CRL Double-Gate in mTLS: Revoking a Cert When the Client Is Already Connected (opens in new tab)

In the previous article, we saw how to serve three mTLS audiences on a single port with SNI routing, and how cert binding protects against session replay. But there's still a gap: revocation. You revoke a client certificate. You update your CRL. The problem: the client is already connected via TCP keep-alive. Their TLS handshake happened 10 minutes ago. tls.Config.VerifyConnection only runs at handshake. The client keeps sending requests with a revoked cert, and your server accepts them. Why ...