diff --git a/src/backend/libpq/be-secure-openssl.c b/src/backend/libpq/be-secure-openssl.c
index c97c811..e24d7de 100644
--- a/src/backend/libpq/be-secure-openssl.c
+++ b/src/backend/libpq/be-secure-openssl.c
@@ -1287,19 +1287,19 @@ ssl_protocol_version_to_openssl(int v, const char *guc_name, int loglevel)
 		case PG_TLS1_VERSION:
 			return TLS1_VERSION;
 		case PG_TLS1_1_VERSION:
-#ifdef TLS1_1_VERSION
+#if defined(TLS1_1_VERSION) && TLS1_1_VERSION <= TLS_MAX_VERSION
 			return TLS1_1_VERSION;
 #else
 			break;
 #endif
 		case PG_TLS1_2_VERSION:
-#ifdef TLS1_2_VERSION
+#if defined(TLS1_2_VERSION) &&  TLS1_2_VERSION <= TLS_MAX_VERSION
 			return TLS1_2_VERSION;
 #else
 			break;
 #endif
 		case PG_TLS1_3_VERSION:
-#ifdef TLS1_3_VERSION
+#if defined(TLS1_3_VERSION)  &&  TLS1_2_VERSION <= TLS_MAX_VERSION
 			return TLS1_3_VERSION;
 #else
 			break;
@@ -1335,11 +1335,11 @@ SSL_CTX_set_min_proto_version(SSL_CTX *ctx, int version)
 
 	if (version > TLS1_VERSION)
 		ssl_options |= SSL_OP_NO_TLSv1;
-#ifdef TLS1_1_VERSION
+#if defined(TLS1_1_VERSION) && TLS1_1_VERSION <= TLS_MAX_VERSION
 	if (version > TLS1_1_VERSION)
 		ssl_options |= SSL_OP_NO_TLSv1_1;
 #endif
-#ifdef TLS1_2_VERSION
+#if defined(TLS1_2_VERSION) && TLS1_2_VERSION <= TLS_MAX_VERSION
 	if (version > TLS1_2_VERSION)
 		ssl_options |= SSL_OP_NO_TLSv1_2;
 #endif
@@ -1356,11 +1356,11 @@ SSL_CTX_set_max_proto_version(SSL_CTX *ctx, int version)
 
 	AssertArg(version != 0);
 
-#ifdef TLS1_1_VERSION
+#if defined(TLS1_1_VERSION) && TLS1_1_VERSION <= TLS_MAX_VERSION
 	if (version < TLS1_1_VERSION)
 		ssl_options |= SSL_OP_NO_TLSv1_1;
 #endif
-#ifdef TLS1_2_VERSION
+#if defined(TLS1_2_VERSION) && TLS1_2_VERSION <= TLS_MAX_VERSION
 	if (version < TLS1_2_VERSION)
 		ssl_options |= SSL_OP_NO_TLSv1_2;
 #endif