diff --git a/library/ssl_client.c b/library/ssl_client.c
index 73a854d..2ed6ce6 100644
--- a/library/ssl_client.c
+++ b/library/ssl_client.c
@@ -720,6 +720,30 @@
     int ret;
     size_t session_id_len;
 
+#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
+    defined(MBEDTLS_SSL_SESSION_TICKETS) && \
+    defined(MBEDTLS_HAVE_TIME)
+    /* Check if a tls13 ticket has been configured. */
+    if( ssl->session_negotiate->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
+        ssl->handshake->resume != 0 &&
+        ssl->session_negotiate != NULL &&
+        ssl->session_negotiate->ticket != NULL )
+    {
+        mbedtls_time_t now = mbedtls_time( NULL );
+        if( ssl->session_negotiate->ticket_received > now ||
+            (uint64_t)( now - ssl->session_negotiate->ticket_received )
+                    > ssl->session_negotiate->ticket_lifetime )
+        {
+            /* Without valid ticket, disable session resumption.*/
+            MBEDTLS_SSL_DEBUG_MSG(
+                3, ( "Ticket expired, disable session resumption" ) );
+            ssl->handshake->resume = 0;
+        }
+    }
+#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
+          MBEDTLS_SSL_SESSION_TICKETS &&
+          MBEDTLS_HAVE_TIME */
+
     if( ssl->conf->f_rng == NULL )
     {
         MBEDTLS_SSL_DEBUG_MSG( 1, ( "no RNG provided" ) );
@@ -843,33 +867,6 @@
         }
     }
 
-#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && \
-    defined(MBEDTLS_SSL_SESSION_TICKETS) && \
-    defined(MBEDTLS_HAVE_TIME)
-    /* Check if a tls13 ticket has been configured. */
-    if( ssl->session_negotiate->tls_version == MBEDTLS_SSL_VERSION_TLS1_3 &&
-        ssl->handshake->resume != 0 &&
-        ssl->session_negotiate != NULL &&
-        ssl->session_negotiate->ticket != NULL )
-    {
-        mbedtls_time_t now = mbedtls_time( NULL );
-        if( ssl->session_negotiate->ticket_received > now ||
-            (uint64_t)( now - ssl->session_negotiate->ticket_received )
-                    > ssl->session_negotiate->ticket_lifetime )
-        {
-            MBEDTLS_SSL_DEBUG_MSG( 3, ( "ticket expired" ) );
-            mbedtls_platform_zeroize( ssl->session_negotiate->ticket,
-                                      ssl->session_negotiate->ticket_len );
-            mbedtls_free( ssl->session_negotiate->ticket );
-            ssl->session_negotiate->ticket = NULL;
-            ssl->session_negotiate->ticket_len = 0;
-        }
-
-    }
-#endif /* MBEDTLS_SSL_PROTO_TLS1_3 &&
-          MBEDTLS_SSL_SESSION_TICKETS &&
-          MBEDTLS_HAVE_TIME */
-
     return( 0 );
 }
 
diff --git a/library/ssl_tls13_client.c b/library/ssl_tls13_client.c
index ee4c24d..6227f3d 100644
--- a/library/ssl_tls13_client.c
+++ b/library/ssl_tls13_client.c
@@ -681,7 +681,8 @@
 static int ssl_tls13_has_configured_ticket( mbedtls_ssl_context *ssl )
 {
     mbedtls_ssl_session *session = ssl->session_negotiate;
-    return( session != NULL && session->ticket != NULL );
+    return( ssl->handshake->resume &&
+            session != NULL && session->ticket != NULL );
 }
 
 MBEDTLS_CHECK_RETURN_CRITICAL