diff --git a/lib/secure-streams/secure-streams-client.c b/lib/secure-streams/secure-streams-client.c
index 68781f9a9..f724431bf 100644
--- a/lib/secure-streams/secure-streams-client.c
+++ b/lib/secure-streams/secure-streams-client.c
@@ -512,12 +512,8 @@ lws_sspc_destroy(lws_sspc_handle_t **ph)
 
 	if (h->dsh)
 		lws_dsh_destroy(&h->dsh);
-	if (h->cwsi) {
-		struct lws *wsi = h->cwsi;
+	if (h->cwsi)
 		h->cwsi = NULL;
-		if (wsi)
-			lws_set_timeout(wsi, 1, LWS_TO_KILL_SYNC);
-	}
 
 	/* clean out any pending metadata changes that didn't make it */
 
diff --git a/lib/secure-streams/secure-streams-serialize.c b/lib/secure-streams/secure-streams-serialize.c
index 021945e43..fd4e4034b 100644
--- a/lib/secure-streams/secure-streams-serialize.c
+++ b/lib/secure-streams/secure-streams-serialize.c
@@ -684,10 +684,19 @@ payload_ff:
 						     parser);
 				h->txc.peer_tx_cr_est -= n;
 
-				if (client_pss_to_sspc_h(pss, ssi))
+				if (client_pss_to_sspc_h(pss, ssi)) {
 					/* we still have an sspc handle */
-					ssi->rx(client_pss_to_userdata(pss),
+					int ret = ssi->rx(client_pss_to_userdata(pss),
 						(uint8_t *)cp, n, flags);
+					switch (ret) {
+					case LWSSSSRET_OK:
+						break;
+					case LWSSSSRET_DISCONNECT_ME:
+						goto hangup;
+					case LWSSSSRET_DESTROY_ME:
+						return LWSSSSRET_DESTROY_ME;
+					}
+				}
 
 #if defined(LWS_WITH_DETAILED_LATENCY)
 				if (lws_det_lat_active(context)) {