From 5fbe666193d0f7a200c6413b2f16e5dfa84232af Mon Sep 17 00:00:00 2001
From: Andres Freund <andres@anarazel.de>
Date: Wed, 19 Jun 2024 09:13:17 -0700
Subject: [PATCH v2 08/10] krb-vs-openssl-workaround

---
 src/include/libpq/libpq-be.h | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h
index 05cb1874c58..3601fba92fc 100644
--- a/src/include/libpq/libpq-be.h
+++ b/src/include/libpq/libpq-be.h
@@ -19,10 +19,6 @@
 #define LIBPQ_BE_H
 
 #include <sys/time.h>
-#ifdef USE_OPENSSL
-#include <openssl/ssl.h>
-#include <openssl/err.h>
-#endif
 #include <netinet/tcp.h>
 
 #ifdef ENABLE_GSS
@@ -57,6 +53,17 @@ typedef struct
 #include "libpq/hba.h"
 #include "libpq/pqcomm.h"
 
+/*
+ * These SSL-related #includes must come after all system-provided headers.
+ * This ensures that OpenSSL can take care of conflicts with Windows'
+ * <wincrypt.h> by #undef'ing the conflicting macros.  (We don't directly
+ * include <wincrypt.h>, but some other Windows headers do.) Here <gssapi/gssapi.h>
+ * indirectly inlcudes <wincrypt.h> which cause conflicting macros. 
+ */
+#ifdef USE_OPENSSL
+#include <openssl/ssl.h>
+#include <openssl/err.h>
+#endif
 
 /*
  * GSSAPI specific state information
-- 
2.44.0.279.g3bd955d269