diff --git a/CMakeLists.txt b/CMakeLists.txt
index e4670f7b..a23d2efb 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -33,6 +33,8 @@
 # USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
 # OF SUCH DAMAGE.
 
+include(CheckIncludeFiles)
+
 set(CMAKE_MODULE_PATH "${CMAKE_CURRENT_SOURCE_DIR}/cmake;${CMAKE_MODULE_PATH}")
 include(CheckFunctionExistsMayNeedLibrary)
 
@@ -109,6 +111,171 @@ endif()
 set(LIB_STATIC "libssh2_static")
 set(LIB_SHARED "libssh2_shared")  # Must match libssh2_shared_EXPORTS macro in include/libssh2.h
 
+## Cryptography backend choice
+
+set(CRYPTO_BACKEND
+  ""
+  CACHE
+  STRING
+  "The backend to use for cryptography: OpenSSL, wolfSSL, Libgcrypt,
+WinCNG, mbedTLS, or empty to try any available")
+
+# If the crypto backend was given, rather than searching for the first
+# we are able to find, the find_package commands must abort configuration
+# and report to the user.
+if(CRYPTO_BACKEND)
+  set(SPECIFIC_CRYPTO_REQUIREMENT REQUIRED)
+endif()
+
+if(CRYPTO_BACKEND STREQUAL "OpenSSL" OR NOT CRYPTO_BACKEND)
+
+  find_package(OpenSSL ${SPECIFIC_CRYPTO_REQUIREMENT})
+
+  if(OPENSSL_FOUND)
+    set(CRYPTO_BACKEND "OpenSSL")
+    set(CRYPTO_SOURCES openssl.c openssl.h)
+    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_OPENSSL")
+    set(CRYPTO_BACKEND_INCLUDE_DIR ${OPENSSL_INCLUDE_DIR})
+    list(APPEND LIBRARIES ${OPENSSL_LIBRARIES})
+    list(APPEND PC_REQUIRES_PRIVATE libssl libcrypto)
+
+    if (WIN32)
+      # Statically linking to OpenSSL requires crypt32 for some Windows APIs.
+      # This should really be handled by FindOpenSSL.cmake.
+      list(APPEND LIBRARIES crypt32 bcrypt)
+      list(APPEND PC_LIBS -lcrypt32 -lbcrypt)
+
+      #set(CMAKE_FIND_DEBUG_MODE TRUE)
+
+      find_file(DLL_LIBCRYPTO
+        NAMES crypto.dll
+          libcrypto-1_1.dll libcrypto-1_1-x64.dll
+          libcrypto-3.dll libcrypto-3-x64.dll
+        HINTS ${_OPENSSL_ROOT_HINTS} PATHS ${_OPENSSL_ROOT_PATHS}
+        PATH_SUFFIXES bin NO_DEFAULT_PATH)
+      if(DLL_LIBCRYPTO)
+        message(STATUS "Found libcrypto DLL: ${DLL_LIBCRYPTO}")
+      else()
+        message(WARNING
+          "Unable to find OpenSSL libcrypto DLL, executables may not run")
+      endif()
+
+      find_file(DLL_LIBSSL
+        NAMES ssl.dll
+          libssl-1_1.dll libssl-1_1-x64.dll
+          libssl-3.dll libssl-3-x64.dll
+        HINTS ${_OPENSSL_ROOT_HINTS} PATHS ${_OPENSSL_ROOT_PATHS}
+        PATH_SUFFIXES bin NO_DEFAULT_PATH)
+      if(DLL_LIBSSL)
+        message(STATUS "Found libssl DLL: ${DLL_LIBSSL}")
+      else()
+        message(WARNING
+          "Unable to find OpenSSL libssl DLL, executables may not run")
+      endif()
+
+      #set(CMAKE_FIND_DEBUG_MODE FALSE)
+
+      if(DLL_LIBCRYPTO AND DLL_LIBSSL)
