diff --git a/components/wpa_supplicant/src/eap_peer/eap_tls.c b/components/wpa_supplicant/src/eap_peer/eap_tls.c
index dcb604e51c..8db2e1f417 100644
--- a/components/wpa_supplicant/src/eap_peer/eap_tls.c
+++ b/components/wpa_supplicant/src/eap_peer/eap_tls.c
@@ -28,6 +28,7 @@ struct eap_tls_data {
 	void *ssl_ctx;
 	u8 eap_type;
 	struct wpabuf *pending_resp;
+	bool prot_success_received;
 };
 
 
@@ -249,9 +250,13 @@ static struct wpabuf * eap_tls_process(struct eap_sm *sm, void *priv,
 			   "EAP-TLS: ACKing protected success indication (appl data 0x00)");
 		eap_peer_tls_reset_output(&data->ssl);
 		res = 1;
+		ret->methodState = METHOD_DONE;
+		ret->decision = DECISION_UNCOND_SUCC;
+		data->prot_success_received = true;
 	}
 
-	if (tls_connection_established(data->ssl_ctx, data->ssl.conn))
+	if (tls_connection_established(data->ssl_ctx, data->ssl.conn) &&
+	    (!data->ssl.tls_v13 || data->prot_success_received))
 		eap_tls_success(sm, data, ret);
 
 	if (res == 1) {