diff --git a/session.go b/session.go
index 7ea1c3979..6c10e0144 100644
--- a/session.go
+++ b/session.go
@@ -6,6 +6,7 @@ import (
 	"crypto/tls"
 	"errors"
 	"fmt"
+	"io"
 	"net"
 	"sync"
 	"time"
@@ -603,6 +604,9 @@ runLoop:
 	}
 	s.logger.Infof("Connection %s closed.", s.srcConnID)
 	s.sessionRunner.removeConnectionID(s.srcConnID)
+	if s.version.UsesTLS() {
+		s.cryptoStreamHandler.(io.Closer).Close()
+	}
 	return closeErr.err
 }
 
diff --git a/session_test.go b/session_test.go
index 132c673d5..682924fe9 100644
--- a/session_test.go
+++ b/session_test.go
@@ -1638,6 +1638,7 @@ var _ = Describe("Client Session", func() {
 		})
 		Expect(err).ToNot(HaveOccurred())
 		// make sure the go routine returns
+		sess.version = protocol.Version39
 		packer.EXPECT().PackConnectionClose(gomock.Any()).Return(&packedPacket{}, nil)
 		sessionRunner.EXPECT().removeConnectionID(gomock.Any())
 		Expect(sess.Close()).To(Succeed())