+        list(APPEND _RUNTIME_DEPENDENCIES ${DLL_LIBCRYPTO} ${DLL_LIBSSL})
+      endif()
+    endif()
+
+    find_package(ZLIB)
+
+    if(ZLIB_FOUND)
+      list(APPEND LIBRARIES ${ZLIB_LIBRARIES})
+      list(APPEND PC_REQUIRES_PRIVATE zlib)
+    endif()
+  endif()
+endif()
+
+if(CRYPTO_BACKEND STREQUAL "wolfSSL" OR NOT CRYPTO_BACKEND)
+
+  find_package(wolfssl ${SPECIFIC_CRYPTO_REQUIREMENT})
+
+  if(WOLFSSL_FOUND)
+    set(CRYPTO_BACKEND "wolfSSL")
+    set(CRYPTO_SOURCES openssl.c openssl.h)
+    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_WOLFSSL")
+    set(CRYPTO_BACKEND_INCLUDE_DIR ${WOLFSSL_INCLUDE_DIR} ${WOLFSSL_INCLUDE_DIR}/wolfssl)
+    list(APPEND LIBRARIES ${WOLFSSL_LIBRARIES})
+    list(APPEND PC_LIBS -lwolfssl)
+
+    if (WIN32)
+      list(APPEND LIBRARIES crypt32)
+      list(APPEND PC_LIBS -lcrypt32)
+    endif()
+
+    find_package(ZLIB)
+
+    if(ZLIB_FOUND)
+      list(PREPEND CRYPTO_BACKEND_INCLUDE_DIR ${ZLIB_INCLUDE_DIR})
+
+      list(APPEND LIBRARIES ${ZLIB_LIBRARIES})  # Public wolfSSL headers require zlib headers
+      list(APPEND PC_REQUIRES_PRIVATE zlib)
+    endif()
+  endif()
+endif()
+
+if(CRYPTO_BACKEND STREQUAL "Libgcrypt" OR NOT CRYPTO_BACKEND)
+
+  find_package(Libgcrypt ${SPECIFIC_CRYPTO_REQUIREMENT})
+
+  if(LIBGCRYPT_FOUND)
+    set(CRYPTO_BACKEND "Libgcrypt")
+    set(CRYPTO_SOURCES libgcrypt.c libgcrypt.h)
+    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_LIBGCRYPT")
+    set(CRYPTO_BACKEND_INCLUDE_DIR ${LIBGCRYPT_INCLUDE_DIRS})
+    list(APPEND LIBRARIES ${LIBGCRYPT_LIBRARIES})
+    list(APPEND PC_LIBS -lgcrypt)
+  endif()
+endif()
+
+if(CRYPTO_BACKEND STREQUAL "WinCNG" OR NOT CRYPTO_BACKEND)
+
+  # The check actually compiles the header.  This requires windows.h.
+  check_include_files("windows.h;bcrypt.h" HAVE_BCRYPT_H)
+
+  if(HAVE_BCRYPT_H)
+    set(CRYPTO_BACKEND "WinCNG")
+    set(CRYPTO_SOURCES wincng.c wincng.h)
+    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_WINCNG")
+    set(CRYPTO_BACKEND_INCLUDE_DIR "")
+
+    set(HAVE_LIBCRYPT32 TRUE)
+    list(APPEND LIBRARIES bcrypt)
+    list(APPEND PC_LIBS -lbcrypt)
+
+    # Reading keys from files is optional and depends on Wincrypt
+    check_include_files("windows.h;wincrypt.h" HAVE_WINCRYPT_H)
+
+    if(HAVE_WINCRYPT_H)
+      list(APPEND LIBRARIES crypt32)
+      list(APPEND PC_LIBS -lcrypt32)
+    endif()
+
+  elseif(${SPECIFIC_CRYPTO_REQUIREMENT} STREQUAL ${REQUIRED})
+    message(FATAL_ERROR "WinCNG not available")
+  endif()
+endif()
+
+if(CRYPTO_BACKEND STREQUAL "mbedTLS" OR NOT CRYPTO_BACKEND)
+
+  find_package(mbedTLS ${SPECIFIC_CRYPTO_REQUIREMENT})
+
+  if(MBEDTLS_FOUND)
+    set(CRYPTO_BACKEND "mbedTLS")
+    set(CRYPTO_SOURCES mbedtls.c mbedtls.h)
+    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_MBEDTLS")
