Re: [TLS] Re: when is it ok to resume a cached SSL/TLS session

OpenSSL, following the SHOULD recommendation

Out of interest, in resumption procedures does OpenSSL (a) 
maintain the earliest expiry date of the certs in the 
partys' cert chains in the connection state(s), or (b) 
revalidate cert chains?

If a server receives a client nonce that is later than the 
expiry data of the client cert INDICATED, is this a fatal 
alert case - even before handing the cert chain to the 
application? I assume not, under the "certs are opaque 
objects to SSL protocol machine" rule

While invalidated sessionIds and expired/invalid certs DO 
NOT require either party to drop an ongoing TLS Connection, 
these same conditions CLEARLY control active session 
duplication, session resumption, and full handshakes.

>   If either party suspects that the session may have been
>   compromised, or that certificates may have expired or 
> been revoked,
>   it should force a full handshake. "

_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls