Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I met a strange issue that the TLS connection is always torn down by Chrome after received server ChangeCipherSpec. The sequence is as following:

  Client                     Server
                          <--SYN, ACK
                          <--ServerHello, Certificate

Why FIN is sent instead of Application Data?

share|improve this question

Your sequence is weird. When the client sends the ClientHello, then the server will respond with a ServerHello, and then:

  • either the client and server reuse an existing session, and do the "abbreviated handshake", in which case the server sends its ChangeCipherSpec and then a Finished message;
  • or the client and server do not reuse an existing session, in which case the server must send its Certificate message and a ServerHelloDone, in which case the client will send a ClientKeyExchange, then a ChangeCipherSpec and a Finished message.

See this answer for a description of the SSL handshakes.

In any case, if you observe a Certificate message from the server, then this is not an abbreviated handshake, and there should be at least a ServerHelloDone from the server, and a ClientKeyExchange from the client. The logical conclusion would be that your network capture tool does not see all the traffic. Therefore, it may miss the "application data" records that you expect.

share|improve this answer
I searched the material in the network, and it seems the sequence follows the TLS False Start used by Chrome except the FIN after the ChangeCipherSpec from server – jacky Aug 16 '13 at 14:57

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.