diff --git a/doc/Changelog b/doc/Changelog
index f00148911..167e5a33c 100644
--- a/doc/Changelog
+++ b/doc/Changelog
@@ -1,3 +1,6 @@
+24 May 2018: Wouter
+	- Fix that libunbound can do DNS-over-TLS, when configured.
+
 23 May 2018: Wouter
 	- Use accept4 to speed up incoming TCP (and TLS) connections,
 	  available on Linux and FreeBSD.
diff --git a/libunbound/libworker.c b/libunbound/libworker.c
index aef117869..84ac6aed6 100644
--- a/libunbound/libworker.c
+++ b/libunbound/libworker.c
@@ -158,14 +158,12 @@ libworker_setup(struct ub_ctx* ctx, int is_bg, struct ub_event_base* eb)
 		hints_delete(w->env->hints);
 		w->env->hints = NULL;
 	}
-	if(cfg->ssl_upstream) {
-		w->sslctx = connect_sslctx_create(NULL, NULL,
-			cfg->tls_cert_bundle);
-		if(!w->sslctx) {
-			/* to make the setup fail after unlock */
-			hints_delete(w->env->hints);
-			w->env->hints = NULL;
-		}
+	w->sslctx = connect_sslctx_create(NULL, NULL,
+		cfg->tls_cert_bundle);
+	if(!w->sslctx) {
+		/* to make the setup fail after unlock */
+		hints_delete(w->env->hints);
+		w->env->hints = NULL;
 	}
 	if(!w->is_bg || w->is_bg_thread) {
 		lock_basic_unlock(&ctx->cfglock);