RustPython
diff --git a/‎crates/stdlib/src/ssl.rs‎
Lines changed: 29 additions & 16 deletions b/‎crates/stdlib/src/ssl.rs‎
Lines changed: 29 additions & 16 deletions
diff --git a/‎crates/stdlib/src/ssl/compat.rs‎
Lines changed: 1 addition & 2 deletions b/‎crates/stdlib/src/ssl/compat.rs‎
Lines changed: 1 addition & 2 deletions
@@ -2724,16 +2724,12 @@ mod _ssl {
             recv_method.call((self.sock.clone(), vm.ctx.new_int(size)), vm)
         }
 
-        pub(crate) fn sock_send(
-            &self,
-            data: Vec<u8>,
-            vm: &VirtualMachine,
-        ) -> PyResult<PyObjectRef> {
+        pub(crate) fn sock_send(&self, data: &[u8], vm: &VirtualMachine) -> PyResult<PyObjectRef> {
             // In BIO mode, write to outgoing BIO
             if let Some(ref bio) = self.outgoing_bio {
                 let bio_obj: PyObjectRef = bio.clone().into();
                 let write_method = bio_obj.get_attr("write", vm)?;
-                return write_method.call((vm.ctx.new_bytes(data),), vm);
+                return write_method.call((vm.ctx.new_bytes(data.to_vec()),), vm);
             }
 
             // Normal socket mode
@@ -2742,7 +2738,7 @@ mod _ssl {
 
             // Call socket.socket.send(self.sock, data)
             let send_method = socket_class.get_attr("send", vm)?;
-            send_method.call((self.sock.clone(), vm.ctx.new_bytes(data)), vm)
+            send_method.call((self.sock.clone(), vm.ctx.new_bytes(data.to_vec())), vm)
         }
 
         /// Flush any pending TLS output data to the socket
@@ -2767,8 +2763,7 @@ mod _ssl {
                     );
                 }
 
-                let to_send = pending[sent_total..].to_vec();
-                match self.sock_send(to_send, vm) {
+                match self.sock_send(&pending[sent_total..], vm) {
                     Ok(result) => {
                         let sent: usize = result.try_to_value::<isize>(vm)?.try_into().unwrap_or(0);
                         if sent == 0 {
@@ -2826,8 +2821,7 @@ mod _ssl {
                     );
                 }
 
-                let to_send = buf[sent_total..].to_vec();
-                match self.sock_send(to_send, vm) {
+                match self.sock_send(&buf[sent_total..], vm) {
                     Ok(result) => {
                         let sent: usize = result.try_to_value::<isize>(vm)?.try_into().unwrap_or(0);
                         if sent == 0 {
@@ -2865,9 +2859,12 @@ mod _ssl {
             Ok(())
         }
 
-        /// Blocking flush of all pending TLS output data
-        /// Used during shutdown() to ensure all data is sent before closing
+        /// Flush all pending TLS output data, respecting socket timeout
+        /// Used during handshake completion and shutdown() to ensure all data is sent
         pub(crate) fn blocking_flush_all_pending(&self, vm: &VirtualMachine) -> PyResult<()> {
+            // Get socket timeout to respect during flush
+            let timeout = self.get_socket_timeout(vm)?;
+
             loop {
                 let pending_data = {
                     let pending = self.pending_tls_output.lock();
@@ -2877,21 +2874,30 @@ mod _ssl {
                     pending.clone()
                 };
 
-                // Wait for socket to be writable (blocking, no timeout)
+                // Wait for socket to be writable, respecting socket timeout
                 let py_socket: PyRef<PySocket> = self.sock.clone().try_into_value(vm)?;
                 let socket = py_socket
                     .sock()
                     .map_err(|e| vm.new_os_error(format!("Failed to get socket: {e}")))?;
-                let _ = sock_select(&socket, SelectKind::Write, None);
+                let timed_out = sock_select(&socket, SelectKind::Write, timeout)
+                    .map_err(|e| vm.new_os_error(format!("select failed: {e}")))?;
+
+                if timed_out {
+                    return Err(
+                        timeout_error_msg(vm, "The write operation timed out".to_string()).upcast(),
+                    );
+                }
 
                 // Try to send pending data
-                match self.sock_send(pending_data.clone(), vm) {
+                match self.sock_send(&pending_data, vm) {
                     Ok(result) => {
                         let sent: usize = result.try_to_value::<isize>(vm)?.try_into().unwrap_or(0);
                         if sent > 0 {
                             let mut pending = self.pending_tls_output.lock();
                             pending.drain(..sent);
                         }
+                        // If sent == 0, socket wasn't ready despite select() saying so
+                        // Continue loop to retry - this avoids infinite loops
                     }
                     Err(e) => {
                         if is_blocking_io_error(&e, vm) {
@@ -3555,6 +3561,13 @@ mod _ssl {
                 let is_bio = self.is_bio_mode();
                 let data: &[u8] = data_bytes.as_ref();
 
+                // CRITICAL: Flush any pending TLS data before writing new data
+                // This ensures TLS 1.3 Finished message reaches server before application data
+                // Without this, server may not be ready to process our data
+                if !is_bio {
+                    self.flush_pending_tls_output(vm)?;
+                }
+
                 // Write data in chunks to avoid filling the internal TLS buffer
                 // rustls has a limited internal buffer, so we need to flush periodically
                 const CHUNK_SIZE: usize = 16384; // 16KB chunks (typical TLS record size)
 
@@ -1021,8 +1021,7 @@ fn send_all_bytes(socket: &PySSLSocket, buf: Vec<u8>, vm: &VirtualMachine) -> Ss
 
     let mut sent_total = 0;
     while sent_total < buf.len() {
-        let to_send = buf[sent_total..].to_vec();
-        match socket.sock_send(to_send, vm) {
+        match socket.sock_send(&buf[sent_total..], vm) {
             Ok(result) => {
                 let sent: usize = result
                     .try_to_value::<isize>(vm)