diff --git a/lib/output.c b/lib/output.c
index ef70f232..f3acff2c 100644
--- a/lib/output.c
+++ b/lib/output.c
@@ -795,5 +795,5 @@ LWS_VISIBLE int
 lws_ssl_pending_no_ssl(struct lws *wsi)
 {
 	(void)wsi;
-	return 0;
+	return 1;
 }
diff --git a/lib/service.c b/lib/service.c
index 7fc2abc2..fd945625 100644
--- a/lib/service.c
+++ b/lib/service.c
@@ -540,22 +540,21 @@ lws_http_client_read(struct lws *wsi, char **buf, int *len)
 {
 	int rlen, n;
 
-
-
 	rlen = lws_ssl_capable_read(wsi, (unsigned char *)*buf, *len);
-	if (rlen < 0)
-		return -1;
-
-	*len = rlen;
-	if (rlen == 0)
-		return 0;
-
-//	lwsl_err("%s: read %d\n", __func__, rlen);
+	*len = 0;
 
 	/* allow the source to signal he has data again next time */
-	wsi->client_rx_avail = 0;
 	lws_change_pollfd(wsi, 0, LWS_POLLIN);
 
+	if (rlen == LWS_SSL_CAPABLE_ERROR)
+		return -1;
+
+	if (rlen <= 0)
+		return 0;
+
+	*len = rlen;
+	wsi->client_rx_avail = 0;
+
 	/*
 	 * server may insist on transfer-encoding: chunked,
 	 * so http client must deal with it
@@ -974,6 +973,13 @@ drain:
 		    !wsi->told_user_closed) {
 
 			/*
+			 * In SSL mode we get POLLIN notification about
+			 * encrypted data in.
+			 *
+			 * But that is not necessarily related to decrypted
+			 * data out becoming available; in may need to perform
+			 * other in or out before that happens.
+			 *
 			 * simply mark ourselves as having readable data
 			 * and turn off our POLLIN
 			 */