Due to the new half-close policy in TLS 1.3, an infinite loop can occur in JsseSslConduitEngine#handleHandshake when the SSLEngineResult.HandshakeStatus is NEED_WRAP and the SSLEngineResult.Status is CLOSED. In particular, after this state is reached, the SSLEngineResult.HandshakeStatus will always be NEED_WRAP and the SSLEngineResult.Status will always be OK and so the for loop will never terminate.