@@ -1094,6 +1094,11 @@ property is set only when `tlsSocket.authorized === false`.
 
 <!-- YAML
 added: v0.11.4
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/64677
+    description: On TLS 1.3, a resumed session where the client presented no
+                 certificate is no longer reported as authorized.
 -->
 
 * Type: {boolean}
@@ -1103,15 +1108,10 @@ specified when creating the `tls.TLSSocket` instance, otherwise `false`.
 
 The peer certificate is only verified during a full TLS handshake. When a
 connection is established by resuming a previous session (see
-[Session Resumption][]), verification is not repeated. If the client
-presented a certificate in the original handshake, `authorized` and
+[Session Resumption][]), verification is not repeated: `authorized` and
 `authorizationError` carry the result stored with the session, including
-any verification error. On TLS 1.3, a client that sent no certificate at
-all can resume a session and report `authorized` as `true`, while
-[`tls.TLSSocket.getPeerCertificate()`][] returns an empty object. Servers
-that authorize clients manually with `rejectUnauthorized: false` should
-therefore also check [`tls.TLSSocket.isSessionReused()`][] and that a peer
-certificate is present.
+any verification error and the case where the client presented no
+certificate at all.
 
 ### `tlsSocket.disableRenegotiation()`
 
@@ -2612,7 +2612,6 @@ added: v0.11.3
 [`tls.TLSSocket.getProtocol()`]: #tlssocketgetprotocol
 [`tls.TLSSocket.getSession()`]: #tlssocketgetsession
 [`tls.TLSSocket.getTLSTicket()`]: #tlssocketgettlsticket
-[`tls.TLSSocket.isSessionReused()`]: #tlssocketissessionreused
 [`tls.TLSSocket.servername`]: #tlssocketservername
 [`tls.TLSSocket`]: #class-tlstlssocket
 [`tls.connect()`]: #tlsconnectoptions-callback