diff --git a/daemon/crypto.c b/daemon/crypto.c
index 4d44546ec..8dc4f31f3 100644
--- a/daemon/crypto.c
+++ b/daemon/crypto.c
@@ -702,6 +702,9 @@ static int null_crypt_rtcp(struct crypto_context *c, struct rtcp_packet *r, str
 static void dump_key(struct crypto_context *c) {
 	char *k, *s;
 
+	if (!c->params.crypto_suite)
+		return;
+
 	k = g_base64_encode(c->params.master_key, c->params.crypto_suite->master_key_len);
 	s = g_base64_encode(c->params.master_salt, c->params.crypto_suite->master_salt_len);
 
diff --git a/daemon/dtls.c b/daemon/dtls.c
index 9e3bc27a2..63d8dd412 100644
--- a/daemon/dtls.c
+++ b/daemon/dtls.c
@@ -652,21 +652,29 @@ found:
 
 	ilog(LOG_INFO, "DTLS-SRTP successfully negotiated");
 
+	if (d->active) {
+		/* we're the client */
+		crypto_init(&ps->crypto, &client);
+		if (ps->selected_sfd)
+			crypto_init(&ps->selected_sfd->crypto, &server);
+	}
+	else {
+		/* we're the server */
+		crypto_init(&ps->crypto, &server);
+		if (ps->selected_sfd)
+			crypto_init(&ps->selected_sfd->crypto, &client);
+	}
+	// it's possible that ps->selected_sfd is not from ps->sfds list (?)
 	for (GList *l = ps->sfds.head; l; l = l->next) {
 		struct stream_fd *sfd = l->data;
-		if (d->active) {
-			/* we're the client */
-			crypto_init(&ps->crypto, &client);
+		if (d->active) /* we're the client */
 			crypto_init(&sfd->crypto, &server);
-		}
-		else {
-			/* we're the server */
-			crypto_init(&ps->crypto, &server);
+		else /* we're the server */
 			crypto_init(&sfd->crypto, &client);
-		}
 	}
 
-	crypto_dump_keys(&ps->crypto, &ps->selected_sfd->crypto);
+	if (ps->selected_sfd)
+		crypto_dump_keys(&ps->crypto, &ps->selected_sfd->crypto);
 
 	return 0;