diff --git a/lib/core-net/close.c b/lib/core-net/close.c
index 1319ad2df..94f98589c 100644
--- a/lib/core-net/close.c
+++ b/lib/core-net/close.c
@@ -349,6 +349,9 @@ __lws_close_free_wsi(struct lws *wsi, enum lws_close_status reason,
 {
 	struct lws_context_per_thread *pt;
 	const struct lws_protocols *pro;
+#if defined(LWS_WITH_SECURE_STREAMS)
+	lws_ss_handle_t *hh = NULL;
+#endif
 	struct lws_context *context;
 	struct lws *wsi1, *wsi2;
 	int n, ccb;
@@ -842,25 +845,18 @@ async_close:
 			} else
 #endif
 		{
-			lws_ss_handle_t *h = (lws_ss_handle_t *)wsi->a.opaque_user_data;
+			hh = (lws_ss_handle_t *)wsi->a.opaque_user_data;
 
-			if (h) { // && (h->info.flags & LWSSSINFLAGS_ACCEPTED)) {
+			if (hh) { // && (h->info.flags & LWSSSINFLAGS_ACCEPTED)) {
 
 				/*
 				 * ss level: only reports if dangling caliper
 				 * not already reported
 				 */
-				lws_metrics_caliper_report_hist(h->cal_txn, wsi);
+				lws_metrics_caliper_report_hist(hh->cal_txn, wsi);
 
-				h->wsi = NULL;
+				hh->wsi = NULL;
 				wsi->a.opaque_user_data = NULL;
-
-				if (h->ss_dangling_connected &&
-				    lws_ss_event_helper(h, LWSSSCS_DISCONNECTED) ==
-						    LWSSSSRET_DESTROY_ME) {
-
-					lws_ss_destroy(&h);
-				}
 			}
 		}
 	}
@@ -875,6 +871,12 @@ async_close:
 			return;
 
 	__lws_close_free_wsi_final(wsi);
+
+#if defined(LWS_WITH_SECURE_STREAMS)
+	if (hh && hh->ss_dangling_connected &&
+	    lws_ss_event_helper(hh, LWSSSCS_DISCONNECTED) == LWSSSSRET_DESTROY_ME)
+		lws_ss_destroy(&hh);
+#endif
 }
 
 
diff --git a/lib/secure-streams/protocols/ss-h1.c b/lib/secure-streams/protocols/ss-h1.c
index f53a7b14c..707ed8c5a 100644
--- a/lib/secure-streams/protocols/ss-h1.c
+++ b/lib/secure-streams/protocols/ss-h1.c
@@ -653,6 +653,16 @@ secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 		if (h->prev_ss_state != LWSSSCS_CONNECTED) {
 			wsi->client_suppress_CONNECTION_ERROR = 1;
+			/*
+			 * back-to-back http transactions otherwise go
+			 * DISCONNECTED -> CONNECTED, we should insert
+			 * CONNECTING inbetween
+			 */
+			if (h->prev_ss_state == LWSSSCS_DISCONNECTED) {
+				r = lws_ss_event_helper(h, LWSSSCS_CONNECTING);
+				if (r != LWSSSSRET_OK)
+					return _lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, wsi, &h);
+			}
 			if (h->prev_ss_state != LWSSSCS_CONNECTED) {
 				r = lws_ss_event_helper(h, LWSSSCS_CONNECTED);
 				if (r != LWSSSSRET_OK)
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index ad4931686..24f3de98e 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -415,9 +415,22 @@ lws_ss_event_helper(lws_ss_handle_t *h, lws_ss_constate_t cs)
 
 	if (cs == LWSSSCS_CONNECTED)
 		h->ss_dangling_connected = 1;
-	if (cs == LWSSSCS_DISCONNECTED)
+	if (cs == LWSSSCS_DISCONNECTED) {
 		h->ss_dangling_connected = 0;
 
+		h->subseq = 0;
+		h->txn_ok = 0;
+		h->txn_resp_set = 0;
+		h->txn_resp_pending = 0;
+		h->hanging_som = 0;
+		h->inside_msg = 0;
+		h->inside_connect = 0;
+		h->proxy_onward = 0;
+		h->wsi = NULL;
+		h->u.http.good_respcode = 0;
+		h->seqstate = SSSEQ_IDLE;
+	}
+
 	if (h->info.state) {
 		h->h_in_svc = h;
 		r = h->info.state(ss_to_userobj(h), NULL, cs,