[TLS] Alert type for connection limit or server busy?

[Chris Newman <[e-mail]>]

Is there a TLS Alert type that can be used by a TLS server to reject a TLS
client connection based on a per-IP-address connection limit?

The idea would be to have the server reject the connection before spending
cycles on the TLS negotiation. But it's important to inform the client why the
connection is rejected in order to reduce the number and severity of support
calls that might be generated by such a limit if the connections were silently
dropped.

Another case that's interesting is when the server is temporarily overloaded
and wants to reserve CPU cycles for existing connections rather than spending
cycles accepting new connections. Again, it's desirable to indicate to the
client the cause of this connection failure in an attempt to reduce the number
and severity of support calls and also desirable not to spend unnecessary
server time on the TLS negotiation.

With the STARTTLS model, applications could just reject at the banner with a
text error message. But with the separate-port-for-TLS model, this needs to be
done in the TLS layer.

I didn't see appropriate alerts in RFC 5246 section 7.2.

Could alerts for these two cases be added as an extension or a TLS 1.3 feature?

		- Chris