Clarify that SSL_shutdown() must not be called after a fatal error