diff --git a/.github/workflows/windows-native.yml b/.github/workflows/windows-native.yml
index 21955bd2c2..2471351bd0 100644
--- a/.github/workflows/windows-native.yml
+++ b/.github/workflows/windows-native.yml
@@ -130,6 +130,7 @@ jobs:
         run: |
           echo OPENSSL_ROOT_DIR=${{ env.VCPKG_DIR_U }}/installed/${{ matrix.arch.triplet }} >> $GITHUB_ENV
           echo OPENSSL_MODULES=${{ env.VCPKG_DIR_U }}/installed/${{ matrix.arch.triplet }}/bin >> $GITHUB_ENV
+          echo RNP_TESTS_OPENSSL_ROOT=${{ env.VCPKG_DIR_U }}/installed/${{ matrix.arch.triplet }} >> $GITHUB_ENV
 
       - name: Adjust settings for s2k_iteration_tuning test
         # This step adjusts s2k_iteration_tuning threshold for
diff --git a/src/lib/crypto/backend_version.cpp b/src/lib/crypto/backend_version.cpp
index 43d8d4f516..72c431aeab 100644
--- a/src/lib/crypto/backend_version.cpp
+++ b/src/lib/crypto/backend_version.cpp
@@ -72,7 +72,7 @@ backend_version()
     if (version[0]) {
         return version;
     }
-    const char *reg = "OpenSSL (([0-9]\\.[0-9]\\.[0-9])[a-z]*(-beta[0-9])*(-dev)*) ";
+    const char *reg = "OpenSSL (([0-9]\\.[0-9]\\.[0-9])[a-z]*(-[a-z0-9]+)*) ";
 #ifndef RNP_USE_STD_REGEX
     static regex_t r;
     regmatch_t     matches[5];
@@ -84,7 +84,9 @@ backend_version()
             return "unknown";
         }
     }
-    if (regexec(&r, ver, 5, matches, 0) != 0) {
+    int res = regexec(&r, ver, 5, matches, 0);
+    if (res != 0) {
+        RNP_LOG("regexec() failed on %s: %d", ver, res);
         return "unknown";
     }
     assert(sizeof(version) > matches[1].rm_eo - matches[1].rm_so);
@@ -95,6 +97,7 @@ backend_version()
     std::smatch       result;
     std::string       ver = OpenSSL_version(OPENSSL_VERSION);
     if (!std::regex_search(ver, result, re)) {
+        RNP_LOG("std::regex_search failed on \"%s\"", ver.c_str());
         return "unknown";
     }
     assert(sizeof(version) > result[1].str().size());
diff --git a/src/tests/CMakeLists.txt b/src/tests/CMakeLists.txt
index 45f13a7204..f818823565 100644
--- a/src/tests/CMakeLists.txt
+++ b/src/tests/CMakeLists.txt
@@ -244,6 +244,13 @@ function(add_cli_test suite)
     "RNP_TESTS_GPG_PATH=${GPG_EXECUTABLE}"
     "RNP_TESTS_GPGCONF_PATH=${GPGCONF_EXECUTABLE}"
   )
+  if (CRYPTO_BACKEND_OPENSSL)
+    get_filename_component(ossl_root "${OPENSSL_INCLUDE_DIR}" DIRECTORY)
+    list(APPEND _env
+      "RNP_TESTS_OPENSSL_ROOT=${ossl_root}"
+    )
+  endif()
+
   set_tests_properties(${_test_name} PROPERTIES
     TIMEOUT 3000
     FIXTURES_REQUIRED testdata
diff --git a/src/tests/cli_tests.py b/src/tests/cli_tests.py
index 7777ddf8d2..9b70854163 100755
--- a/src/tests/cli_tests.py
+++ b/src/tests/cli_tests.py
@@ -3140,28 +3140,34 @@ def test_backend_version(self):
         if not match:
             match = re.match(OPENSSL_BACKEND_VERSION, out)
             backend_prog = 'openssl'
-            openssl_root = os.getenv('OPENSSL_ROOT_DIR')
+            openssl_root = os.getenv('RNP_TESTS_OPENSSL_ROOT')
         else:
             openssl_root = None
         self.assertTrue(match)
         # check there is no unexpected output
         self.assertNotRegex(err, r'(?is)^.*Unsupported.*$')
         self.assertNotRegex(err, r'(?is)^.*pgp_sa_to_openssl_string.*$')
+        self.assertNotRegex(err, r'(?is)^.*unknown.*$')
 
         # In case when there are several openssl installations
         # testing environment is supposed to point to the right one
         # through OPENSSL_ROOT_DIR environment variable
+        backend_prog_ext = None
         if openssl_root is not None:
-            backen_prog_ext = shutil.which(backend_prog, path = openssl_root + '/bin')
+            backend_prog_ext = shutil.which(backend_prog, path = openssl_root + '/bin')
         else:
         # In all other cases
         # check that botan or openssl executable binary exists in PATH
-            backen_prog_ext = shutil.which(backend_prog)
+            backend_prog_ext = shutil.which(backend_prog)
 
-        if backen_prog_ext is not None:
-            ret, out, _ = run_proc(backen_prog_ext, ['version'])
-            self.assertEqual(ret, 0)
-            self.assertIn(match.group(1), out)
+        if backend_prog == 'openssl':
+            # OpenSSL should have executable
+            self.assertIsNotNone(backend_prog_ext)
+        if backend_prog_ext is None:
+            return
+        ret, out, _ = run_proc(backend_prog_ext, ['version'])
+        self.assertEqual(ret, 0)
+        self.assertIn(match.group(1), out)
 
     def test_help_message(self):
         # rnp help message