diff --git a/testssl.sh b/testssl.sh
index 354417c..090a0f6 100755
--- a/testssl.sh
+++ b/testssl.sh
@@ -21525,8 +21525,8 @@ find_openssl_binary() {
 
      # In order to avoid delays due to lookups of the hostname "invalid." we just try to avoid using "-connect invalid."
      # when possible. The following does a check fopr that. For WSL we stick for now to the old scheme. Not sure about Cygwin
-     if [[ SYSTEM2 == "WSL" ]]; then
-          NXCONNECT=-connect $NXDNS
+     if [[ $SYSTEM2 == "WSL" ]]; then
+          NXCONNECT="-connect $NXDNS"
      else
           # If this connects and bails out with an error message, we do not need "-connect invalid."
           if $OPENSSL s_client 2>&1 </dev/null | grep -Eiaq 'Connection refused|connect error|Bad file descriptor'; then