The peer certificate is only verified during a full TLS handshake. When a

connection is established by resuming a previous session (see

[Session Resumption][]), verification is not repeated. If the client

presented a certificate in the original handshake, `authorized` and

`authorizationError` carry the result stored with the session, including

any verification error. On TLS 1.3, a client that sent no certificate at

all can resume a session and report `authorized` as `true`, while

[`tls.TLSSocket.getPeerCertificate()`][] returns an empty object. Servers

that authorize clients manually with `rejectUnauthorized: false` should

therefore also check [`tls.TLSSocket.isSessionReused()`][] and that a peer

certificate is present.

[`tls.TLSSocket.isSessionReused()`]: #tlssocketissessionreused