Your sequence is weird. When the client sends the
ClientHello, then the server will respond with a
ServerHello, and then:
- either the client and server reuse an existing session, and do the "abbreviated handshake", in which case the server sends its
ChangeCipherSpec and then a
- or the client and server do not reuse an existing session, in which case the server must send its
Certificate message and a
ServerHelloDone, in which case the client will send a
ClientKeyExchange, then a
ChangeCipherSpec and a
See this answer for a description of the SSL handshakes.
In any case, if you observe a
Certificate message from the server, then this is not an abbreviated handshake, and there should be at least a
ServerHelloDone from the server, and a
ClientKeyExchange from the client. The logical conclusion would be that your network capture tool does not see all the traffic. Therefore, it may miss the "application data" records that you expect.