diff --git a/source/extensions/transport_sockets/tls/ssl_socket.cc b/source/extensions/transport_sockets/tls/ssl_socket.cc
index 08d741b56b..d2d3b2b8ef 100644
--- a/source/extensions/transport_sockets/tls/ssl_socket.cc
+++ b/source/extensions/transport_sockets/tls/ssl_socket.cc
@@ -178,6 +178,14 @@ Network::IoResult SslSocket::doRead(Buffer::Instance& read_buffer) {
             break;
           }
           FALLTHRU;
+        case SSL_ERROR_SSL:
+          // If EAGAIN treat it as if it's SSL_ERROR_WANT_READ
+          if (errno == EAGAIN) {
+            ENVOY_CONN_LOG(debug, "errno:{}:{}", callbacks_->connection(), errno,
+                           Envoy::errorDetails(errno));
+            break;
+          }
+          // fall through for other errors
         case SSL_ERROR_WANT_WRITE:
           // Renegotiation has started. We don't handle renegotiation so just fall through.
         default:
@@ -327,6 +335,15 @@ Network::IoResult SslSocket::doWrite(Buffer::Instance& write_buffer, bool end_st
       case SSL_ERROR_WANT_WRITE:
         bytes_to_retry_ = bytes_to_write;
         break;
+      case SSL_ERROR_SSL:
+        // If EAGAIN treat it as if it's SSL_ERROR_WANT_WRITE
+        if (errno == EAGAIN) {
+          ENVOY_CONN_LOG(debug, "errno:{}:{}", callbacks_->connection(), errno,
+                         Envoy::errorDetails(errno));
+          bytes_to_retry_ = bytes_to_write;
+          break;
+        }
+      // fall through for other errors
       case SSL_ERROR_WANT_READ:
       // Renegotiation has started. We don't handle renegotiation so just fall through.
       default: