diff --git a/src/shrpx_spdy_upstream.cc b/src/shrpx_spdy_upstream.cc
index ad602285..f41d636b 100644
--- a/src/shrpx_spdy_upstream.cc
+++ b/src/shrpx_spdy_upstream.cc
@@ -564,8 +564,10 @@ void spdy_downstream_eventcb(bufferevent *bev, short events, void *ptr)
         // RST_STREAM is sent after all pending data are sent.
         upstream->on_downstream_body_complete(downstream);
       } else if(downstream->get_response_state() == Downstream::MSG_COMPLETE) {
-        // For SSL tunneling?
-        upstream->rst_stream(downstream, SPDYLAY_INTERNAL_ERROR);
+        if(downstream->tunnel_established()) {
+          // For SSL tunneling
+          upstream->rst_stream(downstream, SPDYLAY_INTERNAL_ERROR);
+        }
       } else {
         // If stream was not closed, then we set MSG_COMPLETE and let
         // on_stream_close_callback delete downstream.