diff --git a/src/backend/postmaster/postmaster.c b/src/backend/postmaster/postmaster.c
index a0790863228..9dd3c3b0319 100644
--- a/src/backend/postmaster/postmaster.c
+++ b/src/backend/postmaster/postmaster.c
@@ -247,7 +247,8 @@ ProtocolExtensionConfig default_protocol_config = {
 	libpq_end_command,
 	NULL, NULL, NULL, NULL,		/* use libpq defaults for printtup*() */
 	NULL,
-	libpq_report_param_status
+	libpq_report_param_status,
+	libpq_direct_ssl_handshake
 };
 
 /* still more option variables */
@@ -1511,6 +1512,11 @@ libpq_end_command(QueryCompletion *qc, CommandDest dest)
 	EndCommand(qc, dest, false);
 }
 
+int
+libpq_direct_ssl_handshake(struct Port *port)
+{
+	return ProcessSSLStartup(port);
+}
 
 /*
  * on_proc_exit callback to close server's listen sockets
diff --git a/src/backend/tcop/backend_startup.c b/src/backend/tcop/backend_startup.c
index 6db5dee90ba..8ed6d7140ea 100644
--- a/src/backend/tcop/backend_startup.c
+++ b/src/backend/tcop/backend_startup.c
@@ -42,7 +42,7 @@
 bool		Trace_connection_negotiation = false;
 static void BackendInitialize(ClientSocket *client_sock, CAC_state cac, ProtocolExtensionConfig *protocol_config);
 int	ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done);
-static int	ProcessSSLStartup(Port *port);
+int	ProcessSSLStartup(Port *port);
 static void SendNegotiateProtocolVersion(List *unrecognized_protocol_options);
 static void process_startup_packet_die(SIGNAL_ARGS);
 static void StartupPacketTimeoutHandler(void);
@@ -253,15 +253,14 @@ BackendInitialize(ClientSocket *client_sock, CAC_state cac, ProtocolExtensionCon
 	RegisterTimeout(STARTUP_PACKET_TIMEOUT, StartupPacketTimeoutHandler);
 	enable_timeout_after(STARTUP_PACKET_TIMEOUT, AuthenticationTimeout * 1000);
 
-	/* Handle direct SSL handshake for non-TDS connections */
-	if (!port->is_tds_conn)
-	status = ProcessSSLStartup(port);
+	/* Handle protocol-specific direct SSL handshake */
+	status = port->protocol_config->fn_direct_ssl_handshake(port);
 
 	/*
 	 * Receive the startup packet (which might turn out to be a cancel request
 	 * packet).
 	 */
-	if (port->is_tds_conn || status == STATUS_OK)
+	if (status == STATUS_OK)
 		status = (port->protocol_config->fn_start)(port);
 
 	/*
@@ -360,7 +359,7 @@ BackendInitialize(ClientSocket *client_sock, CAC_state cac, ProtocolExtensionCon
  * This happens before the startup packet so we are careful not to actually
  * read any bytes from the stream if it's not a direct SSL connection.
  */
-static int
+int
 ProcessSSLStartup(Port *port)
 {
 	int			firstbyte;
diff --git a/src/include/libpq/libpq-be.h b/src/include/libpq/libpq-be.h
index 255e0d6a685..4e98f4a75a7 100644
--- a/src/include/libpq/libpq-be.h
+++ b/src/include/libpq/libpq-be.h
@@ -117,6 +117,9 @@ typedef struct ProtocolExtensionConfig {
 	void	(*fn_printtup_destroy)(DestReceiver *self);
 	int		(*fn_process_command)(void);
 	void	(*fn_report_param_status)(const char *name, char *val);
+
+	/* function pointer for handling direct SSL handshake */
+	int		(*fn_direct_ssl_handshake)(struct Port *port);
 } ProtocolExtensionConfig;
 
 /*
diff --git a/src/include/postmaster/protocol_extension.h b/src/include/postmaster/protocol_extension.h
index 372d4f5ce2b..f1c78c85b73 100644
--- a/src/include/postmaster/protocol_extension.h
+++ b/src/include/postmaster/protocol_extension.h
@@ -42,5 +42,6 @@ extern void	libpq_send_ready_for_query(CommandDest dest);
 extern int	libpq_read_command(StringInfo inBuf);
 extern void	libpq_end_command(QueryCompletion *qc, CommandDest dest);
 extern void	libpq_report_param_status(const char *name, char *val);
+extern int	libpq_direct_ssl_handshake(struct Port *port);
 
 #endif							/* _PROTOCOL_EXTENSION_H */
diff --git a/src/include/tcop/backend_startup.h b/src/include/tcop/backend_startup.h
index 67afb972d5d..31b0814691c 100644
--- a/src/include/tcop/backend_startup.h
+++ b/src/include/tcop/backend_startup.h
@@ -39,5 +39,6 @@ typedef struct BackendStartupData
 
 extern void BackendMain(char *startup_data, size_t startup_data_len) pg_attribute_noreturn();
 extern int	ProcessStartupPacket(Port *port, bool ssl_done, bool gss_done);
+extern int	ProcessSSLStartup(Port *port);
 
 #endif							/* BACKEND_STARTUP_H */