diff --git a/dlls/wininet/internet.c b/dlls/wininet/internet.c
index b6a29a5de4a..e561228eebc 100644
--- a/dlls/wininet/internet.c
+++ b/dlls/wininet/internet.c
@@ -58,6 +58,7 @@
 #include "winerror.h"
 #define NO_SHLWAPI_STREAM
 #include "shlwapi.h"
+#include "wincrypt.h"
 
 #include "wine/exception.h"
 
@@ -65,7 +66,6 @@
 #include "resource.h"
 
 #include "wine/unicode.h"
-#include "wincrypt.h"
 
 WINE_DEFAULT_DEBUG_CHANNEL(wininet);
 
diff --git a/dlls/wininet/internet.h b/dlls/wininet/internet.h
index 76d98f184dd..6101aca2eea 100644
--- a/dlls/wininet/internet.h
+++ b/dlls/wininet/internet.h
@@ -40,6 +40,10 @@
 #ifdef HAVE_OPENSSL_SSL_H
 #define DSA __ssl_DSA  /* avoid conflict with commctrl.h */
 #undef FAR
+/* avoid conflict with wincrypt.h */
+#undef PKCS7_SIGNER_INFO
+#undef X509_NAME
+#undef X509_CERT_PAIR
 # include <openssl/ssl.h>
 #undef FAR
 #define FAR do_not_use_this_in_wine
diff --git a/dlls/wininet/netconnection.c b/dlls/wininet/netconnection.c
index eca9a8c5fe1..40f3a2236b3 100644
--- a/dlls/wininet/netconnection.c
+++ b/dlls/wininet/netconnection.c
@@ -47,6 +47,7 @@
 #include "winbase.h"
 #include "wininet.h"
 #include "winerror.h"
+#include "wincrypt.h"
 
 /* To avoid conflicts with the Unix socket headers. we only need it for
  * the error codes anyway. */
@@ -55,7 +56,6 @@
 
 #include "wine/debug.h"
 #include "internet.h"
-#include "wincrypt.h"
 
 #define RESPONSE_TIMEOUT        30            /* FROM internet.c */