ADDITIONAL SYSTEM INFORMATION :
"uname -a"
Linux saturn 4.15.0-45-generic #48-Ubuntu SMP Tue Jan 29 16:28:13 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

java 11.0.2 2019-01-15 LTS
Java(TM) SE Runtime Environment 18.9 (build 11.0.2+9-LTS)
Java HotSpot(TM) 64-Bit Server VM 18.9 (build 11.0.2+9-LTS, mixed mode)


A DESCRIPTION OF THE PROBLEM :
The client calls SSLEngine.closeOutBound() sending a close_notify. The server state is NOT_HANDSHAKING. The server unwraps. The server state becomes NEED_WRAP. The server calls wrap. The result is OK. The server state is still NEED_WRAP.

This state is confusing to me. What I expect is after the server receives an EOF from the client, it starts a clean close. The clean close involves the following steps:
(1) writing application data, wrapping and flushing to the socket channel
(2) call sslEngine.closeOutbound
(3) wrap() again and flush to the socket channel
However, in step (1), I do handshake first and call wrap with an empty byte buffer. Intuitively I call wrap again which seems to be the wrong action, which caught me by surprise. Am I understanding the behavior correctly? If yes, worth mentioning in the javadoc that after inbound done, the handshake status is always NEED_WRAP until outbound done?