diff --git a/src/ssl_sample.c b/src/ssl_sample.c
index 5509e1f22..d6315267f 100644
--- a/src/ssl_sample.c
+++ b/src/ssl_sample.c
@@ -1342,11 +1342,14 @@ smp_fetch_ssl_c_ca_err(const struct arg *args, struct sample *smp, const char *k
 		return 0;
 	ctx = conn->xprt_ctx;
 
-	if (conn->flags & CO_FL_WAIT_XPRT) {
+	if (conn->flags & CO_FL_WAIT_XPRT && !conn->err_code) {
 		smp->flags = SMP_F_MAY_CHANGE;
 		return 0;
 	}
 
+	if (!ctx)
+		return 0;
+
 	smp->data.type = SMP_T_SINT;
 	smp->data.u.sint = (unsigned long long int)SSL_SOCK_ST_TO_CA_ERROR(ctx->xprt_st);
 	smp->flags = SMP_F_VOL_SESS;
@@ -1365,12 +1368,15 @@ smp_fetch_ssl_c_ca_err_depth(const struct arg *args, struct sample *smp, const c
 	if (!conn || conn->xprt != &ssl_sock)
 		return 0;
 
-	if (conn->flags & CO_FL_WAIT_XPRT) {
+	if (conn->flags & CO_FL_WAIT_XPRT && !conn->err_code) {
 		smp->flags = SMP_F_MAY_CHANGE;
 		return 0;
 	}
 	ctx = conn->xprt_ctx;
 
+	if (!ctx)
+		return 0;
+
 	smp->data.type = SMP_T_SINT;
 	smp->data.u.sint = (long long int)SSL_SOCK_ST_TO_CAEDEPTH(ctx->xprt_st);
 	smp->flags = SMP_F_VOL_SESS;
@@ -1389,13 +1395,16 @@ smp_fetch_ssl_c_err(const struct arg *args, struct sample *smp, const char *kw,
 	if (!conn || conn->xprt != &ssl_sock)
 		return 0;
 
-	if (conn->flags & CO_FL_WAIT_XPRT) {
+	if (conn->flags & CO_FL_WAIT_XPRT && !conn->err_code) {
 		smp->flags = SMP_F_MAY_CHANGE;
 		return 0;
 	}
 
 	ctx = conn->xprt_ctx;
 
+	if (!ctx)
+		return 0;
+
 	smp->data.type = SMP_T_SINT;
 	smp->data.u.sint = (long long int)SSL_SOCK_ST_TO_CRTERROR(ctx->xprt_st);
 	smp->flags = SMP_F_VOL_SESS;