diff --git a/CMakeLists.txt b/CMakeLists.txt
index bddf30c..47cf004 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -619,6 +619,9 @@
 LA_CHECK_INCLUDE_FILE("windows.h" HAVE_WINDOWS_H)
 IF(ENABLE_CNG)
   LA_CHECK_INCLUDE_FILE("Bcrypt.h" HAVE_BCRYPT_H)
+  IF(HAVE_BCRYPT_H)
+    LIST(APPEND ADDITIONAL_LIBS "Bcrypt")
+  ENDIF(HAVE_BCRYPT_H)
 ELSE(ENABLE_CNG)
   UNSET(HAVE_BCRYPT_H CACHE)
 ENDIF(ENABLE_CNG)
diff --git a/configure.ac b/configure.ac
index 0592279..ef2b3b6 100644
--- a/configure.ac
+++ b/configure.ac
@@ -292,7 +292,6 @@
 AC_CHECK_HEADERS([sys/time.h sys/utime.h sys/utsname.h sys/vfs.h])
 AC_CHECK_HEADERS([time.h unistd.h utime.h wchar.h wctype.h])
 AC_CHECK_HEADERS([windows.h])
-AC_CHECK_HEADERS([Bcrypt.h])
 # check windows.h first; the other headers require it.
 AC_CHECK_HEADERS([wincrypt.h winioctl.h],[],[],
 [[#ifdef HAVE_WINDOWS_H
@@ -399,6 +398,9 @@
   AC_CHECK_LIB(lzo2,lzo1x_decompress_safe)
 fi
 
+AC_ARG_WITH([cng],
+  AS_HELP_STRING([--without-cng], [Don't build support of CNG(Crypto Next Generation)]))
+
 AC_ARG_WITH([nettle],
   AS_HELP_STRING([--without-nettle], [Don't build with crypto support from Nettle]))
 AC_ARG_WITH([openssl],
@@ -845,6 +847,16 @@
 	;;
 esac
 
+if test "x$with_cng" != "xno"; then
+    AC_CHECK_HEADERS([bcrypt.h],[
+        LIBS="$LIBS -lbcrypt"
+    ],[],
+    [[#ifdef HAVE_WINDOWS_H
+    # include <windows.h>
+    #endif
+    ]])
+fi
+
 if test "x$with_nettle" != "xno"; then
     AC_CHECK_HEADERS([nettle/md5.h nettle/ripemd160.h nettle/sha.h])
     AC_CHECK_HEADERS([nettle/pbkdf2.h nettle/aes.h nettle/hmac.h])