diff --git a/CMake/Utilities.cmake b/CMake/Utilities.cmake
index 37cdfe3bf..8b6276df6 100644
--- a/CMake/Utilities.cmake
+++ b/CMake/Utilities.cmake
@@ -29,3 +29,16 @@ function(IN_STR_LIST LIST_NAME ITEM_SEARCHED RETVAL)
     set(${RETVAL} TRUE PARENT_SCOPE)
   endif()
 endfunction()
+
+# Returns a list of arguments that evaluate to true
+function(collect_true output_var output_count_var)
+  set(${output_var})
+  foreach(option_var IN LISTS ARGN)
+    if(${option_var})
+      list(APPEND ${output_var} ${option_var})
+    endif()
+  endforeach()
+  set(${output_var} ${${output_var}} PARENT_SCOPE)
+  list(LENGTH ${output_var} ${output_count_var})
+  set(${output_count_var} ${${output_count_var}} PARENT_SCOPE)
+endfunction()
diff --git a/CMakeLists.txt b/CMakeLists.txt
index e548d81c0..8390c38c9 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -308,12 +308,22 @@ endif()
 option(CMAKE_USE_MBEDTLS "Enable mbedTLS for SSL/TLS" OFF)
 
 set(openssl_default ON)
-if(WIN32)
-    set(openssl_default OFF)
+if(WIN32 OR CMAKE_USE_DARWINSSL OR CMAKE_USE_WINSSL OR CMAKE_USE_MBEDTLS)
+  set(openssl_default OFF)
 endif()
 option(CMAKE_USE_OPENSSL "Use OpenSSL code. Experimental" ${openssl_default})
 
-if(CMAKE_USE_WINSSL AND NOT SSL_ENABLED)
+collect_true(enabled_ssl_options enabled_ssl_options_count
+  CMAKE_USE_WINSSL
+  CMAKE_USE_DARWINSSL
+  CMAKE_USE_OPENSSL
+  CMAKE_USE_MBEDTLS
+)
+if(enabled_ssl_options_count GREATER 1)
+  message(FATAL_ERROR "Multiple SSL options specified: ${enabled_ssl_options}. Please pick at most one and disable the rest.")
+endif()
+
+if(CMAKE_USE_WINSSL)
   set(SSL_ENABLED ON)
   set(USE_SCHANNEL ON) # Windows native SSL/TLS support
   set(USE_WINDOWS_SSPI ON) # CMAKE_USE_WINSSL implies CURL_WINDOWS_SSPI
@@ -324,7 +334,7 @@ if(CURL_WINDOWS_SSPI)
   set(CMAKE_REQUIRED_DEFINITIONS "${CMAKE_REQUIRED_DEFINITIONS} -DSECURITY_WIN32")
 endif()
 
-if(CMAKE_USE_DARWINSSL AND NOT SSL_ENABLED)
+if(CMAKE_USE_DARWINSSL)
   find_library(COREFOUNDATION_FRAMEWORK "CoreFoundation")
   if(NOT COREFOUNDATION_FRAMEWORK)
       message(FATAL_ERROR "CoreFoundation framework not found")
@@ -340,7 +350,7 @@ if(CMAKE_USE_DARWINSSL AND NOT SSL_ENABLED)
   list(APPEND CURL_LIBS "${COREFOUNDATION_FRAMEWORK}" "${SECURITY_FRAMEWORK}")
 endif()
 
-if(CMAKE_USE_OPENSSL AND NOT SSL_ENABLED)
+if(CMAKE_USE_OPENSSL)
   find_package(OpenSSL REQUIRED)
   set(SSL_ENABLED ON)
   set(USE_OPENSSL ON)
@@ -363,7 +373,7 @@ if(CMAKE_USE_OPENSSL AND NOT SSL_ENABLED)
   check_symbol_exists(RAND_egd    "${CURL_INCLUDES}" HAVE_RAND_EGD)
 endif()
 
-if(CMAKE_USE_MBEDTLS AND NOT SSL_ENABLED)
+if(CMAKE_USE_MBEDTLS)
   find_package(MbedTLS REQUIRED)
   set(SSL_ENABLED ON)
   set(USE_MBEDTLS ON)
diff --git a/docs/INSTALL.cmake b/docs/INSTALL.cmake
index b2924e642..9c5c2d9f6 100644
--- a/docs/INSTALL.cmake
+++ b/docs/INSTALL.cmake
@@ -24,7 +24,8 @@ Current flaws in the curl CMake build
    Missing features in the cmake build:
 
    - Builds libcurl without large file support
-   - Can't select which SSL library to build with, only OpenSSL
+   - Does not support all SSL libraries (only OpenSSL, WinSSL, DarwinSSL, and
+     mbed TLS)
    - Doesn't build with SCP and SFTP support (libssh2)
    - Doesn't allow different resolver backends (no c-ares build support)
    - No RTMP support built