Add extra TODO to find out more about status_request extension during

session resumption

1 files changed, 4 insertions, 0 deletions

diff --git a/core/src/main/java/org/bouncycastle/crypto/tls/TlsClientProtocol.java b/core/src/main/java/org/bouncycastle/crypto/tls/TlsClientProtocol.java
index e4eb59b8..a1df0e33 100644
--- a/core/src/main/java/org/bouncycastle/crypto/tls/TlsClientProtocol.java
+++ b/core/src/main/java/org/bouncycastle/crypto/tls/TlsClientProtocol.java
@@ -720,6 +720,10 @@ public class TlsClientProtocol
 
             this.securityParameters.truncatedHMac = TlsExtensionsUtils.hasTruncatedHMacExtension(sessionServerExtensions);
 
+            /*
+             * TODO It's surprising that there's no provision to allow a 'fresh' CertificateStatus to be sent in
+             * a session resumption handshake.
+             */
             this.allowCertificateStatus = !this.resumedSession
                 && TlsUtils.hasExpectedEmptyExtensionData(sessionServerExtensions,
                     TlsExtensionsUtils.EXT_status_request, AlertDescription.illegal_parameter);