diff --git a/CHANGELOG.md b/CHANGELOG.md
index bdb6a1baad5..bd59c8484eb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -31,6 +31,8 @@
   [#3480](https://github.com/rustwasm/wasm-bindgen/pull/3480)
 
 * Replaced `curl` with `ureq`. By default we now use Rustls instead of OpenSSL.
+  The `openssl` is now out of the dependencies in `wasm-bindgen-cli` crates, so that
+  the `vendored-openssl` feature is now out of supported features.
   [#3511](https://github.com/rustwasm/wasm-bindgen/pull/3511)
 
 ### Fixed
diff --git a/crates/cli/Cargo.toml b/crates/cli/Cargo.toml
index b94b5b03e24..4f05c7e6ef8 100644
--- a/crates/cli/Cargo.toml
+++ b/crates/cli/Cargo.toml
@@ -20,12 +20,15 @@ docopt = "1.0"
 env_logger = "0.8"
 anyhow = "1.0"
 log = "0.4"
-openssl = { version = '0.10.11', optional = true }
+native-tls = { version = "0.2", default-features = false, optional = true }
 rouille = { version = "3.0.0", default-features = false }
 serde = { version = "1.0", features = ['derive'] }
 serde_derive = "1.0"
 serde_json = "1.0"
-ureq = { version = "2.7", default-features = false, features = ["brotli", "gzip"] }
+ureq = { version = "2.7", default-features = false, features = [
+    "brotli",
+    "gzip",
+] }
 walrus = { version = "0.19.0", features = ['parallel'] }
 wasm-bindgen-cli-support = { path = "../cli-support", version = "=0.2.87" }
 wasm-bindgen-shared = { path = "../shared", version = "=0.2.87" }
@@ -46,11 +49,9 @@ harness = false
 [features]
 default = ["rustls-tls"]
 
-rustls-tls = ["ureq/tls"]
-
-# Enables native-tls specific functionality not available by default.
-native-tls = ["ureq/native-tls"]
-native-tls-vendored = ["native-tls", "native-tls/vendored"]
+native-tls = ["dep:native-tls", "ureq/native-tls"]
+rustls-tls = ["ureq/tls"]                          # ureq uses rustls by default.
 
 # Legacy support
-vendored-openssl = ['native-tls-vendored']
+openssl = ["native-tls"]
+vendored-openssl = ["openssl", "native-tls/vendored"]