diff --git a/dlls/winhttp/request.c b/dlls/winhttp/request.c
index 95ef89254d7..3449ce6b4e3 100644
--- a/dlls/winhttp/request.c
+++ b/dlls/winhttp/request.c
@@ -538,6 +538,7 @@ static BOOL query_headers( request_t *request, DWORD level, LPCWSTR name, LPVOID
         else
             headers = request->raw_headers;
 
+        if (!headers) return FALSE;
         len = strlenW( headers ) * sizeof(WCHAR);
         if (len + sizeof(WCHAR) > *buflen)
         {
diff --git a/dlls/winhttp/tests/winhttp.c b/dlls/winhttp/tests/winhttp.c
index 3fbb24c5263..eb0129ceb53 100644
--- a/dlls/winhttp/tests/winhttp.c
+++ b/dlls/winhttp/tests/winhttp.c
@@ -525,6 +525,54 @@ static void test_WinHttpAddHeaders(void)
 
 }
 
+static void test_secure_connection(void)
+{
+    static const WCHAR google[] = {'w','w','w','.','g','o','o','g','l','e','.','c','o','m',0};
+
+    HANDLE ses, con, req;
+    DWORD size;
+    BOOL ret;
+
+    ses = WinHttpOpen(test_useragent, 0, NULL, NULL, 0);
+    ok(ses != NULL, "failed to open session %u\n", GetLastError());
+
+    con = WinHttpConnect(ses, google, 443, 0);
+    ok(con != NULL, "failed to open a connection %u\n", GetLastError());
+
+    /* try without setting WINHTTP_FLAG_SECURE */
+    req = WinHttpOpenRequest(con, NULL, NULL, NULL, NULL, NULL, 0);
+    ok(req != NULL, "failed to open a request %u\n", GetLastError());
+
+    ret = WinHttpSendRequest(req, NULL, 0, NULL, 0, 0, 0);
+    ok(ret, "failed to send request %u\n", GetLastError());
+
+    ret = WinHttpReceiveResponse(req, NULL);
+    ok(!ret, "succeeded unexpectedly\n");
+
+    size = 0;
+    ret = WinHttpQueryHeaders(req, WINHTTP_QUERY_RAW_HEADERS_CRLF, NULL, NULL, &size, NULL);
+    ok(!ret, "succeeded unexpectedly\n");
+
+    WinHttpCloseHandle(req);
+
+    req = WinHttpOpenRequest(con, NULL, NULL, NULL, NULL, NULL, WINHTTP_FLAG_SECURE);
+    ok(req != NULL, "failed to open a request %u\n", GetLastError());
+
+    ret = WinHttpSendRequest(req, NULL, 0, NULL, 0, 0, 0);
+    ok(ret, "failed to send request %u\n", GetLastError());
+
+    ret = WinHttpReceiveResponse(req, NULL);
+    ok(ret, "failed to receive response %u\n", GetLastError());
+
+    size = 0;
+    ret = WinHttpQueryHeaders(req, WINHTTP_QUERY_RAW_HEADERS_CRLF, NULL, NULL, &size, NULL);
+    ok(!ret, "succeeded unexpectedly\n");
+
+    WinHttpCloseHandle(req);
+    WinHttpCloseHandle(con);
+    WinHttpCloseHandle(ses);
+}
+
 START_TEST (winhttp)
 {
     test_OpenRequest();
@@ -532,4 +580,5 @@ START_TEST (winhttp)
     test_WinHttpTimeFromSystemTime();
     test_WinHttpTimeToSystemTime();
     test_WinHttpAddHeaders();
+    test_secure_connection();
 }