diff --git a/srcpkgs/mit-krb5/patches/libressl.patch b/srcpkgs/mit-krb5/patches/libressl.patch
index dcd76d38523..1c0c5cab095 100644
--- a/srcpkgs/mit-krb5/patches/libressl.patch
+++ b/srcpkgs/mit-krb5/patches/libressl.patch
@@ -1,6 +1,6 @@
---- src/plugins/preauth/pkinit/pkinit_crypto_openssl.c.orig
-+++ src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
-@@ -191,7 +191,7 @@
+--- src/plugins/preauth/pkinit/pkinit_crypto_openssl.c	2019-01-08 17:02:37.000000000 +0100
++++ src/plugins/preauth/pkinit/pkinit_crypto_openssl.c	2019-05-11 16:29:37.001458084 +0200
+@@ -189,7 +189,7 @@
      (*_x509_pp) = PKCS7_cert_from_signer_info(_p7,_si)
  #endif
  
@@ -9,20 +9,30 @@
  
  /* 1.1 standardizes constructor and destructor names, renaming
   * EVP_MD_CTX_{create,destroy} and deprecating ASN1_STRING_data. */
-@@ -3059,7 +3059,7 @@
+@@ -3053,7 +3053,7 @@
      return retval;
  }
  
 -#if OPENSSL_VERSION_NUMBER >= 0x10100000L
-+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
++#if OPENSSL_VERSION_NUMBER >= 0x10100000L || defined(LIBRESSL_VERSION_NUMBER)
  
  /*
   * We need to decode DomainParameters from RFC 3279 section 2.3.3.  We would
-@@ -3122,6 +3122,7 @@
+@@ -3079,7 +3079,7 @@
+ ASN1_SEQUENCE(DHvparams) = {
+     ASN1_SIMPLE(int_dhvparams, seed, ASN1_BIT_STRING),
+     ASN1_SIMPLE(int_dhvparams, counter, BIGNUM)
+-} static_ASN1_SEQUENCE_END_name(int_dhvparams, DHvparams)
++} ASN1_SEQUENCE_END_name(int_dhvparams, DHvparams)
  
- #else /* OPENSSL_VERSION_NUMBER < 0x10100000L */
+ ASN1_SEQUENCE(DHxparams) = {
+     ASN1_SIMPLE(int_dhx942_dh, p, BIGNUM),
+@@ -3087,7 +3087,7 @@
+     ASN1_OPT(int_dhx942_dh, q, BIGNUM),
+     ASN1_OPT(int_dhx942_dh, j, BIGNUM),
+     ASN1_OPT(int_dhx942_dh, vparams, DHvparams),
+-} static_ASN1_SEQUENCE_END_name(int_dhx942_dh, DHxparams)
++} ASN1_SEQUENCE_END_name(int_dhx942_dh, DHxparams)
  
-+#include <openssl/asn1_mac.h>
- /*
-  * Do the same decoding (except without decoding j and vparams or checking the
-  * sequence length) using the pre-OpenSSL-1.1 asn1_mac.h.  Define an internal
+ static DH *
+ decode_dh_params(const uint8_t *p, unsigned int len)
diff --git a/srcpkgs/mit-krb5/template b/srcpkgs/mit-krb5/template
index ffa856e06a4..2ee2038f921 100644
--- a/srcpkgs/mit-krb5/template
+++ b/srcpkgs/mit-krb5/template
@@ -1,7 +1,7 @@
 # Template file for 'mit-krb5'
 pkgname=mit-krb5
 version=1.17
-revision=2
+revision=3
 wrksrc="krb5-${version}"
 build_style=gnu-configure
 hostmakedepends="e2fsprogs-devel flex perl pkg-config"