	touch check-dep-libekmfweb
 
 skip-libekmfweb-openssl:
@@ -67,8 +69,8 @@ ekmfweb.o: check-dep-libekmfweb ekmfweb.c utilities.h cca.h $(rootdir)include/ek
 utilities.o: check-dep-libekmfweb utilities.c utilities.h $(rootdir)include/ekmfweb/ekmfweb.h
 cca.o: check-dep-libekmfweb cca.c cca.h utilities.h $(rootdir)include/ekmfweb/ekmfweb.h
 
-libekmfweb.so.$(VERSION): ALL_CFLAGS += -fPIC
-libekmfweb.so.$(VERSION): LDLIBS = -ljson-c -lcrypto -lssl -lcurl -ldl
+libekmfweb.so.$(VERSION): ALL_CFLAGS += -fPIC `curl-config --cflags`
+libekmfweb.so.$(VERSION): LDLIBS = -ljson-c -lcrypto -lssl `curl-config --libs` -ldl
 libekmfweb.so.$(VERSION): ALL_LDFLAGS += -shared -Wl,--version-script=libekmfweb.map \
 	-Wl,-z,defs,-Bsymbolic -Wl,-soname,libekmfweb.so.$(VERM)
 libekmfweb.so.$(VERSION): ekmfweb.o utilities.o cca.o
diff --git a/libekmfweb/ekmfweb.c b/libekmfweb/ekmfweb.c
index fd78207c..1f9ad170 100644
--- a/libekmfweb/ekmfweb.c
+++ b/libekmfweb/ekmfweb.c
@@ -705,6 +705,7 @@ static int _ekmf_perform_request(const struct ekmf_config *config,
 				 long *status_code, char **error_msg,
 				 CURL *curl, bool verbose)
 {
+	const struct curl_tlssessioninfo *info = NULL;
 	struct curl_header_cb_data header_cb = { 0 };
 	struct curl_sslctx_cb_data sslctx_cb = { 0 };
 	struct curl_write_cb_data write_cb = { 0 };
@@ -732,6 +733,19 @@ static int _ekmf_perform_request(const struct ekmf_config *config,
 
 	curl_easy_reset(curl);
 
+	/*
+	 * The CURLOPT_SSL_CTX_FUNCTION callback only works with the OpenSSL
+	 * curl backend. Check that OpenSSL is the current curl backend.
+	 */
+	rc = curl_easy_getinfo(curl, CURLINFO_TLS_SSL_PTR, &info);
+	CURL_ERROR_CHECK(rc, "curl_easy_getinfo CURLINFO_TLS_SSL_PTR", verbose,
+			 out);
+	if (info->backend != CURLSSLBACKEND_OPENSSL) {
+		pr_verbose(verbose, "libcurl is not using the OpenSSL backend");
+		rc = -EIO;
+		goto out;
+	}
+
 	rc = curl_easy_setopt(curl, CURLOPT_VERBOSE, verbose ? 1 : 0);
 	CURL_ERROR_CHECK(rc, "curl_easy_setopt CURLOPT_VERBOSE", verbose, out);
 
@@ -5617,6 +5631,20 @@ void ekmf_curl_destroy(CURL *curl_handle)
  */
 void __attribute__ ((constructor)) ekmf_init(void)
 {
+	CURLsslset rc;
+
+	/*
+	 * Ensure that curl uses OpenSSL as SSL backend. If curl has already
+	 * been itialized by the calling application, the backend can't be
+	 * changed anymore, but we continue anyway. However, it will later be
+	 * checked if curl uses the OpenSSL backend, and a HTTPS connection
+	 * will fail if it is not using the OpenSSL backend.
+	 */
+	rc = curl_global_sslset(CURLSSLBACKEND_OPENSSL, NULL, NULL);
+	if (rc != CURLSSLSET_OK && rc != CURLSSLSET_TOO_LATE)
+		errx(EXIT_FAILURE, "libekmfweb: libcurl was not built with "
+		     "the OpenSSL backend");
+
 	curl_global_init(CURL_GLOBAL_ALL);
 }