diff --git a/src/internal.c b/src/internal.c
index 78d111e04..9da5d74f1 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -2473,6 +2473,11 @@ static int DoHandShakeMsgType(CYASSL* ssl, byte* input, word32* inOutIdx,
     }
 #endif
 
+    if (ssl->options.handShakeState == HANDSHAKE_DONE && type != hello_request){
+        CYASSL_MSG("HandShake message after handshake complete");
+        return OUT_OF_ORDER_E;
+    }
+
     switch (type) {
 
     case hello_request: