A TLS fatal alert shall always disconnect the session.

src/coap_tinydtls.c

@@ -112,7 +112,7 @@ dtls_event(struct dtls_context_t *dtls_context,
 
   if (event == COAP_EVENT_DTLS_CONNECTED)
     coap_session_connected(coap_session);
-  else if (event == DTLS_ALERT_CLOSE_NOTIFY)
+  else if (event == DTLS_ALERT_CLOSE_NOTIFY || COAP_EVENT_DTLS_ERROR)
     coap_session_disconnected(coap_session);
 
   return 0;

src/net.c

@@ -930,7 +930,7 @@ coap_handle_message_for_proto(coap_context_t *ctx, coap_session_t *session, coap
   if (session->proto == COAP_PROTO_DTLS) {
     if (session->type == COAP_SESSION_TYPE_HELLO)
       result = coap_dtls_hello(session, data, data_len);
-    else
+    else if (session->tls)
       result = coap_dtls_receive(session, data, data_len);
   } else if (session->proto == COAP_PROTO_UDP) {
     result = coap_handle_message(ctx, session, data, data_len);