diff --git a/examples/client/client.c b/examples/client/client.c
index afe1f5ef1..5d268d7ab 100644
--- a/examples/client/client.c
+++ b/examples/client/client.c
@@ -694,13 +694,21 @@ THREAD_RETURN CYASSL_THREAD client_test(void* args)
         if (nonBlocking) {
             printf("not doing secure renegotiation on example with"
                    " nonblocking yet");
-        }
-        else if (CyaSSL_Rehandshake(ssl) != SSL_SUCCESS) {
-            int  err = CyaSSL_get_error(ssl, 0);
-            char buffer[CYASSL_MAX_ERROR_SZ];
-            printf("err = %d, %s\n", err,
+        } else {
+            #ifndef NO_SESSION_CACHE
+                if (resumeSession) {
+                    session = CyaSSL_get_session(ssl);
+                    CyaSSL_set_session(ssl, session);
+                    resumeSession = 0;  /* only resume once */
+                }
+            #endif
+            if (CyaSSL_Rehandshake(ssl) != SSL_SUCCESS) {
+                int  err = CyaSSL_get_error(ssl, 0);
+                char buffer[CYASSL_MAX_ERROR_SZ];
+                printf("err = %d, %s\n", err,
                                 CyaSSL_ERR_error_string(err, buffer));
-            err_sys("CyaSSL_Rehandshake failed");
+                err_sys("CyaSSL_Rehandshake failed");
+            }
         }
     }
 #endif /* HAVE_SECURE_RENEGOTIATION */
diff --git a/src/internal.c b/src/internal.c
index d1437fb1f..93d239140 100644
--- a/src/internal.c
+++ b/src/internal.c
@@ -8960,6 +8960,10 @@ static void PickHashSigAlgo(CYASSL* ssl,
 
         ssl->options.serverState = SERVER_HELLO_COMPLETE;
 
+        if (ssl->keys.encryptionOn) {
+            *inOutIdx += ssl->keys.padSz;
+        }
+
         if (ssl->options.resuming) {
             if (ssl->options.haveSessionId && XMEMCMP(ssl->arrays->sessionID,
                                          ssl->session.sessionID, ID_LEN) == 0) {
@@ -8998,10 +9002,6 @@ static void PickHashSigAlgo(CYASSL* ssl,
             }
         #endif
 
-        if (ssl->keys.encryptionOn) {
-            *inOutIdx += ssl->keys.padSz;
-        }
-
         return SetCipherSpecs(ssl);
     }