diff --git a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
index bd7c6d49de08..b1f3d322aebb 100644
--- a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
+++ b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
@@ -729,13 +729,15 @@ public int fill(ByteBuffer buffer) throws IOException
                                     return filled = -1;
 
                                 case BUFFER_UNDERFLOW:
-                                    if (netFilled > 0)
+                                    if (BufferUtil.space(_encryptedInput) == 0)
                                     {
-                                        if (BufferUtil.space(_encryptedInput) > 0)
-                                            continue; // try filling some more
                                         BufferUtil.clear(_encryptedInput);
                                         throw new SSLHandshakeException("Encrypted buffer max length exceeded");
                                     }
+
+                                    if (netFilled > 0)
+                                        continue; // try filling some more
+
                                     _underflown = true;
                                     if (netFilled < 0 && _sslEngine.getUseClientMode())
                                     {