diff --git a/lib/secure-streams/private-lib-secure-streams.h b/lib/secure-streams/private-lib-secure-streams.h
index f338fc6b8..917b45100 100644
--- a/lib/secure-streams/private-lib-secure-streams.h
+++ b/lib/secure-streams/private-lib-secure-streams.h
@@ -153,6 +153,7 @@ typedef struct lws_ss_handle {
 	uint8_t			hanging_som:1;
 	uint8_t			inside_msg:1;
 	uint8_t			being_serialized:1; /* we are not the consumer */
+	uint8_t			destroying:1;
 } lws_ss_handle_t;
 
 /* connection helper that doesn't need to hang around after connection starts */
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index fdfa3dd6b..7c76a0dfc 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -808,6 +808,12 @@ lws_ss_destroy(lws_ss_handle_t **ppss)
 	if (!h)
 		return;
 
+	if (h->destroying) {
+		lwsl_info("%s: reentrant destroy\n", __func__);
+		return;
+	}
+	h->destroying = 1;
+
 	if (h->wsi) {
 		/*
 		 * Don't let the wsi point to us any more,