diff --git a/qutebrowser/browser/network/networkmanager.py b/qutebrowser/browser/network/networkmanager.py
index 8e74f05c3..3b4c71ed0 100644
--- a/qutebrowser/browser/network/networkmanager.py
+++ b/qutebrowser/browser/network/networkmanager.py
@@ -195,10 +195,20 @@ class NetworkManager(QNetworkAccessManager):
             errors = [SslError(e) for e in errors]
             ssl_strict = config.get('network', 'ssl-strict')
             if ssl_strict == 'ask':
-                host_tpl = urlutils.host_tuple(reply.url())
-                if set(errors).issubset(self._accepted_ssl_errors[host_tpl]):
+                try:
+                    host_tpl = urlutils.host_tuple(reply.url())
+                except ValueError:
+                    host_tpl = None
+                    is_accepted = False
+                    is_rejected = False
+                else:
+                    is_accepted = set(errors).issubset(
+                        self._accepted_ssl_errors[host_tpl])
+                    is_rejected = set(errors).issubset(
+                        self._rejected_ssl_errors[host_tpl])
+                if is_accepted:
                     reply.ignoreSslErrors()
-                elif set(errors).issubset(self._rejected_ssl_errors[host_tpl]):
+                elif is_rejected:
                     pass
                 else:
                     err_string = '\n'.join('- ' + err.errorString() for err in
@@ -208,9 +218,11 @@ class NetworkManager(QNetworkAccessManager):
                         owner=reply)
                     if answer:
                         reply.ignoreSslErrors()
-                        self._accepted_ssl_errors[host_tpl] += errors
+                        d = self._accepted_ssl_errors
                     else:
-                        self._rejected_ssl_errors[host_tpl] += errors
+                        d = self._rejected_ssl_errors
+                    if host_tpl is not None:
+                        d[host_tpl] += errors
             elif ssl_strict:
                 pass
             else:
diff --git a/qutebrowser/utils/urlutils.py b/qutebrowser/utils/urlutils.py
index 9cda7c56e..5428ba921 100644
--- a/qutebrowser/utils/urlutils.py
+++ b/qutebrowser/utils/urlutils.py
@@ -350,11 +350,29 @@ def filename_from_url(url):
 
 
 def host_tuple(url):
-    """Get a (scheme, host, port) tuple.
+    """Get a (scheme, host, port) tuple from a QUrl.
 
     This is suitable to identify a connection, e.g. for SSL errors.
     """
-    return (url.scheme(), url.host(), url.port())
+    if not url.isValid():
+        raise ValueError(get_errstring(url))
+    scheme, host, port = url.scheme(), url.host(), url.port()
+    assert scheme
+    if not host:
+        raise ValueError("Got URL {} without host.".format(
+            url.toDisplayString()))
+    if port == -1:
+        port_mapping = {
+            'http': 80,
+            'https': 443,
+            'ftp': 21,
+        }
+        try:
+            port = port_mapping[scheme]
+        except KeyError:
+            raise ValueError("Got URL {} with unknown port.".format(
+                url.toDisplayString()))
+    return scheme, host, port
 
 
 def get_errstring(url, base="Invalid URL"):