TLS: always send CCS immediately before FINISHED message

Author: peterdettman

crypto/src/crypto/tls/TlsClientProtocol.cs

@@ -145,6 +145,7 @@ protected override void HandleHandshakeMessage(byte type, MemoryStream buf)
                 ProcessFinishedMessage(buf);
                 this.mConnectionState = CS_SERVER_FINISHED;
 
+                SendChangeCipherSpecMessage();
                 SendFinishedMessage();
                 this.mConnectionState = CS_CLIENT_FINISHED;
 
@@ -266,8 +267,6 @@ protected override void HandleHandshakeMessage(byte type, MemoryStream buf)
                     {
                         this.mSecurityParameters.masterSecret = Arrays.Clone(this.mSessionParameters.MasterSecret);
                         this.mRecordStream.SetPendingConnectionState(Peer.GetCompression(), Peer.GetCipher());
-
-                        SendChangeCipherSpecMessage();
                     }
                     else
                     {

crypto/src/crypto/tls/TlsServerProtocol.cs

@@ -359,10 +359,10 @@ protected override void HandleHandshakeMessage(byte type, MemoryStream buf)
                     if (this.mExpectSessionTicket)
                     {
                         SendNewSessionTicketMessage(mTlsServer.GetNewSessionTicket());
-                        SendChangeCipherSpecMessage();
                     }
                     this.mConnectionState = CS_SERVER_SESSION_TICKET;
 
+                    SendChangeCipherSpecMessage();
                     SendFinishedMessage();
                     this.mConnectionState = CS_SERVER_FINISHED;
 
@@ -647,11 +647,6 @@ protected virtual void ReceiveClientKeyExchangeMessage(MemoryStream buf)
             }
 
             mRecordStream.SetPendingConnectionState(Peer.GetCompression(), Peer.GetCipher());
-
-            if (!mExpectSessionTicket)
-            {
-                SendChangeCipherSpecMessage();
-            }
         }
 
         protected virtual void SendCertificateRequestMessage(CertificateRequest certificateRequest)