diff --git b/src/backend/libpq/be-secure-openssl.c a/src/backend/libpq/be-secure-openssl.c
index 9303d4be67..fa4f4678fb 100644
--- b/src/backend/libpq/be-secure-openssl.c
+++ a/src/backend/libpq/be-secure-openssl.c
@@ -123,7 +123,8 @@ be_tls_init(bool isServerStart)
 
 	/*
 	 * Create a new SSL context into which we'll load all the configuration
-	 * settings.
+	 * settings.  If we fail partway through, we can avoid memory leakage by
+	 * freeing this context; we don't install it as active until the end.
 	 *
 	 * We use SSLv23_method() because it can negotiate use of the highest
 	 * mutually supported protocol version, while alternatives like