diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,10 @@
 # Revision history for tcp-simple
 
+## 0.4.0.0
+
+* auto add `withOpenSSL`.
+* add `extra-libraries` to cabal file.
+
 ## 0.3.0.0
 
 * Add qualified notes, rename `closeTLS/closeSSL` to `close`.
diff --git a/Data/OpenSSLSetting.hs b/Data/OpenSSLSetting.hs
--- a/Data/OpenSSLSetting.hs
+++ b/Data/OpenSSLSetting.hs
@@ -15,6 +15,7 @@
 
 import qualified OpenSSL.X509.SystemStore as X509
 import qualified OpenSSL.Session          as SSL
+import           OpenSSL                    (withOpenSSL)
 import           Paths_tcp_streams          (getDataFileName)
 import           Data.TLSSetting            (TrustedCAStore(..))
 
@@ -32,7 +33,7 @@
 --
 makeClientSSLContext :: TrustedCAStore          -- ^ trusted certificates.
                      -> IO SSL.SSLContext
-makeClientSSLContext tca = do
+makeClientSSLContext tca = withOpenSSL $ do
     let caStore = makeCAStore tca
     ctx <- SSL.context
     caStore ctx
@@ -53,7 +54,7 @@
                       -> FilePath       -- ^ private key associated.
                       -> TrustedCAStore -- ^ server will use these certificates to validate clients.
                       -> IO SSL.SSLContext
-makeClientSSLContext' pub certs priv tca = do
+makeClientSSLContext' pub certs priv tca = withOpenSSL $ do
     let caStore = makeCAStore tca
     ctx <- SSL.context
     caStore ctx
@@ -70,7 +71,7 @@
                      -> [FilePath]     -- ^ chain certificate (X.509 format).
                      -> FilePath       -- ^ private key associated.
                      -> IO SSL.SSLContext
-makeServerSSLContext pub certs priv = do
+makeServerSSLContext pub certs priv = withOpenSSL $ do
     ctx <- SSL.context
     SSL.contextSetDefaultCiphers ctx
     SSL.contextSetCertificateFile ctx pub
diff --git a/System/IO/Streams/OpenSSL.hs b/System/IO/Streams/OpenSSL.hs
--- a/System/IO/Streams/OpenSSL.hs
+++ b/System/IO/Streams/OpenSSL.hs
@@ -16,9 +16,6 @@
 -- import qualified "System.IO.Streams.OpenSSL" as SSL
 -- @
 --
--- Be sure to use 'withOpenSSL' wrap your operation before using any functions here.
--- otherwise a segmentation fault will happen.
---
 module System.IO.Streams.OpenSSL
   ( -- * client
     connect
@@ -26,7 +23,6 @@
     -- * server
   , accept
     -- * helpers
-  , withOpenSSL
   , sslToStreams
   , close
   ) where
@@ -69,7 +65,7 @@
 {-# INLINABLE sslToStreams #-}
 
 close :: SSL.SSL -> IO ()
-close ssl = do
+close ssl = withOpenSSL $ do
     SSL.shutdown ssl SSL.Unidirectional
     maybe (return ()) N.close (SSL.sslSocket ssl)
 
@@ -87,7 +83,7 @@
         -> HostName             -- ^ hostname to connect to
         -> PortNumber           -- ^ port number to connect to
         -> IO (InputStream ByteString, OutputStream ByteString, SSL)
-connect ctx subname host port = do
+connect ctx subname host port = withOpenSSL $ do
     sock <- TCP.connectSocket host port
     E.bracketOnError (SSL.connection ctx sock) close $ \ ssl -> do
         SSL.connect ssl
@@ -148,7 +144,7 @@
 accept :: SSL.SSLContext            -- ^ check "Data.OpenSSLSetting".
        -> Socket                    -- ^ the listening 'Socket'.
        -> IO (InputStream ByteString, OutputStream ByteString, SSL.SSL, N.SockAddr)
-accept ctx sock = do
+accept ctx sock = withOpenSSL $ do
     (sock', sockAddr) <- N.accept sock
     E.bracketOnError (SSL.connection ctx sock') close $ \ ssl -> do
         SSL.accept ssl
diff --git a/tcp-streams.cabal b/tcp-streams.cabal
--- a/tcp-streams.cabal
+++ b/tcp-streams.cabal
@@ -1,5 +1,5 @@
 name:                tcp-streams
-version:             0.3.0.0
+version:             0.4.0.0
 synopsis:            One stop solution for tcp client and server with tls support.
 description:         One stop solution for tcp client and server with tls support.
 license:             BSD3
@@ -51,10 +51,19 @@
   if flag(openssl)
     build-depends:      HsOpenSSL      >=0.10.3 && <0.12
                     ,   HsOpenSSL-x509-system == 0.1.*
+    if os(mingw32) || os(windows)
+      extra-libraries: eay32, ssl32
+    else
+      if os(osx)
+        extra-libraries: crypto
+        extra-lib-dirs: /usr/local/lib
+        include-dirs: /usr/local/include
+      else
+        extra-libraries: crypto
 
+  ghc-options:    -Wall
   -- hs-source-dirs:      
   default-language:    Haskell2010
-  ghc-options:    -Wall
 
 test-suite testsuite
   type:              exitcode-stdio-1.0
diff --git a/test/Main.hs b/test/Main.hs
--- a/test/Main.hs
+++ b/test/Main.hs
@@ -55,7 +55,7 @@
         Stream.fromList ["", "ok"] >>= Stream.connectTo os
         N.shutdown sock N.ShutdownSend
         Stream.toList is >>= putMVar resultMVar
-        N.sClose sock
+        N.close sock
 
     server mvar = do
         sock <- Raw.bindAndListen 8888 1024
@@ -123,7 +123,7 @@
 
 testSSLSocket :: Test
 testSSLSocket = testCase "network/socket" $
-    N.withSocketsDo . SSL.withOpenSSL $ do
+    N.withSocketsDo $ do
     x <- timeout (10 * 10^(6::Int)) go
     assertEqual "ok" (Just ()) x
 
@@ -154,7 +154,7 @@
 
 testHTTPS' :: Test
 testHTTPS' = testCase "network/https" $
-    N.withSocketsDo . SSL.withOpenSSL $ do
+    N.withSocketsDo $ do
     x <- timeout (10 * 10^(6::Int)) go
     assertEqual "ok" (Just 1024) x
   where