diff --git a/library/ssl_srv.c b/library/ssl_srv.c
index c884e7c..6d8626c 100644
--- a/library/ssl_srv.c
+++ b/library/ssl_srv.c
@@ -1721,6 +1721,8 @@
                                             size_t *olen )
 {
     unsigned char *p = buf;
+    const ssl_ciphersuite_t *suite = NULL;
+    const cipher_info_t *cipher = NULL;
 
     if( ssl->session_negotiate->encrypt_then_mac == SSL_EXTENDED_MS_DISABLED ||
         ssl->minor_ver == SSL_MINOR_VERSION_0 )
@@ -1729,6 +1731,21 @@
         return;
     }
 
+    /*
+     * RFC 7366: "If a server receives an encrypt-then-MAC request extension
+     * from a client and then selects a stream or Authenticated Encryption
+     * with Associated Data (AEAD) ciphersuite, it MUST NOT send an
+     * encrypt-then-MAC response extension back to the client."
+     */
+    if( ( suite = ssl_ciphersuite_from_id(
+                    ssl->session_negotiate->ciphersuite ) ) == NULL ||
+        ( cipher = cipher_info_from_type( suite->cipher ) ) == NULL ||
+        cipher->mode != POLARSSL_MODE_CBC )
+    {
+        *olen = 0;
+        return;
+    }
+
     SSL_DEBUG_MSG( 3, ( "server hello, adding encrypt then mac extension" ) );
 
     *p++ = (unsigned char)( ( TLS_EXT_ENCRYPT_THEN_MAC >> 8 ) & 0xFF );