diff --git a/lib/secure-streams/policy-common.c b/lib/secure-streams/policy-common.c
index 84dc234bc..81be61985 100644
--- a/lib/secure-streams/policy-common.c
+++ b/lib/secure-streams/policy-common.c
@@ -162,7 +162,7 @@ lws_ss_policy_ref_trust_store(struct lws_context *context,
 	}
 	v = lws_get_vhost_by_name(context, pol->trust.store->name);
 	if (v) {
-		lwsl_notice("%s: vh already exists\n", __func__);
+		lwsl_debug("%s: vh already exists\n", __func__);
 		goto accepted;
 	}
 
diff --git a/lib/secure-streams/private-lib-secure-streams.h b/lib/secure-streams/private-lib-secure-streams.h
index 9332d03d4..a6af660c3 100644
--- a/lib/secure-streams/private-lib-secure-streams.h
+++ b/lib/secure-streams/private-lib-secure-streams.h
@@ -241,6 +241,14 @@ typedef struct lws_sspc_metadata {
 	/* the value of length .len is overallocated after this */
 } lws_sspc_metadata_t;
 
+/* state of the upstream proxy onward connection */
+
+enum {
+	LWSSSPC_ONW_NONE,
+	LWSSSPC_ONW_REQ,
+	LWSSSPC_ONW_ONGOING,
+	LWSSSPC_ONW_CONN,
+};
 
 typedef struct lws_sspc_handle {
 	char			rideshare_list[128];
@@ -269,13 +277,14 @@ typedef struct lws_sspc_handle {
 	int16_t			temp16;
 
 	uint8_t			rideshare_ofs[4];
-	uint8_t			conn_req;
 	uint8_t			rsidx;
 
+	uint8_t			conn_req_state:2;
 	uint8_t			destroying:1;
 	uint8_t			non_wsi:1;
 	uint8_t			ignore_txc:1;
 	uint8_t			pending_timeout_update:1;
+	uint8_t			pending_writeable_len:1;
 } lws_sspc_handle_t;
 
 typedef struct backoffs {