Thanks. That might help but I'm not quite sure what I'm looking at. Wireshark shows the various frames sent to and from the server. The point of interest is frame frame 25 is sent from the server to the client, and the client sends back an ACK in frame 26. After that nothing happens until the timeout passes (increasing the timeout just means it waits longer). After which the client sends an encrypted request which the server response to with a FIN/ACK and then the client sends a RST/ACK and closes the port.
I'm not sure what the client would be waiting on at that point. It appears that all encrypted requests have received an encrypted response.
I'm not sure what the client would be waiting on at that point. It appears that all encrypted requests have received an encrypted response.