+    set(CRYPTO_BACKEND_INCLUDE_DIR ${MBEDTLS_INCLUDE_DIR})
+    list(APPEND LIBRARIES ${MBEDTLS_LIBRARIES})
+    list(APPEND PC_LIBS -lmbedcrypto)
+    link_directories(${MBEDTLS_LIBRARY_DIR})
+  endif()
+endif()
+
+#
+
 add_subdirectory(src)
 
 if(BUILD_EXAMPLES)
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 020526f7..44e03d7a 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -41,153 +41,10 @@ include(CheckSymbolExists)
 include(CheckNonblockingSocketSupport)
 include(CMakePushCheckState)
 
-## Cryptography backend choice
-
-set(CRYPTO_BACKEND
-  ""
-  CACHE
-  STRING
-  "The backend to use for cryptography: OpenSSL, wolfSSL, Libgcrypt,
-WinCNG, mbedTLS, or empty to try any available")
-
-# If the crypto backend was given, rather than searching for the first
-# we are able to find, the find_package commands must abort configuration
-# and report to the user.
 if(CRYPTO_BACKEND)
-  set(SPECIFIC_CRYPTO_REQUIREMENT REQUIRED)
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "OpenSSL" OR NOT CRYPTO_BACKEND)
-
-  find_package(OpenSSL ${SPECIFIC_CRYPTO_REQUIREMENT})
-
-  if(OPENSSL_FOUND)
-    set(CRYPTO_BACKEND "OpenSSL")
-    set(CRYPTO_SOURCES openssl.c openssl.h)
-    list(APPEND PRIVATE_COMPILE_DEFINITIONS LIBSSH2_OPENSSL)
-    list(APPEND PRIVATE_INCLUDE_DIRECTORIES ${OPENSSL_INCLUDE_DIR})
-    list(APPEND LIBRARIES ${OPENSSL_LIBRARIES})
-    list(APPEND PC_REQUIRES_PRIVATE libssl libcrypto)
-
-    if (WIN32)
-      # Statically linking to OpenSSL requires crypt32 for some Windows APIs.
-      # This should really be handled by FindOpenSSL.cmake.
-      list(APPEND LIBRARIES crypt32 bcrypt)
-      list(APPEND PC_LIBS -lcrypt32 -lbcrypt)
-
-      #set(CMAKE_FIND_DEBUG_MODE TRUE)
-
-      find_file(DLL_LIBCRYPTO
-        NAMES crypto.dll
-          libcrypto-1_1.dll libcrypto-1_1-x64.dll
-          libcrypto-3.dll libcrypto-3-x64.dll
-        HINTS ${_OPENSSL_ROOT_HINTS} PATHS ${_OPENSSL_ROOT_PATHS}
-        PATH_SUFFIXES bin NO_DEFAULT_PATH)
-      if(DLL_LIBCRYPTO)
-        message(STATUS "Found libcrypto DLL: ${DLL_LIBCRYPTO}")
-      else()
-        message(WARNING
-          "Unable to find OpenSSL libcrypto DLL, executables may not run")
-      endif()
-
-      find_file(DLL_LIBSSL
-        NAMES ssl.dll
-          libssl-1_1.dll libssl-1_1-x64.dll
-          libssl-3.dll libssl-3-x64.dll
-        HINTS ${_OPENSSL_ROOT_HINTS} PATHS ${_OPENSSL_ROOT_PATHS}
-        PATH_SUFFIXES bin NO_DEFAULT_PATH)
-      if(DLL_LIBSSL)
-        message(STATUS "Found libssl DLL: ${DLL_LIBSSL}")
-      else()
-        message(WARNING
-          "Unable to find OpenSSL libssl DLL, executables may not run")
-      endif()
-
-      #set(CMAKE_FIND_DEBUG_MODE FALSE)
-
-      if(DLL_LIBCRYPTO AND DLL_LIBSSL)
-        list(APPEND _RUNTIME_DEPENDENCIES ${DLL_LIBCRYPTO} ${DLL_LIBSSL})
