diff --git a/lib/tls.js b/lib/tls.js
index e3b90832236..d9690b7dba2 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -321,6 +321,14 @@ function onCryptoStreamEnd() {
   }
 
   if (this.onend) this.onend();
+
+  if (this._opposite._finished &&
+      !this._opposite._ended &&
+      !this._opposite._doneFlag) {
+    this._opposite.once('end', function(xs) {
+      this._done();
+    });
+  }
 }
 
 
diff --git a/test/internet/test-tls-ensure-ssl-free.js b/test/internet/test-tls-ensure-ssl-free.js
new file mode 100644
index 00000000000..3cb3cac99d1
--- /dev/null
+++ b/test/internet/test-tls-ensure-ssl-free.js
@@ -0,0 +1,45 @@
+// Copyright Joyent, Inc. and other Node contributors.
+//
+// Permission is hereby granted, free of charge, to any person obtaining a
+// copy of this software and associated documentation files (the
+// "Software"), to deal in the Software without restriction, including
+// without limitation the rights to use, copy, modify, merge, publish,
+// distribute, sublicense, and/or sell copies of the Software, and to permit
+// persons to whom the Software is furnished to do so, subject to the
+// following conditions:
+//
+// The above copyright notice and this permission notice shall be included
+// in all copies or substantial portions of the Software.
+//
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+// OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+// MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+// NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+// DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+// OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+// USE OR OTHER DEALINGS IN THE SOFTWARE.
+var assert = require('assert');
+var https = require('https');
+
+var wasClosed = 0;
+var options = {
+  host: 'google.com',
+  rejectUnauthorized: false,
+  agent: false
+};
+
+https.get(options, function(res) {
+  var originalClose = res.socket.pair.ssl.close;
+
+  res.socket.pair.ssl.close = function() {
+    wasClosed++;
+    return originalClose.apply(this, arguments);
+  };
+
+  res.resume();
+});
+
+process.on('exit', function() {
+  assert.equal(wasClosed, 1);
+});
+