diff --git a/lib/https.js b/lib/https.js
index b37211b2ac..141eff7791 100644
--- a/lib/https.js
+++ b/lib/https.js
@@ -7,6 +7,8 @@ function Server(opts, requestListener) {
   if (!(this instanceof Server)) return new Server(opts, requestListener);
   tls.Server.call(this, opts, http._connectionListener);
 
+  this.httpAllowHalfOpen = false;
+
   if (requestListener) {
     this.addListener('request', requestListener);
   }
diff --git a/lib/tls.js b/lib/tls.js
index afca4c63ca..4fc35a9d0f 100644
--- a/lib/tls.js
+++ b/lib/tls.js
@@ -269,6 +269,8 @@ CryptoStream.prototype._pull = function() {
   var havePending = this._pending.length > 0;
 
   while (this._pending.length > 0) {
+    if (!this.pair._ssl) break;
+
     var tmp = this._pending.shift();
     var cb = this._pendingCallbacks.shift();
 
diff --git a/src/node_crypto.cc b/src/node_crypto.cc
index 4abdc5dbbb..cf4ecd438a 100644
--- a/src/node_crypto.cc
+++ b/src/node_crypto.cc
@@ -651,7 +651,7 @@ Handle<Value> Connection::ClearIn(const Arguments& args) {
   size_t buffer_length = Buffer::Length(buffer_obj);
 
   size_t off = args[1]->Int32Value();
-  if (off >= buffer_length) {
+  if (off > buffer_length) {
     return ThrowException(Exception::Error(
           String::New("Offset is out of bounds")));
   }