diff --git a/ssl/s3_clnt.c b/ssl/s3_clnt.c
index 2f2c451..9eca492 100644
--- a/ssl/s3_clnt.c
+++ b/ssl/s3_clnt.c
@@ -775,7 +775,7 @@
 		{
 		if (!ssl3_is_version_enabled(s, server_version))
 			{
-			OPENSSL_PUT_ERROR(SSL, ssl3_get_server_hello, SSL_R_WRONG_SSL_VERSION);
+			OPENSSL_PUT_ERROR(SSL, ssl3_get_server_hello, SSL_R_UNSUPPORTED_PROTOCOL);
 			s->version = server_version;
 			al = SSL_AD_PROTOCOL_VERSION;
 			goto f_err;
diff --git a/ssl/s3_srvr.c b/ssl/s3_srvr.c
index 71f7fef..5f3f839 100644
--- a/ssl/s3_srvr.c
+++ b/ssl/s3_srvr.c
@@ -843,7 +843,7 @@
 		uint16_t version = ssl3_get_mutual_version(s, client_version);
 		if (version == 0)
 			{
-			OPENSSL_PUT_ERROR(SSL, ssl3_get_client_hello, SSL_R_WRONG_VERSION_NUMBER);
+			OPENSSL_PUT_ERROR(SSL, ssl3_get_client_hello, SSL_R_UNSUPPORTED_PROTOCOL);
 			s->version = s->client_version;
 			al = SSL_AD_PROTOCOL_VERSION;
 			goto f_err;
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index 2b91f43..e3bf338 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -1703,6 +1703,94 @@
 	}
 }
 
+func addMinimumVersionTests() {
+	for i, shimVers := range tlsVersions {
+		// Assemble flags to disable all older versions on the shim.
+		var flags []string
+		for _, vers := range tlsVersions[:i] {
+			flags = append(flags, vers.flag)
+		}
+
+		for _, runnerVers := range tlsVersions {
+			protocols := []protocol{tls}
+			if runnerVers.hasDTLS && shimVers.hasDTLS {
+				protocols = append(protocols, dtls)
+			}
+			for _, protocol := range protocols {
+				suffix := shimVers.name + "-" + runnerVers.name
+				if protocol == dtls {
+					suffix += "-DTLS"
+				}
+				shimVersFlag := strconv.Itoa(int(versionToWire(shimVers.version, protocol == dtls)))
+
+				// TODO(davidben): This should also assert on
+				// expectedLocalError to check we send an alert
+				// rather than close the connection, but the TLS
+				// code currently fails this.
+				var expectedVersion uint16
+				var shouldFail bool
+				var expectedError string
+				if runnerVers.version >= shimVers.version {
+					expectedVersion = runnerVers.version
+				} else {
+					shouldFail = true
+					expectedError = ":UNSUPPORTED_PROTOCOL:"
+				}
+
+				testCases = append(testCases, testCase{
+					protocol: protocol,
+					testType: clientTest,
+					name:     "MinimumVersion-Client-" + suffix,
+					config: Config{
+						MaxVersion: runnerVers.version,
+					},
+					flags:           flags,
+					expectedVersion: expectedVersion,
+					shouldFail:      shouldFail,
+					expectedError:   expectedError,
+				})
+				testCases = append(testCases, testCase{
+					protocol: protocol,
+					testType: clientTest,
+					name:     "MinimumVersion-Client2-" + suffix,
+					config: Config{
+						MaxVersion: runnerVers.version,
+					},
+					flags:           []string{"-min-version", shimVersFlag},
+					expectedVersion: expectedVersion,
+					shouldFail:      shouldFail,
+					expectedError:   expectedError,
+				})
+
+				testCases = append(testCases, testCase{
+					protocol: protocol,
+					testType: serverTest,
+					name:     "MinimumVersion-Server-" + suffix,
+					config: Config{
+						MaxVersion: runnerVers.version,
+					},
+					flags:           flags,
+					expectedVersion: expectedVersion,
+					shouldFail:      shouldFail,
+					expectedError:   expectedError,
+				})
+				testCases = append(testCases, testCase{
+					protocol: protocol,
+					testType: serverTest,
+					name:     "MinimumVersion-Server2-" + suffix,
+					config: Config{
+						MaxVersion: runnerVers.version,
+					},
+					flags:           []string{"-min-version", shimVersFlag},
+					expectedVersion: expectedVersion,
+					shouldFail:      shouldFail,
+					expectedError:   expectedError,
+				})
+			}
+		}
+	}
+}
+
 func addD5BugTests() {
 	testCases = append(testCases, testCase{
 		testType: serverTest,
@@ -2398,6 +2486,7 @@
 	addCBCSplittingTests()
 	addClientAuthTests()
 	addVersionNegotiationTests()
+	addMinimumVersionTests()
 	addD5BugTests()
 	addExtensionTests()
 	addResumptionVersionTests()