diff --git a/lib/secure-streams/private-lib-secure-streams.h b/lib/secure-streams/private-lib-secure-streams.h
index b48af3a27..fb2607658 100644
--- a/lib/secure-streams/private-lib-secure-streams.h
+++ b/lib/secure-streams/private-lib-secure-streams.h
@@ -1,7 +1,7 @@
 /*
  * libwebsockets - small server side websockets and web server implementation
  *
- * Copyright (C) 2019 - 2020 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2019 - 2021 Andy Green <andy@warmcat.com>
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to
@@ -485,6 +485,9 @@ _lws_ss_alloc_set_metadata(lws_ss_metadata_t *omd, const char *name,
 lws_ss_state_return_t
 _lws_ss_client_connect(lws_ss_handle_t *h, int is_retry, void *conn_if_sspc_onw);
 
+lws_ss_state_return_t
+_lws_ss_request_tx(lws_ss_handle_t *h);
+
 int
 __lws_ss_proxy_bind_ss_to_conn_wsi(void *parconn, size_t dsh_size);
 
diff --git a/lib/secure-streams/secure-streams-process.c b/lib/secure-streams/secure-streams-process.c
index abd8c9128..eda1a5b52 100644
--- a/lib/secure-streams/secure-streams-process.c
+++ b/lib/secure-streams/secure-streams-process.c
@@ -1,7 +1,7 @@
 /*
  * libwebsockets - small server side websockets and web server implementation
  *
- * Copyright (C) 2019 - 2020 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2019 - 2021 Andy Green <andy@warmcat.com>
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to
@@ -207,7 +207,7 @@ ss_proxy_onward_tx(void *userobj, lws_ss_tx_ordinal_t ord, uint8_t *buf,
 
 	/* ... there's more we want to send? */
 	if (!lws_dsh_get_head(m->conn->dsh, KIND_C_TO_P, (void **)&p, &si))
-		lws_ss_request_tx(m->conn->ss);
+		_lws_ss_request_tx(m->conn->ss);
 
 	if (!*len && !*flags)
 		/* we don't actually want to send anything */
diff --git a/lib/secure-streams/secure-streams-serialize.c b/lib/secure-streams/secure-streams-serialize.c
index 571e6714c..568d72261 100644
--- a/lib/secure-streams/secure-streams-serialize.c
+++ b/lib/secure-streams/secure-streams-serialize.c
@@ -1,7 +1,7 @@
 /*
  * libwebsockets - small server side websockets and web server implementation
  *
- * Copyright (C) 2019 - 2020 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2019 - 2021 Andy Green <andy@warmcat.com>
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to
@@ -746,7 +746,7 @@ payload_ff:
 				}
 
 				if (proxy_pss_to_ss_h(pss))
-					lws_ss_request_tx(
+					_lws_ss_request_tx(
 						proxy_pss_to_ss_h(pss));
 			} else {
 
@@ -921,7 +921,7 @@ payload_ff:
 						 __func__, par->temp32,
 						 proxy_pss_to_ss_h(pss)->wsi->
 							 txc.peer_tx_cr_est);
-					lws_ss_request_tx(proxy_pss_to_ss_h(pss));
+					_lws_ss_request_tx(proxy_pss_to_ss_h(pss));
 				} else
 #endif
 					lwsl_info("%s: dropping TXCR\n", __func__);
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index f468a243b..a51392e10 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -1,7 +1,7 @@
 /*
  * libwebsockets - small server side websockets and web server implementation
  *
- * Copyright (C) 2019 - 2020 Andy Green <andy@warmcat.com>
+ * Copyright (C) 2019 - 2021 Andy Green <andy@warmcat.com>
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to
@@ -403,7 +403,7 @@ lws_ss_timeout_sul_check_cb(lws_sorted_usec_list_t *sul)
 	/* we want to retry... */
 	h->seqstate = SSSEQ_DO_RETRY;
 
-	r = lws_ss_request_tx(h);
+	r = _lws_ss_request_tx(h);
 	_lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, NULL, &h);
 }
 
@@ -821,7 +821,10 @@ _lws_ss_client_connect(lws_ss_handle_t *h, int is_retry, void *conn_if_sspc_onw)
 lws_ss_state_return_t
 lws_ss_client_connect(lws_ss_handle_t *h)
 {
-	return _lws_ss_client_connect(h, 0, 0);
+	lws_ss_state_return_t r;
+	r = _lws_ss_client_connect(h, 0, 0);
+	_lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, h->wsi, &h);
+	return r;
 }
 
 /*
@@ -1404,6 +1407,16 @@ lws_ss_request_tx(lws_ss_handle_t *h)
 {
 	lws_ss_state_return_t r;
 
+	r = _lws_ss_request_tx(h);
+	_lws_ss_handle_state_ret_CAN_DESTROY_HANDLE(r, NULL, &h);
+	return r;
+}
+
+lws_ss_state_return_t
+_lws_ss_request_tx(lws_ss_handle_t *h)
+{
+	lws_ss_state_return_t r;
+
 	// lwsl_notice("%s: h %p, wsi %p\n", __func__, h, h->wsi);
 
 	if (h->wsi) {