diff --git a/lib/secure-streams/private-lib-secure-streams.h b/lib/secure-streams/private-lib-secure-streams.h
index 12b6f001f..f02e86fce 100644
--- a/lib/secure-streams/private-lib-secure-streams.h
+++ b/lib/secure-streams/private-lib-secure-streams.h
@@ -165,6 +165,8 @@ typedef struct lws_ss_handle {
 
 	lws_ss_constate_t	connstate;/**< public connection state */
 	lws_ss_seq_state_t	seqstate; /**< private connection state */
+	lws_ss_state_return_t	pending_ret; /**< holds desired disposition
+						* for ss during CCE */
 
 #if defined(LWS_WITH_SERVER)
 	int			txn_resp;
@@ -189,6 +191,9 @@ typedef struct lws_ss_handle {
 	uint8_t			destroying:1;
 	uint8_t			ss_dangling_connected:1;
 	uint8_t			proxy_onward:1; /* opaque is conn */
+	uint8_t			inside_connect:1; /* set if we are currently
+						   * creating the onward
+						   * connect */
 } lws_ss_handle_t;
 
 /* connection helper that doesn't need to hang around after connection starts */
diff --git a/lib/secure-streams/protocols/ss-h1.c b/lib/secure-streams/protocols/ss-h1.c
index db7069823..06effae4c 100644
--- a/lib/secure-streams/protocols/ss-h1.c
+++ b/lib/secure-streams/protocols/ss-h1.c
@@ -461,13 +461,24 @@ secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 			  h->lc.gutag, in ? (const char *)in : "none");
 		/* already disconnected, no action for DISCONNECT_ME */
 		r = lws_ss_event_helper(h, LWSSSCS_UNREACHABLE);
-		if (r)
+		if (r) {
+			if (h->inside_connect) {
+				h->pending_ret = r;
+				break;
+			}
+
 			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+		}
 
 		h->wsi = NULL;
 		r = lws_ss_backoff(h);
-		if (r != LWSSSSRET_OK)
+		if (r != LWSSSSRET_OK) {
+			if (h->inside_connect) {
+				h->pending_ret = r;
+				break;
+			}
 			return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+		}
 		break;
 
 	case LWS_CALLBACK_CLIENT_HTTP_REDIRECT:
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index a13e7526f..53c36a88d 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -855,7 +855,10 @@ _lws_ss_client_connect(lws_ss_handle_t *h, int is_retry, void *conn_if_sspc_onw)
 		return r;
 	}
 
+	h->inside_connect = 1;
+	h->pending_ret = LWSSSSRET_OK;
 	wsi = lws_client_connect_via_info(&i);
+	h->inside_connect = 0;
 	lws_free(path);
 	if (!wsi) {
 		/*
@@ -863,6 +866,9 @@ _lws_ss_client_connect(lws_ss_handle_t *h, int is_retry, void *conn_if_sspc_onw)
 		 * having to go around the event loop
 		 */
 
+		if (h->pending_ret)
+			return h->pending_ret;
+
 		if (h->prev_ss_state != LWSSSCS_UNREACHABLE &&
 		    h->prev_ss_state != LWSSSCS_ALL_RETRIES_FAILED) {
 			/*