diff --git a/src/PAL/COM/sockets/ssl/MbedTLS/ssl_read_internal.cpp b/src/PAL/COM/sockets/ssl/MbedTLS/ssl_read_internal.cpp
index 8c62182537..e69de372a3 100644
--- a/src/PAL/COM/sockets/ssl/MbedTLS/ssl_read_internal.cpp
+++ b/src/PAL/COM/sockets/ssl/MbedTLS/ssl_read_internal.cpp
@@ -18,10 +18,24 @@ int ssl_read_internal(int sd, char *data, size_t size)
     }
 
     int ret = mbedtls_ssl_read(ssl, (unsigned char *)(data), size);
-    if (ret < 0)
+
+    if (ret == MBEDTLS_ERR_SSL_WANT_READ || ret == MBEDTLS_ERR_SSL_WANT_WRITE)
+    {
+        // Non-blocking socket has no data yet — tell caller to retry via select/poll
+        return SSL_RESULT__WOULD_BLOCK;
+    }
+
+    if (ret == MBEDTLS_ERR_SSL_PEER_CLOSE_NOTIFY || ret == 0)
     {
+        // Peer closed the connection — signal end-of-stream
         return 0;
     }
 
+    if (ret < 0)
+    {
+        // Any other error
+        return SOCK_SOCKET_ERROR;
+    }
+
     return ret;
 }