diff --git a/src/libtls/tls_crypto.c b/src/libtls/tls_crypto.c
index 06fd9229f..f24713de1 100644
--- a/src/libtls/tls_crypto.c
+++ b/src/libtls/tls_crypto.c
@@ -1228,7 +1228,10 @@ METHOD(tls_crypto_t, get_cipher_suites, int,
 	{
 		build_cipher_suite_list(this);
 	}
-	*suites = this->suites;
+	if (suites)
+	{
+		*suites = this->suites;
+	}
 	return this->suite_count;
 }
 
@@ -1376,11 +1379,6 @@ METHOD(tls_crypto_t, select_cipher_suite, tls_cipher_suite_t,
 	suite_algs_t *algs;
 	int i, j;
 
-	if (!this->suites)
-	{
-		build_cipher_suite_list(this);
-	}
-
 	for (i = 0; i < this->suite_count; i++)
 	{
 		for (j = 0; j < count; j++)
diff --git a/src/libtls/tls_crypto.h b/src/libtls/tls_crypto.h
index b5dd4f930..958b7db29 100644
--- a/src/libtls/tls_crypto.h
+++ b/src/libtls/tls_crypto.h
@@ -436,7 +436,7 @@ struct tls_crypto_t {
 	/**
 	 * Get a list of supported TLS cipher suites.
 	 *
-	 * @param suites		list of suites, points to internal data
+	 * @param suites		optional list of suites, points to internal data
 	 * @return				number of suites returned
 	 */
 	int (*get_cipher_suites)(tls_crypto_t *this, tls_cipher_suite_t **suites);
diff --git a/src/libtls/tls_server.c b/src/libtls/tls_server.c
index 8675dc20e..990365ff1 100644
--- a/src/libtls/tls_server.c
+++ b/src/libtls/tls_server.c
@@ -235,6 +235,10 @@ static status_t process_client_hello(private_tls_server_t *this,
 		return NEED_MORE;
 	}
 
+	/* before we do anything version-related, determine our supported suites
+	 * as that might change the min./max. versions */
+	this->crypto->get_cipher_suites(this->crypto, NULL);
+
 	if (ext.len)
 	{
 		extensions = bio_reader_create(ext);