diff --git a/ChangeLog b/ChangeLog
index 6c5e1d0..49cc8c8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -2,6 +2,8 @@
 
 	* Possible fix for IE problems with horizontal positioning of
 	cursor if the line ends in spaces.
+
+	* Work-around for an IE6 bug when doing HTTPS through proxies.
 	
 2009-03-21  Markus Gutschke  <markus@shellinabox.com>
 
diff --git a/config.h b/config.h
index 13f6b67..18db9e2 100644
--- a/config.h
+++ b/config.h
@@ -95,7 +95,7 @@
 #define STDC_HEADERS 1
 
 /* Most recent revision number in the version control system */
-#define VCS_REVISION "85"
+#define VCS_REVISION "86"
 
 /* Version number of package */
 #define VERSION "2.5"
diff --git a/configure b/configure
index 82f2dc7..df5de11 100755
--- a/configure
+++ b/configure
@@ -2055,7 +2055,7 @@ ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $
 ac_compiler_gnu=$ac_cv_c_compiler_gnu
 
 
-VCS_REVISION=85
+VCS_REVISION=86
 
 
 cat >>confdefs.h <<_ACEOF
diff --git a/configure.ac b/configure.ac
index 756b0c2..e3f14ef 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@ AC_PREREQ(2.57)
 
 dnl This is the one location where the authoritative version number is stored
 AC_INIT(shellinabox, 2.5, markus@shellinabox.com)
-VCS_REVISION=85
+VCS_REVISION=86
 AC_SUBST(VCS_REVISION)
 AC_DEFINE_UNQUOTED(VCS_REVISION, "${VCS_REVISION}",
                    [Most recent revision number in the version control system])
diff --git a/libhttp/httpconnection.c b/libhttp/httpconnection.c
index af1ee03..4ff5aa0 100644
--- a/libhttp/httpconnection.c
+++ b/libhttp/httpconnection.c
@@ -183,7 +183,6 @@ static int httpShutdown(struct HttpConnection *http, int how) {
       }
       sslFreeHndl(&http->sslHndl);
     }
-    return rc;
   }
   return shutdown(http->fd, how);
 }
@@ -449,6 +448,18 @@ void httpTransfer(struct HttpConnection *http, char *msg, int len) {
     http->msgLength        = len;
   }
 
+  // Internet Explorer prior to version 7 has a bug when send XMLHttpRequests
+  // over HTTPS that go through a proxy. It won't see the reply until we
+  // close the connection.
+  int ieBug                = 0;
+  if (http->sslHndl) {
+    const char *userAgent  = getFromHashMap(&http->header, "user-agent");
+    const char *msie       = userAgent ? strstr(userAgent, "MSIE ") : NULL;
+    if (msie && msie[5] >= '4' && msie[5] <= '6') {
+      ieBug++;
+    }
+  }
+
   // The caller can suspend the connection, so that it can send an
   // asynchronous reply. Once the reply has been sent, the connection
   // gets reactivated. Normally, this means it would go back to listening
@@ -494,6 +505,10 @@ void httpTransfer(struct HttpConnection *http, char *msg, int len) {
       }
     }
   }
+
+  if (ieBug) {
+    httpCloseRead(http);
+  }
 }
 
 void httpTransferPartialReply(struct HttpConnection *http, char *msg, int len){