diff --git a/src/common/tortls.c b/src/common/tortls.c
index 2ab3771f3e..191a825196 100644
--- a/src/common/tortls.c
+++ b/src/common/tortls.c
@@ -436,8 +436,10 @@ tor_tls_new(int sock, int isServer, int use_no_cert)
 void
 tor_tls_free(tor_tls *tls)
 {
+  tor_assert(tls && tls->ssl);
   SSL_free(tls->ssl);
-  free(tls);
+  tls->ssl = NULL;
+  tor_free(tls);
 }
 
 /** Underlying function for TLS reading.  Reads up to <b>len</b>
diff --git a/src/or/connection.c b/src/or/connection.c
index c6a45eb308..c76cc45625 100644
--- a/src/or/connection.c
+++ b/src/or/connection.c
@@ -170,8 +170,10 @@ _connection_free(connection_t *conn) {
   if (connection_speaks_cells(conn)) {
     if (conn->state == OR_CONN_STATE_OPEN)
       directory_set_dirty();
-    if (conn->tls)
+    if (conn->tls) {
       tor_tls_free(conn->tls);
+      conn->tls = NULL;
+    }
   }
 
   if (conn->identity_pkey)
diff --git a/src/or/main.c b/src/or/main.c
index 24796df138..d440ba9a8f 100644
--- a/src/or/main.c
+++ b/src/or/main.c
@@ -1276,10 +1276,10 @@ void tor_cleanup(void) {
    * unlink, nothing we could do about it anyways. */
   if (options->PidFile && options->command == CMD_RUN_TOR)
     unlink(options->PidFile);
-  crypto_global_cleanup();
   if (accounting_is_enabled(options))
     accounting_record_bandwidth_usage(time(NULL));
   tor_free_all(); /* move tor_free_all back into the ifdef below later. XXX*/
+  crypto_global_cleanup();
 #ifdef USE_DMALLOC
   dmalloc_log_unfreed();
   dmalloc_shutdown();