diff --git a/src/capture_gnutls.c b/src/capture_gnutls.c
index 03606b6..21264fd 100644
--- a/src/capture_gnutls.c
+++ b/src/capture_gnutls.c
@@ -393,7 +393,8 @@ tls_process_record(struct SSLConnection *conn, const uint8_t *payload,
                 break;
             case change_cipher_spec:
                 // From now on, this connection will be encrypted using MasterSecret
-                conn->encrypted = 1;
+                if (conn->client_cipher_ctx.cipher && conn->server_cipher_ctx.cipher)
+                    conn->encrypted = 1;
                 break;
             case application_data:
                 if (conn->encrypted) {
diff --git a/src/capture_openssl.c b/src/capture_openssl.c
index 620880c..9ab3114 100644
--- a/src/capture_openssl.c
+++ b/src/capture_openssl.c
@@ -366,7 +366,8 @@ tls_process_record(struct SSLConnection *conn, const uint8_t *payload,
                 break;
             case change_cipher_spec:
                 // From now on, this connection will be encrypted using MasterSecret
-                conn->encrypted = 1;
+                if (conn->client_cipher_ctx.cipher && conn->server_cipher_ctx.cipher)
+                    conn->encrypted = 1;
                 break;
             case application_data:
                 if (conn->encrypted) {