Question
Resumption can outlive the credential event that would block a fresh handshake. This project measures that gap across certificate rotation, client revocation, restarts, and ticket-key changes.
Matrix
The canonical run recorded 5,040 observations, all valid, with 2,700 resumed handshakes. The implementation split was HAProxy (360 resumed of 1,800), nginx (720 of 1,440), and an OpenSSL reference path (1,620 of 1,800).
In the mTLS revocation condition, 180 fresh handshakes using revoked client A failed while a previously issued ticket still resumed. nginx continued to resume across the tested restart and ticket-rotation scenarios; HAProxy restarted into a full handshake fallback; the OpenSSL reference resumed after restart.
Takeaway
Certificate and revocation policy needs to be read alongside session-ticket lifetime and restart behaviour. A successful fresh-handshake policy does not automatically describe a resumed connection.
Boundary
The results are implementation and configuration specific. They are an invitation to reproduce the exact lifecycle on a target deployment, especially where mTLS provides an access boundary.