diff --git a/pgconn/config.go b/pgconn/config.go
index d7a0fefb..926cb980 100644
--- a/pgconn/config.go
+++ b/pgconn/config.go
@@ -665,7 +665,9 @@ func configTLS(settings map[string]string, thisHost string, parseConfigOptions P
 
 	if sslnegotiation == "direct" {
 		tlsConfig.NextProtos = []string{"postgresql"}
-		sslmode = "require"
+		if sslmode == "prefer" {
+			sslmode = "require"
+		}
 	}
 
 	if sslrootcert != "" {