RustPython
diff --git a/‎crates/stdlib/src/ssl.rs‎
Lines changed: 1 addition & 1 deletion b/‎crates/stdlib/src/ssl.rs‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎crates/stdlib/src/ssl/compat.rs‎
Lines changed: 40 additions & 3 deletions b/‎crates/stdlib/src/ssl/compat.rs‎
Lines changed: 40 additions & 3 deletions
@@ -2867,7 +2867,7 @@ mod _ssl {
 
         /// Blocking flush of all pending TLS output data
         /// Used during shutdown() to ensure all data is sent before closing
-        fn blocking_flush_all_pending(&self, vm: &VirtualMachine) -> PyResult<()> {
+        pub(crate) fn blocking_flush_all_pending(&self, vm: &VirtualMachine) -> PyResult<()> {
             loop {
                 let pending_data = {
                     let pending = self.pending_tls_output.lock();
 
@@ -1233,6 +1233,15 @@ fn handle_handshake_complete(
         }
     }
 
+    // CRITICAL: Ensure all pending TLS data is sent before returning
+    // TLS 1.3 Finished must reach server before handshake is considered complete
+    // Without this, server may not process application data
+    if !socket.is_bio_mode() {
+        socket
+            .blocking_flush_all_pending(vm)
+            .map_err(SslError::Py)?;
+    }
+
     Ok(true)
 }
 
@@ -1307,11 +1316,12 @@ pub(super) fn ssl_do_handshake(
                 conn.send_close_notify();
                 // Flush any pending TLS data before sending close_notify
                 let _ = socket.flush_pending_tls_output(vm);
-                // Actually send the close_notify alert
+                // Actually send the close_notify alert using send_all_bytes
+                // for proper partial send handling and retry logic
                 if let Ok(alert_data) = ssl_write_tls_records(conn)
                     && !alert_data.is_empty()
                 {
-                    let _ = socket.sock_send(alert_data, vm);
+                    let _ = send_all_bytes(socket, alert_data, vm);
                 }
             }
 
@@ -1477,11 +1487,38 @@ pub(super) fn ssl_read(
             // Check if connection needs to write data first (e.g., TLS key update, renegotiation)
             // This mirrors the handshake logic which checks both wants_read() and wants_write()
             if conn.wants_write() && !is_bio {
+                // Check deadline BEFORE attempting flush
+                if let Some(deadline) = deadline
+                    && std::time::Instant::now() >= deadline
+                {
+                    return Err(SslError::Timeout(
+                        "The read operation timed out".to_string(),
+                    ));
+                }
+
                 // Flush pending TLS data before continuing
                 let tls_data = ssl_write_tls_records(conn)?;
                 if !tls_data.is_empty() {
-                    send_all_bytes(socket, tls_data, vm)?;
+                    // Use best-effort send - don't fail READ just because WRITE couldn't complete
+                    match send_all_bytes(socket, tls_data, vm) {
+                        Ok(()) => {}
+                        Err(SslError::WantWrite) => {
+                            // Socket buffer full - acceptable during READ operation
+                            // Pending data will be sent on next write/read call
+                        }
+                        Err(e) => return Err(e),
+                    }
                 }
+
+                // Check deadline AFTER flush attempt
+                if let Some(deadline) = deadline
+                    && std::time::Instant::now() >= deadline
+                {
+                    return Err(SslError::Timeout(
+                        "The read operation timed out".to_string(),
+                    ));
+                }
+
                 // After flushing, rustls may want to read again - continue loop
                 continue;
             }