Depends on which Microsoft OS and user agent.<p>If, e.g., you&#x27;re using an unpatched Windows 8.1 with IE11, you&#x27;ll still be able to connect initially but will get disconnected the first time the key is rotated (max of 1 hour). Upon disconnection, IE11 will downgrade from TLS 1.2 to 1.0 and try again with a new session, so the user probably won&#x27;t notice anything unless they&#x27;re looking for it. That being said, many sites are starting to deprecate TLS 1.0, so this could become more of a problem for patch laggards.<p>If, instead, you&#x27;re using a .NET client that doesn&#x27;t try&#x2F;catch the exception, your program will most likely crash. For customers like this with had a high dependency on Microsoft clients, we simply disabled the issuance of session tickets (just for their site) until the fix was made public.<p>Basically, SChannel freaks out when it sees a new session ticket  presented during the <i>abbreviated</i> handshake (it handles it fine during the full handshake). Without seeing their code, it appears that only portions of RFC 5077 were implemented. Btw, most sites don&#x27;t ever bother to ever rotate their session ticket keys outside of httpd process restarts, so this is why it wasn&#x27;t discovered for so long.