diff --git a/src/agent/dtls_mbedtls.cpp b/src/agent/dtls_mbedtls.cpp
index c52cc180f3d..d4a1c740779 100644
--- a/src/agent/dtls_mbedtls.cpp
+++ b/src/agent/dtls_mbedtls.cpp
@@ -459,11 +459,14 @@ void MbedtlsServer::UpdateFdSet(fd_set &aReadFdSet, fd_set &aWriteFdSet, fd_set
         }
     }
 
-    FD_SET(mSocket, &aReadFdSet);
-
-    if (aMaxFd < mSocket)
+    if (mSocket >= 0)
     {
-        aMaxFd = mSocket;
+        FD_SET(mSocket, &aReadFdSet);
+
+        if (aMaxFd < mSocket)
+        {
+            aMaxFd = mSocket;
+        }
     }
 
     aTimeout.tv_sec = timeout / 1000;
@@ -486,13 +489,17 @@ void MbedtlsServer::ProcessServer(const fd_set &aReadFdSet, const fd_set &aWrite
 {
     uint8_t       packet[kMaxSizeOfPacket];
     uint8_t       control[kMaxSizeOfControl];
-    otbrError     error = OTBR_ERROR_ERRNO;
+    otbrError     error = OTBR_ERROR_ERRNO; // Assume error
     sockaddr_in6  src;
     sockaddr_in6  dst;
     struct msghdr msghdr;
     struct iovec  iov[1];
 
-    VerifyOrExit(FD_ISSET(mSocket, &aReadFdSet));
+    /* Connection is not alive yet, or is shut down */
+    VerifyOrExit(mSocket >= 0, error = OTBR_ERROR_NONE);
+
+    /* If this is not set, then some other handle became rd/wr able, it is not an error */
+    VerifyOrExit(FD_ISSET(mSocket, &aReadFdSet), error = OTBR_ERROR_NONE);
 
     otbrLog(OTBR_LOG_INFO, "Trying to accept connection...");
     memset(&src, 0, sizeof(src));
@@ -548,6 +555,7 @@ void MbedtlsServer::ProcessServer(const fd_set &aReadFdSet, const fd_set &aWrite
         otbrLog(OTBR_LOG_ERR, "DTLS failed to initiate new session: %s.", otbrErrorString(error));
         otbrLog(OTBR_LOG_INFO, "Trying to create new server socket...");
         close(mSocket);
+        mSocket = -1;
 
         if (Bind())
         {
diff --git a/src/agent/dtls_mbedtls.hpp b/src/agent/dtls_mbedtls.hpp
index f7a3660121e..0a1399cd82b 100644
--- a/src/agent/dtls_mbedtls.hpp
+++ b/src/agent/dtls_mbedtls.hpp
@@ -230,6 +230,7 @@ class MbedtlsServer : public Server
      *
      */
     MbedtlsServer(uint16_t aPort, StateHandler aStateHandler, void *aContext) :
+        mSocket(-1),
         mPort(aPort),
         mStateHandler(aStateHandler),
         mContext(aContext) {}
diff --git a/tests/meshcop/commissioner.cpp b/tests/meshcop/commissioner.cpp
index 36097eff178..717fd4b1e5d 100644
--- a/tests/meshcop/commissioner.cpp
+++ b/tests/meshcop/commissioner.cpp
@@ -640,6 +640,7 @@ int CommissionerServe(Context &aContext)
     VerifyOrExit(aContext.mSocket != -1, ret = errno);
     aContext.mDtlsServer = Dtls::Server::Create(kPortJoinerSession, HandleSessionChange, &aContext);
     aContext.mDtlsServer->SetPSK(kPSKd, strlen(reinterpret_cast<const char *>(kPSKd)));
+    aContext.mDtlsServer->Start();
 
     while (aContext.mState != kStateDone && aContext.mState != kStateError)
     {