diff --git a/src/sniffer.c b/src/sniffer.c
index bfd15b1e0..d88ab985c 100644
--- a/src/sniffer.c
+++ b/src/sniffer.c
@@ -2677,6 +2677,7 @@ doMessage:
             Trace(GOT_CHANGE_CIPHER_STR);
             ssl->options.handShakeState = HANDSHAKE_DONE;
             ssl->options.handShakeDone  = 1;
+            ssl->options.gotChangeCipher = 1;
             break;
         case application_data:
             Trace(GOT_APP_DATA_STR);