• Version: v12.18.3
• Platform: Linux 5.8.8-100.fc31.x86_64 deps: update openssl to 1.0.1j #1 SMP Wed Sep 9 20:29:23 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
• Subsystem:

What steps will reproduce the bug?

• Obtain (or create) a CA certificate, a server certificate, and a server key supplied by said CA.
• Compile (with typescript) and run the following code:

import fs from 'fs';
import path from 'path';
import https from 'https';
import tls from 'tls';
import express from 'express';

/* Alias environment variables */
const port = process.env.PORT || 443;

const httpsOptions = {
    key: fs.readFileSync(path.join('certs', 'server.key')),
    cert: fs.readFileSync(path.join('certs', 'server.crt')),
    ca: fs.readFileSync(path.join('certs', 'ca.crt')),
    requestCert: true,
    rejectUnauthorized: false /* This is necessary to accept self-signed certificates, we will perform the authentication ourselves */
};

/* Create Express app */
const expressApp = express();
const expressServer = https.createServer(httpsOptions, expressApp);

expressApp.use((req,res,next) => {
    console.log((req.socket as tls.TLSSocket).authorized ? 'true' : 'false');
    if (!(req.socket as tls.TLSSocket).authorized) {
        return res.status(401).send('Unauthorized');
    }
    next();
});

expressServer.listen(port, () => {
    console.log(`Server listening on port ${port}`);
});

• Open Firefox (version 80) and go to https://localhost. You should have your connection rejected (output is 'false').
• Reload the page. Your connection is now accepted (output is 'true').
• This curiously doesn't happen on Chromium.

How often does it reproduce? Is there a required condition?

• Always reproducible. Chromium seems to not trigger the issue.

What is the expected behavior?

• Connection should always be rejected

What do you see instead?

• Connection is accepted after page reload

Additional information

• According to documentation at https://nodejs.org/api/tls.html#tls_tlssocket_authorized the (req.socket as tls.TLSSocket).authorized flag should always be false if the client certificate doesn't match the server CA. In this case it becomes true after a page reload from Firefox for unknown reasons.
• This issue is described also in a stack overflow entry: https://stackoverflow.com/questions/60367338/result-of-req-socket-authorized-is-not-correct-using-nodejs-https-and-express
• I'm guessing it might be due to some TLS connection reuse logic.