diff --git a/src/lib/net/TCPSocket.h b/src/lib/net/TCPSocket.h
index cece95fd..832cd128 100644
--- a/src/lib/net/TCPSocket.h
+++ b/src/lib/net/TCPSocket.h
@@ -62,7 +62,7 @@ public:
 
 protected:
 	ArchSocket			getSocket() { return m_socket; }
-
+	IEventQueue*		getEvents() { return m_events; }
 	virtual bool		isSecureReady() { return false; }
 	virtual bool		isSecure() { return false; }
 	virtual UInt32		secureRead(void* buffer, UInt32) { return 0; }
@@ -76,11 +76,12 @@ protected:
 
 	Mutex&				getMutex() { return m_mutex; }
 
+	void				sendEvent(Event::Type);
+
 private:
 	void				init();
 
 	void				sendConnectionFailedEvent(const char*);
-	void				sendEvent(Event::Type);
 	void				onConnected();
 	void				onInputShutdown();
 	void				onOutputShutdown();
diff --git a/src/lib/plugin/ns/SecureSocket.cpp b/src/lib/plugin/ns/SecureSocket.cpp
index 97137591..0f66e8cd 100644
--- a/src/lib/plugin/ns/SecureSocket.cpp
+++ b/src/lib/plugin/ns/SecureSocket.cpp
@@ -308,7 +308,8 @@ SecureSocket::checkResult(int n)
 	case SSL_ERROR_SSL:
 		// a failure in the SSL library occurred
 		LOG((CLOG_DEBUG2 "SSL_ERROR_SSL"));
-		throwError("Secure socket SSL error");
+		sendEvent(getEvents()->forIStream().inputShutdown());
+		showError();
 		break;
 
 	default:
diff --git a/src/lib/server/ClientListener.cpp b/src/lib/server/ClientListener.cpp
index 81900ae3..946c7705 100644
--- a/src/lib/server/ClientListener.cpp
+++ b/src/lib/server/ClientListener.cpp
@@ -188,6 +188,7 @@ ClientListener::handleUnknownClient(const Event&, void* vclient)
 
 	// get the real client proxy and install it
 	ClientProxy* client = unknownClient->orphanClientProxy();
+	bool handshakeOk = true;
 	if (client != NULL) {
 		// handshake was successful
 		m_waitingClients.push_back(client);
@@ -199,12 +200,25 @@ ClientListener::handleUnknownClient(const Event&, void* vclient)
 								&ClientListener::handleClientDisconnected,
 								client));
 	}
+	else {
+		handshakeOk = false;
+	}
 
 	// now finished with unknown client
 	m_events->removeHandler(m_events->forClientProxyUnknown().success(), client);
 	m_events->removeHandler(m_events->forClientProxyUnknown().failure(), client);
 	m_newClients.erase(unknownClient);
+	PacketStreamFilter* streamFileter = dynamic_cast<PacketStreamFilter*>(unknownClient->getStream());
+	IDataSocket* socket = NULL;
+	if (streamFileter != NULL) {
+		socket = dynamic_cast<IDataSocket*>(streamFileter->getStream());
+	}
+
 	delete unknownClient;
+
+	if (m_useSecureNetwork && !handshakeOk) {
+		deleteSocket(socket);
+	}
 }
 
 void
diff --git a/src/lib/server/ClientProxyUnknown.h b/src/lib/server/ClientProxyUnknown.h
index 4d7b142d..2907c9cf 100644
--- a/src/lib/server/ClientProxyUnknown.h
+++ b/src/lib/server/ClientProxyUnknown.h
@@ -43,6 +43,9 @@ public:
 	*/
 	ClientProxy*		orphanClientProxy();
 
+	//! Get the stream
+	synergy::IStream*	getStream() { return m_stream; }
+
 	//@}
 
 private: