diff --git a/lib/secure-streams/secure-streams-client.c b/lib/secure-streams/secure-streams-client.c
index 3497855ac..91d9bd0c5 100644
--- a/lib/secure-streams/secure-streams-client.c
+++ b/lib/secure-streams/secure-streams-client.c
@@ -178,6 +178,13 @@ callback_sspc_client(struct lws *wsi, enum lws_callback_reasons reason,
 		lwsl_info("%s: LWS_CALLBACK_RAW_CLOSE: %s proxy conn down, sspc h %s\n",
 			    __func__, lws_wsi_tag(wsi), lws_sspc_tag(h));
 		if (h) {
+			lws_dsh_destroy(&h->dsh);
+			if (h->ss_dangling_connected && h->ssi.state) {
+				lwsl_notice("%s: setting _DISCONNECTED\n", __func__);
+				h->ss_dangling_connected = 0;
+				h->prev_ss_state = LWSSSCS_DISCONNECTED;
+				h->ssi.state(ss_to_userobj(h), NULL, LWSSSCS_DISCONNECTED, 0);
+			}
 			h->cwsi = NULL;
 			/*
 			 * schedule a reconnect in 1s
@@ -200,6 +207,12 @@ callback_sspc_client(struct lws *wsi, enum lws_callback_reasons reason,
 			return -1;
 		}
 
+		if (!len) {
+			lwsl_notice("%s: RAW_RX: zero len\n", __func__);
+
+			return -1;
+		}
+
 		n = lws_ss_deserialize_parse(&h->parser, lws_get_context(wsi),
 					     h->dsh, in, len, &h->state, h,
 					     (lws_ss_handle_t **)m, &h->ssi, 1);