diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index 39b1a66236..d77e6af7dd 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -38,11 +38,16 @@
 #include "utils/memutils.h"
 
 /*
- * These SSL-related #includes must come after all system-provided headers.
- * This ensures that OpenSSL can take care of conflicts with Windows'
- * <wincrypt.h> by #undef'ing the conflicting macros.  (We don't directly
- * include <wincrypt.h>, but some other Windows headers do.)
+ * On Windows, <wincrypt.h> includes a #define for X509_NAME, which breaks our
+ * ability to use OpenSSL's version of that symbol if <wincrypt.h> is pulled
+ * in after <openssl/ssl.h> (which is being done here as "libpq/libpq.h" indirectly 
+ * includes <wincrypt.h> when gssapi is enabled). We can't reliably fix that by 
+ * re-ordering includes. Instead, just zap the #define again here.
  */
+#ifdef X509_NAME
+#undef X509_NAME
+#endif
+
 #include "common/openssl.h"
 #include <openssl/conf.h>
 #include <openssl/dh.h>