diff --git a/panda/src/downloader/bioPtr.h b/panda/src/downloader/bioPtr.h
index 31116d7a52..b3ff5695b8 100644
--- a/panda/src/downloader/bioPtr.h
+++ b/panda/src/downloader/bioPtr.h
@@ -22,6 +22,7 @@
 #define OPENSSL_NO_KRB5
 
 #include "referenceCount.h"
+#include "openSSLWrapper.h"  // must be included before any other openssl.
 #include "openssl/ssl.h"
 
 class URLSpec;
diff --git a/panda/src/downloader/bioStreamBuf.h b/panda/src/downloader/bioStreamBuf.h
index e293840d4e..73fbd68b78 100644
--- a/panda/src/downloader/bioStreamBuf.h
+++ b/panda/src/downloader/bioStreamBuf.h
@@ -23,6 +23,7 @@
 
 #include "bioPtr.h"
 #include "pointerTo.h"
+#include "openSSLWrapper.h"  // must be included before any other openssl.
 #include "openssl/ssl.h"
 
 ////////////////////////////////////////////////////////////////////
diff --git a/panda/src/downloader/bioStreamPtr.h b/panda/src/downloader/bioStreamPtr.h
index d5ad7d340d..95f4308aa4 100644
--- a/panda/src/downloader/bioStreamPtr.h
+++ b/panda/src/downloader/bioStreamPtr.h
@@ -23,6 +23,7 @@
 
 #include "bioStream.h"
 #include "referenceCount.h"
+#include "openSSLWrapper.h"  // must be included before any other openssl.
 #include "openssl/ssl.h"
 
 ////////////////////////////////////////////////////////////////////
diff --git a/panda/src/downloader/httpChannel.h b/panda/src/downloader/httpChannel.h
index 51e69c1ba6..c8dcf23d91 100644
--- a/panda/src/downloader/httpChannel.h
+++ b/panda/src/downloader/httpChannel.h
@@ -36,6 +36,7 @@
 #include "pointerTo.h"
 #include "config_downloader.h"
 #include "filename.h"
+#include "openSSLWrapper.h"  // must be included before any other openssl.
 #include "openssl/ssl.h"
 #include "typedReferenceCount.h"
 
diff --git a/panda/src/downloader/httpDigestAuthorization.cxx b/panda/src/downloader/httpDigestAuthorization.cxx
index 40c38d48a6..e00a92fac0 100644
--- a/panda/src/downloader/httpDigestAuthorization.cxx
+++ b/panda/src/downloader/httpDigestAuthorization.cxx
@@ -17,6 +17,7 @@
 #ifdef HAVE_OPENSSL
 
 #include "httpChannel.h"
+#include "openSSLWrapper.h"  // must be included before any other openssl.
 #include "openssl/ssl.h"
 #include "openssl/md5.h"
 #include <time.h>
diff --git a/panda/src/express/hashVal.cxx b/panda/src/express/hashVal.cxx
index 9789eafa78..8927b23243 100644
--- a/panda/src/express/hashVal.cxx
+++ b/panda/src/express/hashVal.cxx
@@ -14,12 +14,10 @@
 
 #include "hashVal.h"
 #include "virtualFileSystem.h"
-
+#include "openSSLWrapper.h"  // must be included before any other openssl.
+#include "openssl/md5.h"
 #include <ctype.h>
 
-#ifdef HAVE_OPENSSL
-#include "openssl/md5.h"
-#endif  // HAVE_OPENSSL
 
 
 ////////////////////////////////////////////////////////////////////
diff --git a/panda/src/express/openSSLWrapper.h b/panda/src/express/openSSLWrapper.h
index 5c47624786..4e277d881a 100644
--- a/panda/src/express/openSSLWrapper.h
+++ b/panda/src/express/openSSLWrapper.h
@@ -18,9 +18,12 @@
 #include "pandabase.h"
 
 #ifdef HAVE_OPENSSL
-
 #include "filename.h"
 
+#ifdef _WIN32
+#include <winsock2.h>  // must be included prior to including OpenSSL.
+#endif
+
 #define OPENSSL_NO_KRB5
 #include "openssl/ssl.h"
 #include "openssl/rand.h"