Shibboleth Developers

["Scott Cantor" <>]

> ... which isn't consistent with what I said above.... once I removed
> the cert, I would have expected a tomcat level failure.... any chance
> the browser might cache the client cert somewhere? Or load them at
> startup?

The handshake is almost certainly cached. After the handshake, the cached
session on the server contains the certificate, and it will replay it to the
servlet each time.

Whether it's cached on the client depends on the browser. If it's on disk,
which some stacks allow, even restarting the browser wouldn't break the
session for a little while.

-- Scott