Looks good to me for TLS 1.3 connections. I'm wondering if #close_write should raise an error if it's called on a TLS 1.2 connection because it can be misleading. What do you think?

close_notify (which is sent by SSLSocket#stop = SSL_shutdown()) works differently in TLS 1.2 or older protocol versions. TLS 1.2 (https://www.rfc-editor.org/rfc/rfc5246#section-7.2.1) says:

The other party MUST respond with a close_notify alert of its own and close down the connection immediately, discarding any pending writes. It is not required for the initiator of the close to wait for the responding close_notify alert before closing the read side of the connection.

IMHO, I think it's better just to do nothing. Raising an error will be more trouble for the user, and of little value. In other words, no other implementation of close_write can emit an error like this, so it's unexpected.

I don't see how #close_write could be used in a meaningful way on a TLS 1.2 connection, so users might not to want to call it at all. But I don't have a strong preference on it and I think both are OK.

Could you add some rdoc comments on the behavior difference?

What do you think of the updated documentation?

@rhenium thanks for your detailed review. Can you check it again?

Looks good to me. Thank you!