code: private void serverFinished(Finished mesg) throws IOException {
          if (debug != null && Debug.isOn("handshake")) {
              mesg.print(System.out);
          }
  
          boolean verified = mesg.verify(handshakeHash, Finished.SERVER,
              session.getMasterSecret());
  
          if (!verified) {
              fatalSE(Alerts.alert_illegal_parameter,
                         "server 'finished' message doesn't verify");
              // NOTREACHED
          }
  
          /*
           * save server verify data for secure renegotiation
           */
          if (secureRenegotiation) {
              serverVerifyData = mesg.getVerifyData();
          }
  
          /*
           * Reset the handshake state if this is not an initial handshake.
           */
          if (!isInitialHandshake) {
              session.setAsSessionResumption(false);
          }
  
          /*
           * OK, it verified.  If we're doing the fast handshake, add that
           * "Finished" message to the hash of handshake messages, then send
           * our own change_cipher_spec and Finished message for the server
           * to verify in turn.  These are the last handshake messages.
           *
           * In any case, update the session cache.  We're done handshaking,
           * so there are no threats any more associated with partially
           * completed handshakes.
           */
          if (resumingSession) {
              input.digestNow();
              sendChangeCipherAndFinish(true);
          }
          session.setLastAccessedTime(System.currentTimeMillis());
  
          if (!resumingSession) {
              if (session.isRejoinable()) {
                  ((SSLSessionContextImpl) sslContext
                          .engineGetClientSessionContext())
                          .put(session);
                  if (debug != null && Debug.isOn("session")) {
                      System.out.println("%% Cached client session: " + session);
                  }
              } else if (debug != null && Debug.isOn("session")) {
                  System.out.println(
                      "%% Didn't cache non-resumable client session: "
                      + session);
              }
          }
      }
docs: /*
  "Finished" is the last handshake message sent.  If we got this
  far, the MAC has been validated post-decryption.  We validate
  the two hashes here as an additional sanity check, protecting
  the handshake against various active attacks.