--- /sys/src/libsec/port/tlshand.c
+++ /sys/src/libsec/port/tlshand.c
@@ -1406,7 +1406,7 @@ setVersion(TlsConnection *c, int version)
 	switch(version) {
 	case SSL3Version:
 		c->finished.n = SSL3FinishedLen;
-		break;
+		return -1;
 	case TLS10Version:
 	case TLS11Version:
 	case TLS12Version: