diff --git a/lib/chronoscope/nts/key_establishment_client.ex b/lib/chronoscope/nts/key_establishment_client.ex
index 1ab989e..8391e06 100644
--- a/lib/chronoscope/nts/key_establishment_client.ex
+++ b/lib/chronoscope/nts/key_establishment_client.ex
@@ -33,12 +33,16 @@ defmodule Chronoscope.NTS.KeyEstablishmentClient do
   end
 
   defp perform_key_establishment(socket) do
-    :ok = @ssl.send(socket, KeyEstablishmentRequest.create())
-    {:ok, peercert} = @ssl.peercert(socket)
-
-    peercert
-    |> await_response()
-    |> tap(fn _ -> @ssl.close(socket) end)
+    with :ok <- @ssl.send(socket, KeyEstablishmentRequest.create()),
+         {:ok, peercert} <- @ssl.peercert(socket) do
+      peercert
+      |> await_response()
+      |> tap(fn _ -> @ssl.close(socket) end)
+    else
+      e ->
+        @ssl.close(socket)
+        {:error, e}
+    end
   end
 
   defp await_response(peercert) do