There were a few problems here 1. Raw gnutls error codes were being printed in debug messages. This isn't necessarily bad, but it's much less useful than the text returned from gnutls_strerror(). Never underestimate the value of good error handling. 2. ssl_gnutls_read() and ssl_gnutls_write() were returning 0 when there was an error reading from or writing to the ssl connection. They should return -1 to indicate failure (0 normally indicates that the server closed the connection) 3. ssl_gnutls_read() and ssl_gnutls_write() weren't setting errno when they failed. errno would be set to something random, which seemed to frequently be EAGAIN for me when reading, which causes Gaim to keep trying to read from the connection even though it's closed. Ideally ssl-gnutls.c would have a function equivalent to set_errno() in ssl-nss.c, but the gnutls documentation does a poor job of telling you what possible error codes could be returned from gnutls_record_recv() and gnutls_record_send() Even better would be if we allowed the ssl plugins to keep track of the error message themselves, then added a new ssl ops function to fetch the message from the plugin.