That makes it sound like the &quot;bug&quot; (lack of support for updating TLS session keys) was known for a long time, and the original &quot;fix&quot; was the client admitting it didn&#x27;t really fully do TLS 1.2, which based on your experience seems to be a typical &quot;fix&quot; in SChannel.<p>(or, I&#x27;ll admit, it&#x27;s more likely the fallback after a &quot;failed negotiation&quot; was a &quot;robustness&quot; behavior that essentially hid problems)