diff --git a/include/libwebsockets/lws-secure-streams.h b/include/libwebsockets/lws-secure-streams.h
index c62ff5c8f..ff5748907 100644
--- a/include/libwebsockets/lws-secure-streams.h
+++ b/include/libwebsockets/lws-secure-streams.h
@@ -653,6 +653,17 @@ lws_ss_get_est_peer_tx_credit(struct lws_ss_handle *h);
 LWS_VISIBLE LWS_EXTERN const char *
 lws_ss_tag(struct lws_ss_handle *h);
 
+/**
+ * lws_ss_adopt_raw() - bind ss to existing fd
+ *
+ * \param ss: pointer to lws_ss_t to adopt the fd
+ * \param fd: the existing fd
+ *
+ * "connects" the existing ss to a wsi adoption of fd, it's useful for cases
+ * like local representation of eg a pipe() fd using ss.
+ */
+LWS_VISIBLE LWS_EXTERN int
+lws_ss_adopt_raw(struct lws_ss_handle *ss, lws_sock_file_fd_type fd);
 
 #if defined(LWS_WITH_SECURE_STREAMS_AUTH_SIGV4)
 /**
@@ -692,7 +703,6 @@ LWS_VISIBLE LWS_EXTERN int
 lws_aws_filesystem_credentials_helper(const char *path, const char *kid,
 				      const char *ak, char **aws_keyid,
 				      char **aws_key);
-
 #endif
 
 #if defined(STANDALONE)
diff --git a/lib/secure-streams/protocols/ss-h1.c b/lib/secure-streams/protocols/ss-h1.c
index ac760be67..471791b95 100644
--- a/lib/secure-streams/protocols/ss-h1.c
+++ b/lib/secure-streams/protocols/ss-h1.c
@@ -951,7 +951,10 @@ secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 					(unsigned int)(h->txn_resp_set ?
 						(h->txn_resp ? h->txn_resp : 200) :
 						HTTP_STATUS_NOT_FOUND),
-					NULL, h->wsi->http.writeable_len,
+					NULL,
+					h->policy->flags & LWSSSPOLF_HTTP_NO_CONTENT_LENGTH ?
+						LWS_ILLEGAL_HTTP_CONTENT_LEN :
+						h->wsi->http.writeable_len,
 					&p, end))
 				return 1;
 
diff --git a/lib/secure-streams/protocols/ss-raw.c b/lib/secure-streams/protocols/ss-raw.c
index 0bb11aa5c..94f6cfc9c 100644
--- a/lib/secure-streams/protocols/ss-raw.c
+++ b/lib/secure-streams/protocols/ss-raw.c
@@ -130,7 +130,6 @@ secstream_raw(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
                /* fallthru */
 
-	/* chunks of chunked content, with header removed */
 	case LWS_CALLBACK_RAW_RX:
 		if (!h || !h->info.rx)
 			return 0;
diff --git a/lib/secure-streams/secure-streams.c b/lib/secure-streams/secure-streams.c
index c452f9908..c7ad6e137 100644
--- a/lib/secure-streams/secure-streams.c
+++ b/lib/secure-streams/secure-streams.c
@@ -1006,6 +1006,65 @@ lws_ss_client_connect(lws_ss_handle_t *h)
 	return r;
 }
 
+int
+lws_ss_adopt_raw(struct lws_ss_handle *h, lws_sock_file_fd_type fd)
+{
+	const struct ss_pcols *ssp;
+	lws_ss_state_return_t r;
+        lws_adopt_desc_t desc;
+        struct lws *wsi;
+
+        if (!h->policy || !h->policy->protocol)
+		return 1;
+
+        ssp = ss_pcols[(int)h->policy->protocol];
+        if (!ssp)
+		return 1;
+
+	memset(&desc, 0, sizeof(desc));
+
+	desc.vh = lws_ss_get_vhost(h) ? lws_ss_get_vhost(h) :
+				lws_get_vhost_by_name(h->context, "_ss_default");
+	desc.vh_prot_name = ssp->protocol->name;
+	desc.type = LWS_ADOPT_RAW_FILE_DESC;
+	desc.fd = fd;
+	desc.opaque = h;
+
+	wsi = lws_adopt_descriptor_vhost_via_info(&desc);
+	if (!wsi) {
+		lwsl_ss_warn(h, "Failed to adopt pipe\n");
+		return 1;
+	}
+
+	lwsl_wsi_notice(wsi, "Adopted fd %d\n", fd.filefd);
+
+	h->wsi = wsi;
+	wsi->for_ss = 1;
+	h->txn_ok = 0;
+
+	r = lws_ss_event_helper(h, LWSSSCS_CONNECTING);
+	if (r)
+		goto bail;
+	r = lws_ss_event_helper(h, LWSSSCS_CONNECTED);
+	if (r)
+		goto bail;
+
+	if (lws_change_pollfd(wsi, 0, LWS_POLLIN))
+		lwsl_ss_warn(h, "Failed to set POLLIN\n");
+
+	return 0;
+
+bail:
+	r = lws_ss_event_helper(h, LWSSSCS_DISCONNECTED);
+	if (r)
+		goto bail;
+
+	lws_close_free_wsi(wsi, LWS_CLOSE_STATUS_NOSTATUS,
+					   "ss adopt skt fail");
+
+	return 1;
+}
+
 /*
  * Public API
  */