In theory yes. But Google Engineer Adam Langley wrote: > A test case could have caught this, but it's difficult because it's so deep into the handshake. One ne

In theory yes. But Google Engineer Adam Langley wrote: > A test case could have caught this, but it's difficult because it's so deep into the handshake. One needs to write a completely separate TLS stack, with lots of options for sending invalid handshakes. In Chromium we have a patched version of TLSLite to do this sort of thing but I cannot recall that we have a test case for exactly this. (Sounds like I know what my Monday morning involves if not.)