diff --git a/lib/http2/ssl-http2.c b/lib/http2/ssl-http2.c
index 592a73dd9..894fa71ba 100644
--- a/lib/http2/ssl-http2.c
+++ b/lib/http2/ssl-http2.c
@@ -103,6 +103,9 @@ int lws_h2_configure_if_upgraded(struct lws *wsi)
 	char cstr[10];
 	unsigned len;
 
+	if (!wsi->ssl)
+		return 0;
+
 	SSL_get0_alpn_selected(wsi->ssl, &name, &len);
 	if (!len) {
 		lwsl_info("no ALPN upgrade\n");
diff --git a/lib/server/ssl-server.c b/lib/server/ssl-server.c
index a9516f223..c4362824b 100644
--- a/lib/server/ssl-server.c
+++ b/lib/server/ssl-server.c
@@ -155,7 +155,7 @@ lws_ssl_server_name_cb(SSL *ssl, int *ad, void *arg)
 	 */
 	vh = context->vhost_list;
 	while (vh) {
-		if (!vh->being_destroyed && vh->ssl_ctx == SSL_get_SSL_CTX(ssl))
+		if (!vh->being_destroyed && ssl && vh->ssl_ctx == SSL_get_SSL_CTX(ssl))
 			break;
 		vh = vh->vhost_next;
 	}
diff --git a/lib/ssl.c b/lib/ssl.c
index 007dd3ef5..755d06db4 100644
--- a/lib/ssl.c
+++ b/lib/ssl.c
@@ -904,7 +904,7 @@ accepted:
 		/* adapt our vhost to match the SNI SSL_CTX that was chosen */
 		vh = context->vhost_list;
 		while (vh) {
-			if (!vh->being_destroyed &&
+			if (!vh->being_destroyed && wsi->ssl &&
 			    vh->ssl_ctx == SSL_get_SSL_CTX(wsi->ssl)) {
 				lwsl_info("setting wsi to vh %s\n", vh->name);
 				wsi->vhost = vh;