This is a question which I believe the RFC is silent about: https://www.rfc-editor.org/rfc/rfc5246
When an SSL connection is established, and application messages being exchanged between client and server, if at a pt of time a renegotiation is triggered, what should happen to those application messages that are sent while both ends are still negotiating.. ? Are they discarded ? Do they cause renegotiation to fail ?
Thanks !
They are not discarded and they do not cause renegotiation to fail. They are encrypted using the existing session key until the ChangeCipherSpec message has been sent, after which they are encrypted with the new key. That applies in each direction separately. The implication is that they can be interleaved with the handshake messages, although whether any of the existing APIs can actually provide a way to do that is another question.