From 0db7ab0d4930a19a219a9fbfbb47a09c3b27a579 Mon Sep 17 00:00:00 2001
From: Lapo Luchini <lapo@lapo.it>
Date: Fri, 19 Jun 2026 20:42:30 +0200
Subject: [PATCH] Fix escaping.

---
 testssl.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/testssl.sh b/testssl.sh
index 354417c..090a0f6 100755
--- a/testssl.sh
+++ b/testssl.sh
@@ -21525,8 +21525,8 @@ find_openssl_binary() {
 
      # In order to avoid delays due to lookups of the hostname "invalid." we just try to avoid using "-connect invalid."
      # when possible. The following does a check fopr that. For WSL we stick for now to the old scheme. Not sure about Cygwin
-     if [[ SYSTEM2 == "WSL" ]]; then
-          NXCONNECT=-connect $NXDNS
+     if [[ $SYSTEM2 == "WSL" ]]; then
+          NXCONNECT="-connect $NXDNS"
      else
           # If this connects and bails out with an error message, we do not need "-connect invalid."
           if $OPENSSL s_client 2>&1 </dev/null | grep -Eiaq 'Connection refused|connect error|Bad file descriptor'; then