diff --git a/ssl/d1_both.cc b/ssl/d1_both.cc
index cc1de90..6db348a 100644
--- a/ssl/d1_both.cc
+++ b/ssl/d1_both.cc
@@ -324,9 +324,9 @@
    * the unencrypted epoch (we never renegotiate). Other cases fall through and
    * fail with a fatal error. */
   if ((rr->type == SSL3_RT_APPLICATION_DATA &&
-       ssl->s3->aead_read_ctx != NULL) ||
+       !ssl->s3->aead_read_ctx->is_null_cipher()) ||
       (rr->type == SSL3_RT_CHANGE_CIPHER_SPEC &&
-       ssl->s3->aead_read_ctx == NULL)) {
+       ssl->s3->aead_read_ctx->is_null_cipher())) {
     rr->length = 0;
     goto start;
   }
@@ -628,14 +628,14 @@
   assert(ssl->d1->outgoing_written < ssl->d1->outgoing_messages_len);
   assert(msg == &ssl->d1->outgoing_messages[ssl->d1->outgoing_written]);
 
-  /* DTLS renegotiation is unsupported, so only epochs 0 (NULL cipher) and 1
-   * (negotiated cipher) exist. */
-  assert(ssl->d1->w_epoch == 0 || ssl->d1->w_epoch == 1);
-  assert(msg->epoch <= ssl->d1->w_epoch);
   enum dtls1_use_epoch_t use_epoch = dtls1_use_current_epoch;
-  if (ssl->d1->w_epoch == 1 && msg->epoch == 0) {
+  if (ssl->d1->w_epoch >= 1 && msg->epoch == ssl->d1->w_epoch - 1) {
     use_epoch = dtls1_use_previous_epoch;
+  } else if (msg->epoch != ssl->d1->w_epoch) {
+    OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
+    return seal_error;
   }
+
   size_t overhead = dtls_max_seal_overhead(ssl, use_epoch);
   size_t prefix = dtls_seal_prefix_len(ssl, use_epoch);