@@ -626,19 +626,33 @@ for (const test of TEST_CASES) {
 
 {
   // CCM cipher without data should not crash, see https://github.com/nodejs/node/issues/38035.
-  const algo = 'aes-128-ccm';
   const key = Buffer.alloc(16);
   const iv = Buffer.alloc(12);
   const opts = { authTagLength: 10 };
 
-  const cipher = crypto.createCipheriv(algo, key, iv, opts);
-  assert.throws(() => {
-    cipher.final();
-  }, hasOpenSSL3 ? {
-    code: 'ERR_OSSL_TAG_NOT_SET'
-  } : {
-    message: /Unsupported state/
-  });
+  const control = crypto.createCipheriv('aes-128-ccm', key, iv, opts);
+  control.update(Buffer.alloc(0));
+  control.final();
+  const expectedTag = control.getAuthTag();
+
+  const cipher = crypto.createCipheriv('aes-128-ccm', key, iv, opts);
+  let output;
+  try {
+    output = cipher.final();
+  } catch (err) {
+    // OpenSSL without https://github.com/openssl/openssl/pull/32427
+    // cannot finalize an empty CCM message unless update() was called.
+    if (hasOpenSSL3) {
+      assert.strictEqual(err.code, 'ERR_OSSL_TAG_NOT_SET');
+    } else {
+      assert.match(err.message, /Unsupported state/);
+    }
+  }
+
+  if (output !== undefined) {
+    assert.deepStrictEqual(output, Buffer.alloc(0));
+    assert.deepStrictEqual(cipher.getAuthTag(), expectedTag);
+  }
 }
 
 {