diff --git a/CHANGELOG.md b/CHANGELOG.md
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 See also http://pvp.haskell.org/faq
 
+### 0.1.5.0
+
+* New function `openConnectionAddress'` function supporting supplying local `SSLContext`s.
+
 ### 0.1.4.0
 
 * New module `Network.Http.Client.WebSocket` providing basic RFC6455 support.
diff --git a/http-io-streams.cabal b/http-io-streams.cabal
--- a/http-io-streams.cabal
+++ b/http-io-streams.cabal
@@ -1,6 +1,6 @@
 cabal-version:       2.2
 name:                http-io-streams
-version:             0.1.4.0
+version:             0.1.5.0
 
 synopsis:            HTTP and WebSocket client based on io-streams
 description:
diff --git a/http-streams/lib/Network/Http/Client.hs b/http-streams/lib/Network/Http/Client.hs
--- a/http-streams/lib/Network/Http/Client.hs
+++ b/http-streams/lib/Network/Http/Client.hs
@@ -184,6 +184,7 @@
     connectionAddressFromURI,
     connectionAddressFromURL,
     openConnectionAddress,
+    openConnectionAddress',
 
     -- -- * Testing support
     -- makeConnection,
diff --git a/http-streams/lib/Network/Http/Connection.hs b/http-streams/lib/Network/Http/Connection.hs
--- a/http-streams/lib/Network/Http/Connection.hs
+++ b/http-streams/lib/Network/Http/Connection.hs
@@ -231,8 +231,7 @@
 -- Crypto is as provided by the system @openssl@ library, as wrapped
 -- by the @HsOpenSSL@ package and @openssl-streams@.
 --
--- /There is no longer a need to call @withOpenSSL@ explicitly; the
--- initialization is invoked once per process for you/
+-- NB: /There is no longer a need to call 'OpenSSL.withOpenSSL' explicitly; the initialization is invoked once per process for you/
 --
 openConnectionSSL :: SSLContext -> Hostname -> Port -> IO Connection
 openConnectionSSL ctx h1' p = withOpenSSL $ do
diff --git a/http-streams/lib/Network/Http/Inconvenience.hs b/http-streams/lib/Network/Http/Inconvenience.hs
--- a/http-streams/lib/Network/Http/Inconvenience.hs
+++ b/http-streams/lib/Network/Http/Inconvenience.hs
@@ -35,6 +35,7 @@
     connectionAddressFromURI,
     connectionAddressFromURL,
     openConnectionAddress,
+    openConnectionAddress',
 
         -- for testing
     splitURI
@@ -244,12 +245,24 @@
 --
 -- This operation is often used in combination with 'withConnection'.
 --
+-- This uses the implicit global 'SSLContext' which can be accessed via 'modifyContextSSL'; see 'openConnectionAddress'' if you need more control in order to supply a local 'SSLContext'.
+--
 -- @since 0.1.1.0
 openConnectionAddress :: ConnectionAddress -> IO Connection
-openConnectionAddress ca = case ca of
+openConnectionAddress = openConnectionAddress' (const $ readIORef global)
+
+-- | Variant of 'openConnectionAddress' allowing to supply local 'SSLContext'
+--
+-- The @IO SSLContext@ action is only evaluated in case of a 'ConnectionAddressHttps' target.
+--
+-- See also 'baselineContextSSL' which may be convenient to use as a starting point; you may want to implement your own variant of 'baselineContextSSL'.
+--
+-- @since 0.1.5.0
+openConnectionAddress' :: ((Hostname,Word16) -> IO SSLContext) -> ConnectionAddress -> IO Connection
+openConnectionAddress' getCtx ca = case ca of
   ConnectionAddressHttp  host port  -> openConnection host port
   ConnectionAddressHttps host ports -> do
-    ctx <- readIORef global
+    ctx <- getCtx (host,ports)
     openConnectionSSL ctx host ports
   ConnectionAddressHttpUnix fp -> do
     c <- openConnectionUnix (S.unpack fp)