diff --git a/src/lib/net/TCPSocket.cpp b/src/lib/net/TCPSocket.cpp
index c54df40b..62175664 100644
--- a/src/lib/net/TCPSocket.cpp
+++ b/src/lib/net/TCPSocket.cpp
@@ -461,15 +461,26 @@ TCPSocket::serviceConnected(ISocketMultiplexerJob* job,
 	}
 
 	bool needNewJob = false;
+	static UInt32 s_retryOutputBufferSize = 0;
 
 	if (write) {
 		try {
 			// write data
 			UInt32 n = m_outputBuffer.getSize();
+
+			if (s_retryOutputBufferSize > 0) {
+				n = s_retryOutputBufferSize;
+			}
+
 			const void* buffer = m_outputBuffer.peek(n);
 			if (isSecure()) {
 				if (isSecureReady()) {
+					s_retryOutputBufferSize = n;
 					n = secureWrite(buffer, n);
+
+					if (n > 0) {
+						s_retryOutputBufferSize = 0;
+					}
 				}
 				else {
 					return job;
@@ -519,7 +530,8 @@ TCPSocket::serviceConnected(ISocketMultiplexerJob* job,
 
 	if (read && m_readable) {
 		try {
-			UInt8 buffer[4096];
+			static UInt8 buffer[4096];
+			memset(buffer, 0, sizeof(buffer));
 			size_t n = 0;
 
 			if (isSecure()) {
diff --git a/src/lib/plugin/ns/SecureSocket.cpp b/src/lib/plugin/ns/SecureSocket.cpp
index 5b1544db..c878871d 100644
--- a/src/lib/plugin/ns/SecureSocket.cpp
+++ b/src/lib/plugin/ns/SecureSocket.cpp
@@ -370,6 +370,21 @@ SecureSocket::checkResult(int n, bool& fatal, bool& retry)
 
 	case SSL_ERROR_SYSCALL:
 		LOG((CLOG_ERR "secure socket error: SSL_ERROR_SYSCALL"));
+		if (ERR_peek_error() == 0) {
+			if (n == 0) {
+				LOG((CLOG_ERR "an EOF violates the protocol"));
+			}
+			else if (n == -1) {
+				// underlying socket I/O reproted an error
+				try {
+					ARCH->throwErrorOnSocket(getSocket());
+				}
+				catch (XArchNetwork& e) {
+					LOG((CLOG_ERR "%s", e.what()));
+				}
+			}
+		}
+
 		fatal = true;
 		break;