diff -urN ../exim-4.95.orig/src/macros.h ./src/macros.h
--- ../exim-4.95.orig/src/macros.h	2021-09-28 11:24:46.000000000 +0300
+++ ./src/macros.h	2022-03-19 09:41:15.355505000 +0200
@@ -1053,9 +1053,10 @@
 
 
 /* Options on tls_close */
-#define TLS_NO_SHUTDOWN		0
-#define TLS_SHUTDOWN_NOWAIT	1
-#define TLS_SHUTDOWN_WAIT	2
+#define TLS_NO_SHUTDOWN		0	/* Just forget the context */
+#define TLS_SHUTDOWN_NOWAIT	1	/* Send alert; do not wait */
+#define TLS_SHUTDOWN_WAIT	2	/* Send alert & wait for peer's alert */
+#define TLS_SHUTDOWN_WONLY	3	/* only wait for peer's alert */
 
 
 #ifdef COMPILE_UTILITY
diff -urN ../exim-4.95.orig/src/tls-gnu.c ./src/tls-gnu.c
--- ../exim-4.95.orig/src/tls-gnu.c	2022-03-19 09:40:38.638873000 +0200
+++ ./src/tls-gnu.c	2022-03-19 09:41:15.356617000 +0200
@@ -3726,17 +3726,21 @@
 if (do_shutdown)
   {
   DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
-    do_shutdown > 1 ? " (with response-wait)" : "");
+    do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
 
   tls_write(ct_ctx, NULL, 0, FALSE);	/* flush write buffer */
 
 #ifdef EXIM_TCP_CORK
-  if (do_shutdown > 1)
+  if (do_shutdown == TLS_SHUTDOWN_WAIT)
     (void) setsockopt(tlsp->active.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
 #endif
 
+  /* The library seems to have no way to only wait for a peer's
+  shutdown, so handle the same as TLS_SHUTDOWN_WAIT */
+
   ALARM(2);
-  gnutls_bye(state->session, do_shutdown > 1 ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
+  gnutls_bye(state->session,
+      do_shutdown > TLS_SHUTDOWN_NOWAIT ? GNUTLS_SHUT_RDWR : GNUTLS_SHUT_WR);
   ALARM_CLR(0);
   }
 
diff -urN ../exim-4.95.orig/src/tls-openssl.c ./src/tls-openssl.c
--- ../exim-4.95.orig/src/tls-openssl.c	2022-03-19 09:40:38.640312000 +0200
+++ ./src/tls-openssl.c	2022-03-19 09:41:15.357820000 +0200
@@ -4382,22 +4382,25 @@
 
 if (*fdp < 0) return;  /* TLS was not active */
 
-if (do_shutdown)
+if (do_shutdown > TLS_NO_SHUTDOWN)
   {
   int rc;
   DEBUG(D_tls) debug_printf("tls_close(): shutting down TLS%s\n",
-    do_shutdown > 1 ? " (with response-wait)" : "");
+    do_shutdown > TLS_SHUTDOWN_NOWAIT ? " (with response-wait)" : "");
 
   tls_write(ct_ctx, NULL, 0, FALSE);	/* flush write buffer */
 
-  if (  (rc = SSL_shutdown(*sslp)) == 0	/* send "close notify" alert */
-     && do_shutdown > 1)
+  if (  (  do_shutdown >= TLS_SHUTDOWN_WONLY
+	|| (rc = SSL_shutdown(*sslp)) == 0	/* send "close notify" alert */
+	)
+     && do_shutdown > TLS_SHUTDOWN_NOWAIT
+     )
     {
 #ifdef EXIM_TCP_CORK
     (void) setsockopt(*fdp, IPPROTO_TCP, EXIM_TCP_CORK, US &off, sizeof(off));
 #endif
     ALARM(2);
-    rc = SSL_shutdown(*sslp);		/* wait for response */
+    rc = SSL_shutdown(*sslp);			/* wait for response */
     ALARM_CLR(0);
     }
 
diff -urN ../exim-4.95.orig/src/transports/smtp.c ./src/transports/smtp.c
--- ../exim-4.95.orig/src/transports/smtp.c	2021-09-28 11:24:46.000000000 +0300
+++ ./src/transports/smtp.c	2022-03-19 09:41:15.359879000 +0200
@@ -4102,7 +4102,7 @@
       sx->send_quit = FALSE;	/* avoid sending it later */
 
 #ifndef DISABLE_TLS
-      if (sx->cctx.tls_ctx)	/* need to send TLS Close Notify */
+      if (sx->cctx.tls_ctx && sx->send_tlsclose)	/* need to send TLS Close Notify */
 	{
 # ifdef EXIM_TCP_CORK		/* Use _CORK to get Close Notify in FIN segment */
 	(void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
@@ -4445,7 +4445,8 @@
 # ifndef DISABLE_TLS
 	if (sx->cctx.tls_ctx)
 	  {
-	  tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WAIT);
+	  tls_close(sx->cctx.tls_ctx,
+		    sx->send_tlsclose ? TLS_SHUTDOWN_WAIT : TLS_SHUTDOWN_WONLY);
 	  sx->cctx.tls_ctx = NULL;
 	  }
 # endif
@@ -4656,7 +4657,8 @@
 	    a new EHLO. If we don't get a good response, we don't attempt to pass
 	    the socket on. */
 
-	  tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WAIT);
+	  tls_close(sx->cctx.tls_ctx,
+	    sx->send_tlsclose ? TLS_SHUTDOWN_WAIT : TLS_SHUTDOWN_WONLY);
 	  sx->send_tlsclose = FALSE;
 	  sx->cctx.tls_ctx = NULL;
 	  tls_out.active.sock = -1;
@@ -4758,7 +4760,7 @@
   {			/* Use _MORE to get QUIT in FIN segment */
   (void)smtp_write_command(sx, SCMD_MORE, "QUIT\r\n");
 #ifndef DISABLE_TLS
-  if (sx->cctx.tls_ctx)
+  if (sx->cctx.tls_ctx && sx->send_tlsclose)
     {
 # ifdef EXIM_TCP_CORK	/* Use _CORK to get TLS Close Notify in FIN segment */
     (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
@@ -4813,10 +4815,15 @@
     while (!sigalrm_seen && n > 0);
     ALARM_CLR(0);
 
+    if (sx->send_tlsclose)
+      {
 # ifdef EXIM_TCP_CORK
-    (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
+      (void) setsockopt(sx->cctx.sock, IPPROTO_TCP, EXIM_TCP_CORK, US &on, sizeof(on));
 # endif
-    tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WAIT);
+      tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WAIT);
+      }
+    else
+      tls_close(sx->cctx.tls_ctx, TLS_SHUTDOWN_WONLY);
     sx->cctx.tls_ctx = NULL;
     }
 #endif