The secure renegotiation state was not updated on a session

resumption, which would cause failures if doing a renegotiation under
the same session (eg to refresh keys).

The peer_certs variable was not set until after the Session object was
created, meaning the session (or session ticket) would not include
client certs. Worse, they would be included in the next session saved,
so if a client presented one cert, then renegotiated and presented
another one, the first cert would be associated with the second
session!

0 files changed, 0 insertions, 0 deletions