diff --git a/modules/ssl/ssl_engine_io.c b/modules/ssl/ssl_engine_io.c

index 0958135..018b667 100644

--- a/modules/ssl/ssl_engine_io.c

+++ b/modules/ssl/ssl_engine_io.c

@@ -200,6 +200,8 @@ static int bio_filter_out_write(BIO *bio, const char *in, int inl)

     apr_bucket *e;

     int need_flush;

+    BIO_clear_retry_flags(bio);

+

 #ifndef SSL_OP_NO_RENEGOTIATION

     /* Abort early if the client has initiated a renegotiation. */

     if (outctx->filter_ctx->config->reneg_state == RENEG_ABORT) {

@@ -208,12 +210,6 @@ static int bio_filter_out_write(BIO *bio, const char *in, int inl)

     }

 #endif

-    /* when handshaking we'll have a small number of bytes.

-     * max size SSL will pass us here is about 16k.

-     * (16413 bytes to be exact)

-     */

-    BIO_clear_retry_flags(bio);

-

     /* Use a transient bucket for the output data - any downstream

      * filter must setaside if necessary. */

     e = apr_bucket_transient_create(in, inl, outctx->bb->bucket_alloc);

@@ -460,6 +456,8 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen)

     if (!in)

         return 0;

+    BIO_clear_retry_flags(bio);

+

 #ifndef SSL_OP_NO_RENEGOTIATION

     /* Abort early if the client has initiated a renegotiation. */

     if (inctx->filter_ctx->config->reneg_state == RENEG_ABORT) {

@@ -468,8 +466,6 @@ static int bio_filter_in_read(BIO *bio, char *in, int inlen)

     }

 #endif

-    BIO_clear_retry_flags(bio);

-

     if (!inctx->bb) {

         inctx->rc = APR_EOF;

         return -1;