-      endif()
-    endif()
-  endif()
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "wolfSSL" OR NOT CRYPTO_BACKEND)
-
-  find_package(wolfssl ${SPECIFIC_CRYPTO_REQUIREMENT})
-
-  if(WOLFSSL_FOUND)
-    set(CRYPTO_BACKEND "wolfSSL")
-    set(CRYPTO_SOURCES openssl.c openssl.h)
-    list(APPEND PRIVATE_COMPILE_DEFINITIONS LIBSSH2_WOLFSSL)
-    list(APPEND PRIVATE_INCLUDE_DIRECTORIES ${WOLFSSL_INCLUDE_DIR} ${WOLFSSL_INCLUDE_DIR}/wolfssl)
-    list(APPEND LIBRARIES ${WOLFSSL_LIBRARIES})
-    list(APPEND PC_LIBS -lwolfssl)
-
-    if (WIN32)
-      list(APPEND LIBRARIES crypt32)
-      list(APPEND PC_LIBS -lcrypt32)
-    endif()
-  endif()
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "Libgcrypt" OR NOT CRYPTO_BACKEND)
-
-  find_package(Libgcrypt ${SPECIFIC_CRYPTO_REQUIREMENT})
-
-  if(LIBGCRYPT_FOUND)
-    set(CRYPTO_BACKEND "Libgcrypt")
-    set(CRYPTO_SOURCES libgcrypt.c libgcrypt.h)
-    list(APPEND PRIVATE_COMPILE_DEFINITIONS LIBSSH2_LIBGCRYPT)
-    list(APPEND PRIVATE_INCLUDE_DIRECTORIES ${LIBGCRYPT_INCLUDE_DIRS})
-    list(APPEND LIBRARIES ${LIBGCRYPT_LIBRARIES})
-    list(APPEND PC_LIBS -lgcrypt)
-  endif()
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "WinCNG" OR NOT CRYPTO_BACKEND)
-
-  # The check actually compiles the header.  This requires windows.h.
-  check_include_files("windows.h;bcrypt.h" HAVE_BCRYPT_H)
-
-  if(HAVE_BCRYPT_H)
-    set(CRYPTO_BACKEND "WinCNG")
-    set(CRYPTO_SOURCES wincng.c wincng.h)
-    list(APPEND PRIVATE_COMPILE_DEFINITIONS LIBSSH2_WINCNG)
-
-    set(HAVE_LIBCRYPT32 TRUE)
-    list(APPEND LIBRARIES bcrypt)
-    list(APPEND PC_LIBS -lbcrypt)
-
-    # Reading keys from files is optional and depends on Wincrypt
-    check_include_files("windows.h;wincrypt.h" HAVE_WINCRYPT_H)
-
-    if(HAVE_WINCRYPT_H)
-      list(APPEND LIBRARIES crypt32)
-      list(APPEND PC_LIBS -lcrypt32)
-    endif()
-
-  elseif(${SPECIFIC_CRYPTO_REQUIREMENT} STREQUAL ${REQUIRED})
-    message(FATAL_ERROR "WinCNG not available")
-  endif()
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "mbedTLS" OR NOT CRYPTO_BACKEND)
-
-  find_package(mbedTLS ${SPECIFIC_CRYPTO_REQUIREMENT})
-
-  if(MBEDTLS_FOUND)
-    set(CRYPTO_BACKEND "mbedTLS")
-    set(CRYPTO_SOURCES mbedtls.c mbedtls.h)
-    list(APPEND PRIVATE_COMPILE_DEFINITIONS LIBSSH2_MBEDTLS)
-    list(APPEND PRIVATE_INCLUDE_DIRECTORIES ${MBEDTLS_INCLUDE_DIR})
-    list(APPEND LIBRARIES ${MBEDTLS_LIBRARIES})
-    list(APPEND PC_LIBS -lmbedcrypto)
-    link_directories(${MBEDTLS_LIBRARY_DIR})
-  endif()
-endif()
-
-if(NOT CRYPTO_BACKEND)
+  list(APPEND PRIVATE_COMPILE_DEFINITIONS ${CRYPTO_BACKEND_DEFINE})
+  list(APPEND PRIVATE_INCLUDE_DIRECTORIES ${CRYPTO_BACKEND_INCLUDE_DIR})
+else()
   message(FATAL_ERROR "No suitable cryptography backend found.")
