diff --git a/src/bt_peer_connection.cpp b/src/bt_peer_connection.cpp
index 886dc39f250..634d15b3a71 100644
--- a/src/bt_peer_connection.cpp
+++ b/src/bt_peer_connection.cpp
@@ -200,6 +200,12 @@ namespace {
 		if (is_ssl(get_socket()))
 			out_policy = settings_pack::pe_disabled;
 #endif
+#if TORRENT_USE_RTC
+		// never try an encrypted connection over WebRTC (which is already encrypted)
+		if (torrent_peer *pi = peer_info_struct())
+			if (pi->is_rtc_addr)
+				out_policy = settings_pack::pe_disabled;
+#endif
 #ifndef TORRENT_DISABLE_LOGGING
 		static char const* policy_name[] = {"forced", "enabled", "disabled"};
 		TORRENT_ASSERT(out_policy < sizeof(policy_name)/sizeof(policy_name[0]));