diff --git a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
index f85c5f788ea9..8a047170acbb 100644
--- a/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
+++ b/jetty-io/src/main/java/org/eclipse/jetty/io/ssl/SslConnection.java
@@ -654,7 +654,6 @@ public int fill(ByteBuffer buffer) throws IOException
                             else
                             {
                                 appIn = _decryptedInput;
-                                BufferUtil.compact(_encryptedInput);
                             }
 
                             // Let's try reading some encrypted data... even if we have some already.
@@ -712,12 +711,18 @@ public int fill(ByteBuffer buffer) throws IOException
                                     return filled = -1;
 
                                 case BUFFER_UNDERFLOW:
+                                    // Continue if we can compact?
+                                    if (BufferUtil.compact(_encryptedInput))
+                                        continue;
+
+                                    // Are we out of space?
                                     if (BufferUtil.space(_encryptedInput) == 0)
                                     {
                                         BufferUtil.clear(_encryptedInput);
                                         throw new SSLHandshakeException("Encrypted buffer max length exceeded");
                                     }
 
+                                    // if we just filled some
                                     if (netFilled > 0)
                                         continue; // try filling some more