 endif()
 
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 128ea06c..3bba01e6 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -53,84 +53,6 @@ configure_file(
 
 list(APPEND LIBRARIES ${SOCKET_LIBRARIES})
 
-## Cryptography backend choice
-
-set(CRYPTO_BACKEND
-  ""
-  CACHE
-  STRING
-  "The backend to use for cryptography: OpenSSL, wolfSSL, Libgcrypt,
-WinCNG, mbedTLS, or empty to try any available")
-
-# If the crypto backend was given, rather than searching for the first
-# we are able to find, the find_package commands must abort configuration
-# and report to the user.
-if(CRYPTO_BACKEND)
-  set(SPECIFIC_CRYPTO_REQUIREMENT REQUIRED)
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "OpenSSL" OR NOT CRYPTO_BACKEND)
-
-  find_package(OpenSSL ${SPECIFIC_CRYPTO_REQUIREMENT})
-
-  if(OPENSSL_FOUND)
-    set(CRYPTO_BACKEND "OpenSSL")
-    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_OPENSSL")
-    set(CRYPTO_BACKEND_INCLUDE_DIR ${OPENSSL_INCLUDE_DIR})
-  endif()
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "wolfSSL" OR NOT CRYPTO_BACKEND)
-
-  find_package(wolfssl ${SPECIFIC_CRYPTO_REQUIREMENT})
-
-  if(WOLFSSL_FOUND)
-    set(CRYPTO_BACKEND "wolfSSL")
-    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_WOLFSSL")
-    set(CRYPTO_BACKEND_INCLUDE_DIR ${WOLFSSL_INCLUDE_DIR} ${WOLFSSL_INCLUDE_DIR}/wolfssl)
-
-    find_package(ZLIB)
-
-    if(ZLIB_FOUND)
-      set(CRYPTO_BACKEND_INCLUDE_DIR ${ZLIB_INCLUDE_DIR} ${CRYPTO_BACKEND_INCLUDE_DIR})
-    endif()
-  endif()
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "Libgcrypt" OR NOT CRYPTO_BACKEND)
-
-  find_package(Libgcrypt ${SPECIFIC_CRYPTO_REQUIREMENT})
-
-  if(LIBGCRYPT_FOUND)
-    set(CRYPTO_BACKEND "Libgcrypt")
-    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_LIBGCRYPT")
-    set(CRYPTO_BACKEND_INCLUDE_DIR ${LIBGCRYPT_INCLUDE_DIRS})
-  endif()
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "WinCNG" OR NOT CRYPTO_BACKEND)
-
-  # The check actually compiles the header.  This requires windows.h.
-  check_include_files("windows.h;bcrypt.h" HAVE_BCRYPT_H)
-
-  if(HAVE_BCRYPT_H)
-    set(CRYPTO_BACKEND "WinCNG")
-    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_WINCNG")
-    set(CRYPTO_BACKEND_INCLUDE_DIR "")
-  endif()
-endif()
-
-if(CRYPTO_BACKEND STREQUAL "mbedTLS" OR NOT CRYPTO_BACKEND)
-
-  find_package(mbedTLS ${SPECIFIC_CRYPTO_REQUIREMENT})
-
-  if(MBEDTLS_FOUND)
-    set(CRYPTO_BACKEND "mbedTLS")
-    set(CRYPTO_BACKEND_DEFINE "LIBSSH2_MBEDTLS")
-    set(CRYPTO_BACKEND_INCLUDE_DIR ${MBEDTLS_INCLUDE_DIR})
-  endif()
-endif()
-
 set(TESTS
   warmup
   hostkey