diff --git a/lib/libwebsockets.c b/lib/libwebsockets.c
index a332fc69..761febec 100644
--- a/lib/libwebsockets.c
+++ b/lib/libwebsockets.c
@@ -53,6 +53,9 @@ libwebsocket_close_and_free_session(struct libwebsocket_context *context,
 
 	old_state = wsi->state;
 
+	if (wsi->socket_is_permanently_unusable)
+		goto just_kill_connection;
+
 	switch (old_state) {
 	case WSI_STATE_DEAD_SOCKET:
 		return;
@@ -86,15 +89,9 @@ libwebsocket_close_and_free_session(struct libwebsocket_context *context,
 			LWS_CALLBACK_CLIENT_CONNECTION_ERROR, wsi->user_space, NULL, 0);
 
 		free(wsi->u.hdr.ah);
+		wsi->u.hdr.ah = NULL;
 		goto just_kill_connection;
 	}
-	
-	if (wsi->mode == LWS_CONNMODE_HTTP2_SERVING) {
-		if (wsi->u.hdr.ah) {
-			free(wsi->u.hdr.ah);
-			wsi->u.hdr.ah = NULL;
-		}
-	}
 
 	if (wsi->mode == LWS_CONNMODE_HTTP_SERVING_ACCEPTED) {
 		if (wsi->u.http.fd != LWS_INVALID_FILE) {
@@ -218,6 +215,11 @@ just_kill_connection:
 		wsi->rxflow_buffer = NULL;
 	}
 
+	if (wsi->mode == LWS_CONNMODE_HTTP2_SERVING && wsi->u.hdr.ah) {
+		free(wsi->u.hdr.ah);
+		wsi->u.hdr.ah = NULL;
+	}
+	
 	if ((old_state == WSI_STATE_ESTABLISHED ||
 	     wsi->mode == LWS_CONNMODE_WS_SERVING ||
 	     wsi->mode == LWS_CONNMODE_WS_CLIENT)) {
diff --git a/lib/output.c b/lib/output.c
index be1e5445..b2ab45bf 100644
--- a/lib/output.c
+++ b/lib/output.c
@@ -132,6 +132,8 @@ int lws_issue_raw(struct libwebsocket *wsi, unsigned char *buf, size_t len)
 
 	switch (n) {
 	case LWS_SSL_CAPABLE_ERROR:
+		/* we're going to close, let close know sends aren't possible */
+		wsi->socket_is_permanently_unusable = 1;
 		return -1;
 	case LWS_SSL_CAPABLE_MORE_SERVICE:
 		/* nothing got sent, not fatal, retry the whole thing later */
diff --git a/lib/private-libwebsockets.h b/lib/private-libwebsockets.h
index a52ee41c..5946a5ee 100755
--- a/lib/private-libwebsockets.h
+++ b/lib/private-libwebsockets.h
@@ -742,6 +742,7 @@ struct libwebsocket {
 
 	unsigned int hdr_parsing_completed:1;
 	unsigned int user_space_externally_allocated:1;
+	unsigned int socket_is_permanently_unusable:1;
 
 	char pending_timeout; /* enum pending_timeout */
 	time_t pending_timeout_limit;