The responses to this are worth reading too: http://www.ietf.org/mail-archive/web/tls/current/msg03943.html http://www.ietf.org/mail-archive/web/tls/current/ms

The responses to this are worth reading too: http://www.ietf.org/mail-archive/web/tls/current/msg03943.html http://www.ietf.org/mail-archive/web/tls/current/msg03943.ht... http://www.ietf.org/mail-archive/web/tls/current/msg03942.html http://www.ietf.org/mail-archive/web/tls/current/msg03942.ht... Calling this "really bad" is perhaps pushing it a bit far; this is not something that is going to cause widespread panic tomorrow: because it's going to require more security flaws outside of the TLS connection - i.e. the unauthenticated request has to be useful :) Call it a gotcha for the moment! What this should be is a heads up for TLS servers/clients to rework the renegotiation sequence slightly (again see the response link).