diff --git a/scripts/deploy-win-mingw.sh b/scripts/deploy-win-mingw.sh
index 26bdb6d55..12dfe8b8f 100644
--- a/scripts/deploy-win-mingw.sh
+++ b/scripts/deploy-win-mingw.sh
@@ -134,6 +134,13 @@ if ! [ -e $target/klayout.exe ]; then
   exit 1
 fi
 
+# ----------------------------------------------------------
+# cert.pem
+
+echo "Installing cert.pem .."
+
+cp $mingw_inst/etc/ssl/cert.pem $target
+
 # ----------------------------------------------------------
 # Plugins
 
diff --git a/scripts/klayout-inst.nsis b/scripts/klayout-inst.nsis
index a4d4a655e..cbf3cefd7 100644
--- a/scripts/klayout-inst.nsis
+++ b/scripts/klayout-inst.nsis
@@ -40,7 +40,7 @@ InstallDirRegKey HKLM \
           "UninstallString"
 
 # The text to prompt the user to enter a directory
-DirText "Please select your ${NAME} installation path below:"
+DirText "Please select your ${NAME} installation path below (CAUTION: THE GIVEN FOLDER WILL BE DELETED ENTIRELY ON UNINSTALLATION - DO NOT USE A GENERAL PURPOSE FOLDER OR A DRIVE ONLY):"
  
 # automatically close the installer when done.
 AutoCloseWindow true
@@ -68,6 +68,7 @@ section
   file *.dll
   file strm*.exe
   file .*-paths.txt
+  file cert.pem
   file /r db_plugins
   file /r lay_plugins
   file /r audio
@@ -154,7 +155,7 @@ section "Uninstall"
   # now delete installed files
   rmDir /r "$INSTDIR"
 
-  # create a shortcut 
+  # remove shortcut 
   rmDir /r "$SMPROGRAMS\${NAME}"
  
   DeleteRegKey SHCTX "Software\Microsoft\Windows\CurrentVersion\Uninstall\${NAME}"
diff --git a/src/lay/lay/layApplication.cc b/src/lay/lay/layApplication.cc
index 89433d867..930801c5f 100644
--- a/src/lay/lay/layApplication.cc
+++ b/src/lay/lay/layApplication.cc
@@ -64,6 +64,7 @@
 #include "tlHttpStream.h"
 #include "tlArch.h"
 #include "tlFileUtils.h"
+#include "tlEnv.h"
 
 #include <QIcon>
 #include <QDir>
@@ -568,6 +569,19 @@ ApplicationBase::init_app ()
   }
   std::string short_arch_string = tl::join (as, "-");
 
+#if defined(_WIN32)
+  //  Set SSL_CERT_FILE for Windows installation and libcrypto.
+
+  std::string cert_file = "cert.pem";
+  std::string cert_env_var = "SSL_CERT_FILE";
+  if (! tl::has_env (cert_env_var)) {
+    std::string cert_path = tl::combine_path (m_inst_path, cert_file);
+    if (tl::file_exists (cert_path)) {
+      tl::set_env (cert_env_var, cert_path);
+    }
+  }
+#endif
+
   std::vector<std::string> klp_paths;
 
   for (std::vector <std::string>::const_iterator p = m_klayout_path.begin (); p != m_klayout_path.end (); ++p) {