diff --git a/src/backend/tcop/backend_startup.c b/src/backend/tcop/backend_startup.c
index 2fe67015e3b..4dd4d35e6b4 100644
--- a/src/backend/tcop/backend_startup.c
+++ b/src/backend/tcop/backend_startup.c
@@ -625,8 +625,13 @@ retry:
 		char		GSSok = 'N';
 
 #ifdef ENABLE_GSS
-		/* No GSSAPI encryption when on Unix socket */
-		if (port->laddr.addr.ss_family != AF_UNIX)
+
+		/*
+		 * No GSSAPI encryption when on Unix socket.
+		 *
+		 * Also no GSS negotiation if we already have a direct SSL connection.
+		 */
+		if (port->laddr.addr.ss_family != AF_UNIX && !port->ssl_in_use)
 			GSSok = 'G';
 #endif