diff --git a/webrtc/base/base.gyp b/webrtc/base/base.gyp
index a17c97981..6c9fd0e94 100644
--- a/webrtc/base/base.gyp
+++ b/webrtc/base/base.gyp
@@ -500,18 +500,22 @@
             }],
           ],
         }, {
-          'defines': [
-            'SSL_USE_NSS',
-            'HAVE_NSS_SSL_H',
-            'SSL_USE_NSS_RNG',
+          'conditions': [
+            ['use_legacy_ssl_defaults!=1', {
+              'defines': [
+                'SSL_USE_NSS',
+                'HAVE_NSS_SSL_H',
+                'SSL_USE_NSS_RNG',
+              ],
+              'direct_dependent_settings': {
+                'defines': [
+                  'SSL_USE_NSS',
+                  'HAVE_NSS_SSL_H',
+                  'SSL_USE_NSS_RNG',
+                ],
+              },
+            }],
           ],
-          'direct_dependent_settings': {
-            'defines': [
-              'SSL_USE_NSS',
-              'HAVE_NSS_SSL_H',
-              'SSL_USE_NSS_RNG',
-            ],
-          },
         }],
         ['OS == "android"', {
           'defines': [
@@ -529,16 +533,20 @@
             ],
           },
         }, {
-          'defines': [
-            'HAVE_NSS_SSL_H'
-            'SSL_USE_NSS_RNG',
+          'conditions': [
+            ['use_legacy_ssl_defaults!=1', {
+              'defines': [
+                'HAVE_NSS_SSL_H',
+                'SSL_USE_NSS_RNG',
+              ],
+              'direct_dependent_settings': {
+                'defines': [
+                  'HAVE_NSS_SSL_H',
+                  'SSL_USE_NSS_RNG',
+                ],
+              },
+            }],
           ],
-          'direct_dependent_settings': {
-            'defines': [
-              'HAVE_NSS_SSL_H'
-              'SSL_USE_NSS_RNG',
-            ],
-          },
           'sources!': [
             'ifaddrs-android.cc',
             'ifaddrs-android.h',
diff --git a/webrtc/build/common.gypi b/webrtc/build/common.gypi
index 6a911f88c..bc88d4acd 100644
--- a/webrtc/build/common.gypi
+++ b/webrtc/build/common.gypi
@@ -118,6 +118,11 @@
     # https://gcc.gnu.org/wiki/LinkTimeOptimization
     'use_lto%': 0,
 
+    # Defer ssl perference to that specified through sslconfig.h instead of
+    # choosing openssl or nss directly.  In practice, this can be used to
+    # enable schannel on windows.
+    'use_legacy_ssl_defaults%': 0,
+
     'conditions': [
       ['build_with_chromium==1', {
         # Exclude pulse audio on Chromium since its prerequisites don't require