diff --git a/lib/secure-streams/private-lib-secure-streams.h b/lib/secure-streams/private-lib-secure-streams.h
index f02e86fce..2b5f61190 100644
--- a/lib/secure-streams/private-lib-secure-streams.h
+++ b/lib/secure-streams/private-lib-secure-streams.h
@@ -552,6 +552,13 @@ int lws_ss_apply_sigv4(struct lws *wsi, struct lws_ss_handle *h,
 		       unsigned char **p, unsigned char *end);
 #endif
 
+#if defined(_DEBUG)
+void
+lws_ss_assert_extant(struct lws_context *cx, int tsi, struct lws_ss_handle *h);
+#else
+#define lws_ss_assert_extant(_a, _b, _c)
+#endif
+
 typedef int (* const secstream_protocol_connect_munge_t)(lws_ss_handle_t *h,
 		char *buf, size_t len, struct lws_client_connect_info *i,
 		union lws_ss_contemp *ct);
diff --git a/lib/secure-streams/protocols/ss-h1.c b/lib/secure-streams/protocols/ss-h1.c
index 06effae4c..fa90fe1fe 100644
--- a/lib/secure-streams/protocols/ss-h1.c
+++ b/lib/secure-streams/protocols/ss-h1.c
@@ -450,6 +450,9 @@ secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 			lwsl_err("%s: CCE with no ss handle %s\n", __func__, lws_wsi_tag(wsi));
 			break;
 		}
+
+		lws_ss_assert_extant(wsi->a.context, wsi->tsi, h);
+
 		assert(h->policy);
 
 #if defined(LWS_WITH_CONMON)
@@ -499,6 +502,8 @@ secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 		lws_sul_cancel(&h->sul_timeout);
 
+		lws_ss_assert_extant(wsi->a.context, wsi->tsi, h);
+
 #if defined(LWS_WITH_CONMON)
 		lws_conmon_ss_json(h);
 #endif
@@ -535,12 +540,13 @@ secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		}
 		break;
 
-
 	case LWS_CALLBACK_ESTABLISHED_CLIENT_HTTP:
 
 		if (!h)
 			return -1;
 
+		lws_ss_assert_extant(wsi->a.context, wsi->tsi, h);
+
 #if defined(LWS_WITH_CONMON)
 		lws_conmon_ss_json(h);
 #endif
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index 6df37246c..119f2af81 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -1780,3 +1780,26 @@ lws_log_prepend_ss(struct lws_log_cx *cx, void *obj, char **p, char *e)
 	*p += lws_snprintf(*p, lws_ptr_diff_size_t(e, (*p)), "%s: ",
 			lws_ss_tag(h));
 }
+
+#if defined(_DEBUG)
+void
+lws_ss_assert_extant(struct lws_context *cx, int tsi, struct lws_ss_handle *h)
+{
+	struct lws_context_per_thread *pt = &cx->pt[tsi];
+
+	lws_start_foreach_dll_safe(struct lws_dll2 *, d, d1, pt->ss_owner.head) {
+		struct lws_ss_handle *h1 = lws_container_of(d,
+						struct lws_ss_handle, list);
+
+		if (h == h1)
+			return; /* okay */
+
+	} lws_end_foreach_dll_safe(d, d1);
+
+	/*
+	 * The ss handle is not listed in the pt ss handle owner...
+	 */
+
+	assert(0);
+}
+#endif