diff --git a/lib/roles/h2/http2.c b/lib/roles/h2/http2.c
index c156aaa6a..430849e03 100644
--- a/lib/roles/h2/http2.c
+++ b/lib/roles/h2/http2.c
@@ -2531,7 +2531,8 @@ lws_h2_ws_handshake(struct lws *wsi)
 		 * the generic ss-ws.c protocol name
 		 */
 
-		if (wsi->a.vhost->ss_handle->policy->u.http.u.ws.subprotocol) {
+		if (wsi->a.vhost && wsi->a.vhost->ss_handle &&
+		    wsi->a.vhost->ss_handle->policy->u.http.u.ws.subprotocol) {
 			lws_ss_handle_t *h =
 				(lws_ss_handle_t *)wsi->a.opaque_user_data;
 
diff --git a/lib/roles/ws/server-ws.c b/lib/roles/ws/server-ws.c
index 1eeba0546..56f0c4e37 100644
--- a/lib/roles/ws/server-ws.c
+++ b/lib/roles/ws/server-ws.c
@@ -720,7 +720,8 @@ handshake_0405(struct lws_context *context, struct lws *wsi)
 			 * though...
 			 */
 
-			if (sssh->policy->u.http.u.ws.subprotocol)
+			if (sssh && sssh->policy &&
+			    sssh->policy->u.http.u.ws.subprotocol)
 				prot = sssh->policy->u.http.u.ws.subprotocol;
 		}
 #endif