diff --git a/ssl/d1_both.cc b/ssl/d1_both.cc
index 5e5fc4b..798deb0 100644
--- a/ssl/d1_both.cc
+++ b/ssl/d1_both.cc
@@ -780,6 +780,11 @@
 }
 
 static int send_flight(SSL *ssl) {
+  if (ssl->s3->write_shutdown != ssl_shutdown_none) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
+    return -1;
+  }
+
   dtls1_update_mtu(ssl);
 
   int ret = -1;
diff --git a/ssl/d1_pkt.cc b/ssl/d1_pkt.cc
index 7e329e3..e2a8e6a 100644
--- a/ssl/d1_pkt.cc
+++ b/ssl/d1_pkt.cc
@@ -213,6 +213,11 @@
   assert(!SSL_in_init(ssl));
   *out_needs_handshake = false;
 
+  if (ssl->s3->write_shutdown != ssl_shutdown_none) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
+    return -1;
+  }
+
   if (len > SSL3_RT_MAX_PLAIN_LENGTH) {
     OPENSSL_PUT_ERROR(SSL, SSL_R_DTLS_MESSAGE_TOO_BIG);
     return -1;
diff --git a/ssl/s3_both.cc b/ssl/s3_both.cc
index b513a42..1459085 100644
--- a/ssl/s3_both.cc
+++ b/ssl/s3_both.cc
@@ -233,6 +233,11 @@
     return 1;
   }
 
+  if (ssl->s3->write_shutdown != ssl_shutdown_none) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
+    return -1;
+  }
+
   if (ssl->s3->pending_flight->length > 0xffffffff ||
       ssl->s3->pending_flight->length > INT_MAX) {
     OPENSSL_PUT_ERROR(SSL, ERR_R_INTERNAL_ERROR);
diff --git a/ssl/s3_pkt.cc b/ssl/s3_pkt.cc
index 509f8d3..e647d06 100644
--- a/ssl/s3_pkt.cc
+++ b/ssl/s3_pkt.cc
@@ -133,6 +133,11 @@
 
   *out_needs_handshake = false;
 
+  if (ssl->s3->write_shutdown != ssl_shutdown_none) {
+    OPENSSL_PUT_ERROR(SSL, SSL_R_PROTOCOL_IS_SHUTDOWN);
+    return -1;
+  }
+
   unsigned tot, n, nw;
 
   assert(ssl->s3->wnum <= INT_MAX);
diff --git a/ssl/tls_record.cc b/ssl/tls_record.cc
index 2a28859..a85a08f 100644
--- a/ssl/tls_record.cc
+++ b/ssl/tls_record.cc
@@ -476,8 +476,8 @@
 // |tls_seal_scatter_record| implements TLS 1.0 CBC 1/n-1 record splitting and
 // may write two records concatenated.
 static int tls_seal_scatter_record(SSL *ssl, uint8_t *out_prefix, uint8_t *out,
-                            uint8_t *out_suffix, uint8_t type,
-                            const uint8_t *in, size_t in_len) {
+                                   uint8_t *out_suffix, uint8_t type,
+                                   const uint8_t *in, size_t in_len) {
   if (type == SSL3_RT_APPLICATION_DATA && in_len > 1 &&
       ssl_needs_record_splitting(ssl)) {
     assert(ssl->s3->aead_write_ctx->ExplicitNonceLen() == 0);