diff --git a/Data/Conduit/Network/TLS.hs b/Data/Conduit/Network/TLS.hs
--- a/Data/Conduit/Network/TLS.hs
+++ b/Data/Conduit/Network/TLS.hs
@@ -41,6 +41,8 @@
 #else
 import Crypto.Random (newGenIO, SystemRandom)
 #endif
+import Network.Socket (Socket)
+import qualified Data.ByteString as S
 
 tlsConfig :: HostPreference
           -> Int -- ^ port
@@ -79,7 +81,7 @@
                     { TLS.backendFlush = return ()
                     , TLS.backendClose = return ()
                     , TLS.backendSend = sendAll socket
-                    , TLS.backendRecv = recv socket
+                    , TLS.backendRecv = recvExact socket
                     }
                 params
                 (gen :: SystemRandom)
@@ -90,7 +92,7 @@
                 socket
                 (return ()) -- flush
                 (\bs -> yield bs $$ sinkSocket socket)
-                (recv socket)
+                (recvExact socket)
 #endif
 
             TLS.handshake ctx
@@ -154,3 +156,15 @@
     where parseKey (Right pems) = map (fmap (TLS.PrivRSA . snd) . KeyRSA.decodePrivate . L.fromChunks . (:[]) . PEM.pemContent)
                                 $ filter ((== "RSA PRIVATE KEY") . PEM.pemName) pems
           parseKey (Left err) = error $ "Cannot parse PEM file: " ++ err
+
+-- | TLS requires exactly the number of bytes requested to be returned.
+recvExact :: Socket -> Int -> IO S.ByteString
+recvExact socket =
+    loop id
+  where
+    loop front rest
+        | rest < 0 = error "Data.Conduit.Network.TLS.recvExact: rest < 0"
+        | rest == 0 = return $ S.concat $ front []
+        | otherwise = do
+            next <- recv socket rest
+            loop (front . (next:)) $ rest - S.length next
diff --git a/network-conduit-tls.cabal b/network-conduit-tls.cabal
--- a/network-conduit-tls.cabal
+++ b/network-conduit-tls.cabal
@@ -1,5 +1,5 @@
 name:                network-conduit-tls
-version:             1.0.0
+version:             1.0.0.1
 synopsis:            Create TLS-aware network code with conduits
 description:         Uses the tls package for a pure-Haskell implementation.
 homepage:            https://github.com/snoyberg/conduit