Re: TLS and ACAP/IMAP/POP

RL Bob Morgan wrote:
>   After the initiator of a close has sent a closure alert, it MUST discard
>   any TLS messages until it has received an alert from the other party.
>   It will cease to send TLS Record Protocol PDUs, and following the
>   reciept of the alert, MAY send and receive LDAP PDUs.

I don't see the technical justification for this requirement.  In the
current close-TCP-connection-after-notify case, there is no
corresponding requirement for the sender of a close_notify to discard
any received TLS messages.

I observe that if there is a cipher suite mismatch, one side will send a
handshake_failure alert, closing the underlying TCP connection.  Clients
which want to fallback from TLS to SASL or simple-bind authentication
will still have to be able to reconnect in their fallback code.

> Similar language would presumably work in the IMAP/POP/ACAP draft.

IMAP/POP/ACAP do not have "unauthenticate but continue connection"
operations, so they have no use for a "stop TLS but continue connection"
operation.