diff --git a/lib/isc/netmgr/tlsstream.c b/lib/isc/netmgr/tlsstream.c
index adde8e069a..7ba09d8f45 100644
--- a/lib/isc/netmgr/tlsstream.c
+++ b/lib/isc/netmgr/tlsstream.c
@@ -671,6 +671,9 @@ isc_nm_listentls(isc_nm_t *mgr, uint32_t workers, isc_sockaddr_t *iface,
 	isc_nmsocket_t *tsock = NULL;
 
 	REQUIRE(VALID_NM(mgr));
+	if (atomic_load(&mgr->closing)) {
+		return (ISC_R_SHUTTINGDOWN);
+	}
 
 	tlssock = isc_mem_get(mgr->mctx, sizeof(*tlssock));
 
@@ -829,6 +832,10 @@ isc__nm_tls_resumeread(isc_nmhandle_t *handle) {
 	if (!atomic_compare_exchange_strong(&handle->sock->readpaused,
 					    &(bool){ false }, false))
 	{
+		if (inactive(handle->sock)) {
+			return;
+		}
+
 		async_tls_do_bio(handle->sock);
 	}
 }
@@ -926,6 +933,11 @@ isc_nm_tlsconnect(isc_nm_t *mgr, isc_sockaddr_t *local, isc_sockaddr_t *peer,
 
 	REQUIRE(VALID_NM(mgr));
 
+	if (atomic_load(&mgr->closing)) {
+		cb(NULL, ISC_R_SHUTTINGDOWN, cbarg);
+		return;
+	}
+
 	nsock = isc_mem_get(mgr->mctx, sizeof(*nsock));
 	isc__nmsocket_init(nsock, mgr, isc_nm_tlssocket, local);
 	nsock->result = ISC_R_UNSET;