diff --git a/doc/known-issues.md b/doc/known-issues.md
index 3c4c7f64..5969bd0b 100644
--- a/doc/known-issues.md
+++ b/doc/known-issues.md
@@ -21,6 +21,10 @@ Windows does not have symlinks enabled, or Git is not configured to use them. Th
   * [Ensure symlinks are installed in Git](https://stackoverflow.com/a/59761201) `git config --global core.symlinks true`
   * Re-clone the repository and try again.
 
+## Windows: "SSL certificate problem: unable to get local issuer certificate"
+
+This is a curl SSL CA issue, you may want to Google for proper solutions on your system. That said, you can `set CURL_INSECURE=true` and retry to disable SSL verification if you want to workaround the issue.
+
 ## Linux: `Error: Couldn't load Vulkan. Searched /tmp/mach/gpu/zig-out/bin/libvulkan.so.1`
 
 We're aware of a bug failing to find `libvulkan.so` on some Linux distros such as [Guix](https://guix.gnu.org/).
diff --git a/libs/gpu-dawn/sdk.zig b/libs/gpu-dawn/sdk.zig
index a2df7d3a..bc3f4206 100644
--- a/libs/gpu-dawn/sdk.zig
+++ b/libs/gpu-dawn/sdk.zig
@@ -149,10 +149,9 @@ pub fn Sdk(comptime deps: anytype) type {
         }
 
         fn ensureSubmodules(allocator: std.mem.Allocator) !void {
-            if (std.process.getEnvVarOwned(allocator, "NO_ENSURE_SUBMODULES")) |no_ensure_submodules| {
-                defer allocator.free(no_ensure_submodules);
-                if (std.mem.eql(u8, no_ensure_submodules, "true")) return;
-            } else |_| {}
+            if (isEnvVarTruthy(allocator, "NO_ENSURE_SUBMODULES")) {
+                return;
+            }
             var child = std.ChildProcess.init(&.{ "git", "submodule", "update", "--init", "--recursive" }, allocator);
             child.cwd = comptime thisDir();
             child.stderr = std.io.getStdErr();
@@ -160,6 +159,16 @@ pub fn Sdk(comptime deps: anytype) type {
             _ = try child.spawnAndWait();
         }
 
+        fn isEnvVarTruthy(allocator: std.mem.Allocator, name: []const u8) bool {
+            if (std.process.getEnvVarOwned(allocator, name)) |truthy| {
+                defer allocator.free(truthy);
+                if (std.mem.eql(u8, truthy, "true")) return true;
+                return false;
+            } else |_| {
+                return false;
+            }
+        }
+
         pub fn linkFromBinary(b: *Builder, step: *std.build.LibExeObjStep, options: Options) void {
             const target = step.target_info.target;
             const binaries_available = switch (target.os.tag) {
@@ -448,7 +457,13 @@ pub fn Sdk(comptime deps: anytype) type {
 
         fn downloadFile(allocator: std.mem.Allocator, target_file: []const u8, url: []const u8) !void {
             std.debug.print("downloading {s}..\n", .{url});
-            var child = std.ChildProcess.init(&.{ "curl", "-L", "-o", target_file, url }, allocator);
+
+            // Some Windows users experience `SSL certificate problem: unable to get local issuer certificate`
+            // so we give them the option to disable SSL if they desire / don't want to debug the issue.
+            var child = if (isEnvVarTruthy(allocator, "CURL_INSECURE"))
+                std.ChildProcess.init(&.{ "curl", "--insecure", "-L", "-o", target_file, url }, allocator)
+            else
+                std.ChildProcess.init(&.{ "curl", "-L", "-o", target_file, url }, allocator);
             child.cwd = comptime thisDir();
             child.stderr = std.io.getStdErr();
             child.stdout = std.io.getStdOut();