diff --git a/src/ssl_sock.c b/src/ssl_sock.c
index 42a4772..6dd0ce6 100644
--- a/src/ssl_sock.c
+++ b/src/ssl_sock.c
@@ -2679,16 +2679,11 @@
 		HA_RWLOCK_RDLOCK(SNI_LOCK, &s->sni_lock);
 		ssl_sock_switchctx_set(ssl, s->default_ctx);
 		HA_RWLOCK_RDUNLOCK(SNI_LOCK, &s->sni_lock);
+		goto allow_early;
 	}
-allow_early:
-#ifdef OPENSSL_IS_BORINGSSL
-	if (allow_early)
-		SSL_set_early_data_enabled(ssl, 1);
-#else
-	if (!allow_early)
-		SSL_set_max_early_data(ssl, 0);
-#endif
-	return 1;
+
+	/* other cases fallback on abort, if strict-sni is set but no node was found */
+
  abort:
 	/* abort handshake (was SSL_TLSEXT_ERR_ALERT_FATAL) */
 	conn->err_code = CO_ER_SSL_HANDSHAKE;
@@ -2698,6 +2693,16 @@
 	*al = SSL_AD_UNRECOGNIZED_NAME;
 	return 0;
 #endif
+
+allow_early:
+#ifdef OPENSSL_IS_BORINGSSL
+	if (allow_early)
+		SSL_set_early_data_enabled(ssl, 1);
+#else
+	if (!allow_early)
+		SSL_set_max_early_data(ssl, 0);
+#endif
+	return 1;
 }
 
 #else /* ! HAVE_SSL_CLIENT_HELLO_CB  */