In projectB, you’ve marked these include directories as PRIVATE, meaning they apply to projectB only, not to its consumers. If its consumers also need these include directories (as this implies), make them PUBLIC instead.
I can’t see anything in projectB’s CMakeList that would indicate projectB is linking against OpenSSL and libsomething. Even if you build projectB as a static library, you should include the relevant target_link_libraries() command so that CMake knows those dependencies are necessary. In the case of static libraries, they will be propagated to consumers too (since static libraries don’t link).
That is the correct behaviour when using an external package (using find_package()) — that is intended for picking up pre-supplied dependencies. If you want to build your dependencies, I believe you should look into CMake’s dependency guide and FetchContent module.