diff --git a/lib/secure-streams/secure-streams-client.c b/lib/secure-streams/secure-streams-client.c
index 1a61c8b38..c03fb0c04 100644
--- a/lib/secure-streams/secure-streams-client.c
+++ b/lib/secure-streams/secure-streams-client.c
@@ -171,7 +171,7 @@ callback_sspc_client(struct lws *wsi, enum lws_callback_reasons reason,
 		lwsl_info("%s: RAW_RX: rx %d\n", __func__, (int)len);
 
 		if (!h || !h->cwsi) {
-			lwsl_err("%s: rx with bad conn state\n", __func__);
+			lwsl_info("%s: rx when client ss destroyed\n", __func__);
 
 			return -1;
 		}
@@ -535,8 +535,10 @@ lws_sspc_destroy(lws_sspc_handle_t **ph)
 
 	if (h->dsh)
 		lws_dsh_destroy(&h->dsh);
-	if (h->cwsi)
+	if (h->cwsi) {
+		lws_set_opaque_user_data(h->cwsi, NULL);
 		h->cwsi = NULL;
+	}
 
 	/* clean out any pending metadata changes that didn't make it */
 
diff --git a/lib/secure-streams/secure-streams-process.c b/lib/secure-streams/secure-streams-process.c
index 7c3185df2..c8c8b4e17 100644
--- a/lib/secure-streams/secure-streams-process.c
+++ b/lib/secure-streams/secure-streams-process.c
@@ -317,7 +317,7 @@ callback_ss_proxy(struct lws *wsi, enum lws_callback_reasons reason,
 				 */
 				lws_wsi_close(cw, LWS_TO_KILL_ASYNC);
 			conn->wsi = NULL;
-
+			conn->ss->wsi = NULL;
 
 			lws_ss_destroy(&conn->ss);
 			/* conn may have gone */
diff --git a/minimal-examples/secure-streams/minimal-secure-streams-testsfail/CMakeLists.txt b/minimal-examples/secure-streams/minimal-secure-streams-testsfail/CMakeLists.txt
index 909ec4e10..436be60bb 100644
--- a/minimal-examples/secure-streams/minimal-secure-streams-testsfail/CMakeLists.txt
+++ b/minimal-examples/secure-streams/minimal-secure-streams-testsfail/CMakeLists.txt
@@ -66,9 +66,9 @@ if (requirements)
 			if (VALGRIND)
 				add_test(NAME sspc-minimaltf COMMAND
 					${VALGRIND} --tool=memcheck --leak-check=yes --num-callers=20
-					$<TARGET_FILE:lws-minimal-secure-streams-testsfail-client> -i +${CTEST_SOCKET_PATH})
+					$<TARGET_FILE:lws-minimal-secure-streams-testsfail-client> -i +${CTEST_SOCKET_PATH} -d1039)
 			else()
-				add_test(NAME sspc-minimaltf COMMAND lws-minimal-secure-streams-testsfail-client -i +${CTEST_SOCKET_PATH})
+				add_test(NAME sspc-minimaltf COMMAND lws-minimal-secure-streams-testsfail-client -i +${CTEST_SOCKET_PATH} -d1039)
 			endif()
 		
 			set_tests_properties(sspc-minimaltf PROPERTIES