Is the conclusion just that: when implementing a TLS stack, some people call it 'done' when they can get HTTP over TLS mostly working. You will find implementat

Is the conclusion just that: when implementing a TLS stack, some people call it 'done' when they can get HTTP over TLS mostly working. You will find implementations in the wild that omit any (or all) of the code that is required by the spec for security but not for interoperability. This is like the idea that the C source code found in the wild is anything that was accepted by some compiler at some point.