RustPython
diff --git a/‎crates/stdlib/src/ssl.rs‎
Lines changed: 24 additions & 5 deletions b/‎crates/stdlib/src/ssl.rs‎
Lines changed: 24 additions & 5 deletions
diff --git a/‎crates/stdlib/src/ssl/compat.rs‎
Lines changed: 10 additions & 0 deletions b/‎crates/stdlib/src/ssl/compat.rs‎
Lines changed: 10 additions & 0 deletions
@@ -2747,7 +2747,7 @@ mod _ssl {
 
         /// Flush any pending TLS output data to the socket
         /// This should be called before generating new TLS output
-        fn flush_pending_tls_output(&self, vm: &VirtualMachine) -> PyResult<()> {
+        pub(crate) fn flush_pending_tls_output(&self, vm: &VirtualMachine) -> PyResult<()> {
             let mut pending = self.pending_tls_output.lock();
             if pending.is_empty() {
                 return Ok(());
@@ -3919,7 +3919,8 @@ mod _ssl {
             if current_state == ShutdownState::NotStarted {
                 // First, flush any pending TLS data BEFORE sending close_notify
                 // This ensures all application data is sent before the shutdown alert
-                self.flush_pending_tls_output(vm)?;
+                // Ignore errors - pending data will be sent with close_notify
+                let _ = self.flush_pending_tls_output(vm);
 
                 conn.send_close_notify();
 
@@ -3973,7 +3974,7 @@ mod _ssl {
                     if self.try_read_close_notify(conn, vm)? {
                         peer_closed = true;
                     }
-                } else if let Some(_timeout) = timeout_mode {
+                } else if let Some(timeout) = timeout_mode {
                     // All socket modes (blocking, timeout, non-blocking):
                     // Return immediately after sending our close_notify.
                     //
@@ -3989,7 +3990,24 @@ mod _ssl {
                     // This prevents data loss when rustls drains its buffer
                     // but the socket couldn't accept all data immediately
                     drop(conn_guard);
-                    self.blocking_flush_all_pending(vm)?;
+
+                    // Respect socket timeout settings for flushing pending TLS data
+                    match timeout {
+                        Some(0.0) => {
+                            // Non-blocking: best-effort flush, ignore errors
+                            // to avoid deadlock with asyncore-based servers
+                            let _ = self.flush_pending_tls_output(vm);
+                        }
+                        Some(_t) => {
+                            // Timeout mode: use flush with socket's timeout
+                            // Errors (including timeout) are propagated to caller
+                            self.flush_pending_tls_output(vm)?;
+                        }
+                        None => {
+                            // Blocking mode: wait until all pending data is sent
+                            self.blocking_flush_all_pending(vm)?;
+                        }
+                    }
 
                     *self.shutdown_state.lock() = ShutdownState::Completed;
                     *self.connection.lock() = None;
@@ -4022,7 +4040,8 @@ mod _ssl {
         // Helper: Write all pending TLS data (including close_notify) to outgoing buffer/BIO
         fn write_pending_tls(&self, conn: &mut TlsConnection, vm: &VirtualMachine) -> PyResult<()> {
             // First, flush any previously pending TLS output
-            self.flush_pending_tls_output(vm)?;
+            // Ignore errors - they will be retried with the new data
+            let _ = self.flush_pending_tls_output(vm);
 
             loop {
                 if !conn.wants_write() {
 
@@ -1011,6 +1011,10 @@ pub(super) fn is_blocking_io_error(err: &Py<PyBaseException>, vm: &VirtualMachin
 /// until all data is sent. For non-blocking sockets, returns WantWrite
 /// if no progress can be made.
 fn send_all_bytes(socket: &PySSLSocket, buf: Vec<u8>, vm: &VirtualMachine) -> SslResult<()> {
+    // First, flush any previously pending TLS data
+    // Ignore errors - they will be saved in pending buffer and retried
+    let _ = socket.flush_pending_tls_output(vm);
+
     if buf.is_empty() {
         return Ok(());
     }
@@ -1070,6 +1074,10 @@ fn handshake_write_loop(
 ) -> SslResult<bool> {
     let mut made_progress = false;
 
+    // Flush any previously pending TLS data before generating new output
+    // Ignore errors - they will be saved in pending buffer and retried
+    let _ = socket.flush_pending_tls_output(vm);
+
     while conn.wants_write() || force_initial_write {
         if force_initial_write && !conn.wants_write() {
             // No data to write on first iteration - break to avoid infinite loop
@@ -1297,6 +1305,8 @@ pub(super) fn ssl_do_handshake(
             // Send close_notify on error
             if !is_bio {
                 conn.send_close_notify();
+                // Flush any pending TLS data before sending close_notify
+                let _ = socket.flush_pending_tls_output(vm);
                 // Actually send the close_notify alert
                 if let Ok(alert_data) = ssl_write_tls_records(conn)
                     && !alert_data.is_empty()