Re: [TLS] Question to TLS 1.3 and certificate revocation checks in long lasting connections

[Benjamin Kaduk <[e-mail]>]

On Sun, Mar 07, 2021 at 12:15:24PM +0000, Graham Bartlett wrote:
> 
> I would imagine that the implementation would pull the session down once
> the certificate expires, so the session only lasts for the lifetime of the
> certificate.

Many people expect this, but I don't think there's universal agreement
that it's the right behavior.  The divide between authentication and
authorization that (IIRC) Viktor called out is relevant here -- the
initial key exchange and, to large extent, authentication, do not suddenly
become invalid upon credential expiry, but any authorization derived from
the credential might.  So it seems that whether the session should terminate
at the certificate expiry time is rather dependent on what the session is
being used for.

-Ben