diff --git a/recording-daemon/metafile.c b/recording-daemon/metafile.c
index 4ada3b796..ff2058bca 100644
--- a/recording-daemon/metafile.c
+++ b/recording-daemon/metafile.c
@@ -47,6 +47,11 @@ static void meta_free(void *ptr) {
 }
 
 
+static void meta_close_ssrcs(gpointer key, gpointer value, gpointer user_data) {
+	ssrc_t *s = value;
+	ssrc_close(s);
+}
+
 // mf is locked
 static void meta_destroy(metafile_t *mf) {
 	// close all streams
@@ -64,6 +69,8 @@ static void meta_destroy(metafile_t *mf) {
 		close(mf->forward_fd);
 		mf->forward_fd = -1;
 	}
+	// shut down SSRCs, which closes TLS connections
+	g_hash_table_foreach(mf->ssrc_hash, meta_close_ssrcs, NULL);
 	db_close_call(mf);
 }
 
diff --git a/recording-daemon/packet.c b/recording-daemon/packet.c
index 83c4b641c..97cc48b7b 100644
--- a/recording-daemon/packet.c
+++ b/recording-daemon/packet.c
@@ -84,6 +84,8 @@ static void packet_free(void *p) {
 
 
 static void ssrc_tls_shutdown(ssrc_t *ssrc) {
+	if (!ssrc->tls_fwd_stream)
+		return;
 	streambuf_destroy(ssrc->tls_fwd_stream);
 	ssrc->tls_fwd_stream = NULL;
 	resample_shutdown(&ssrc->tls_fwd_resampler);
@@ -142,14 +144,20 @@ void ssrc_tls_state(ssrc_t *ssrc) {
 }
 
 
+void ssrc_close(ssrc_t *s) {
+	output_close(s->metafile, s->output);
+	s->output = NULL;
+	for (int i = 0; i < G_N_ELEMENTS(s->decoders); i++) {
+		decoder_free(s->decoders[i]);
+		s->decoders[i] = NULL;
+	}
+	ssrc_tls_shutdown(s);
+}
+
 void ssrc_free(void *p) {
 	ssrc_t *s = p;
 	packet_sequencer_destroy(&s->sequencer);
-	output_close(s->metafile, s->output);
-	for (int i = 0; i < G_N_ELEMENTS(s->decoders); i++)
-		decoder_free(s->decoders[i]);
-	if (s->tls_fwd_stream)
-		ssrc_tls_shutdown(s);
+	ssrc_close(s);
 	g_slice_free1(sizeof(*s), s);
 }
 
diff --git a/recording-daemon/packet.h b/recording-daemon/packet.h
index 31b0c1640..e6c2e9362 100644
--- a/recording-daemon/packet.h
+++ b/recording-daemon/packet.h
@@ -3,6 +3,7 @@
 
 #include "types.h"
 
+void ssrc_close(ssrc_t *s);
 void ssrc_free(void *p);
 
 void packet_process(stream_t *, unsigned char *, unsigned len);