@@ -51,7 +51,10 @@ redirect will send browsers to a port nothing is listening on.
 
 The web surface itself is reachable without an operator certificate: it serves a landing
 page with a Log in action, and every API call still requires a certificate that verifies
-against the operator CA.
+against the operator CA. Because both share one listener, a browser may open its
+connection for the page before it offers a certificate; an API call that arrives on such a
+connection is refused and the connection is closed, so the next attempt makes a fresh TLS
+handshake. The refusal is logged (`authz: refused ...`) with the caller's address.
 
 **Everything under the mount must be readable by uid 65532.** The final image stage is
 `gcr.io/distroless/static-debian12:nonroot`, so the process runs as that uid, and that
 
@@ -25,13 +25,17 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"encoding/asn1"
 	"encoding/json"
 	"encoding/pem"
+	"io"
 	"math/big"
 	"net/http"
 	"net/http/httptest"
+	"net/http/httptrace"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -404,3 +408,179 @@ func TestRootHandler_VersionIsAnonymous(t *testing.T) {
 		t.Errorf("body = %q, want the build info rather than the SPA", rec.Body.String())
 	}
 }
+
+// writeOperatorCA writes a self-signed operator CA to dir and returns its path
+// with the parsed certificate and key, so a test can issue operator leaves.
+func writeOperatorCA(t *testing.T, dir string) (string, *x509.Certificate, *ecdsa.PrivateKey) {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber:          big.NewInt(1),
+		Subject:               pkix.Name{CommonName: "operator CA"},
+		NotBefore:             time.Now().Add(-time.Hour),
+		NotAfter:              time.Now().Add(time.Hour),
+		IsCA:                  true,
+		BasicConstraintsValid: true,
+		KeyUsage:              x509.KeyUsageCertSign,
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, tmpl, &key.PublicKey, key)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ca, err := x509.ParseCertificate(der)
+	if err != nil {
+		t.Fatal(err)
+	}
+	path := filepath.Join(dir, "operator-ca.pem")
+	if err := os.WriteFile(path, pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: der}), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path, ca, key
+}
+
+// operatorLeaf issues a client certificate carrying the admin access level.
+func operatorLeaf(t *testing.T, ca *x509.Certificate, caKey *ecdsa.PrivateKey) tls.Certificate {
+	t.Helper()
+	key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	value, err := authz.MarshalLevelValue(authz.LevelAdmin)
+	if err != nil {
+		t.Fatal(err)
+	}
+	oid, err := asn1ObjectIdentifier(authz.AccessLevelOID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	tmpl := &x509.Certificate{
+		SerialNumber:    big.NewInt(2),
+		Subject:         pkix.Name{CommonName: "op@acme.example"},
+		NotBefore:       time.Now().Add(-time.Hour),
+		NotAfter:        time.Now().Add(time.Hour),
+		KeyUsage:        x509.KeyUsageDigitalSignature,
+		ExtKeyUsage:     []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth},
+		ExtraExtensions: []pkix.Extension{{Id: oid, Value: value}},
+	}
+	der, err := x509.CreateCertificate(rand.Reader, tmpl, ca, &key.PublicKey, caKey)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: key}
+}
+
+// asn1ObjectIdentifier parses a dotted OID.
+func asn1ObjectIdentifier(dotted string) (asn1.ObjectIdentifier, error) {
+	var oid asn1.ObjectIdentifier
+	for _, part := range strings.Split(dotted, ".") {
+		n, err := strconv.Atoi(part)
+		if err != nil {
+			return nil, err
+		}
+		oid = append(oid, n)
+	}
+	return oid, nil
+}
+
+// connTracker records whether each request went out on a reused connection.
+func connTracker(req *http.Request, reused *bool) *http.Request {
+	trace := &httptrace.ClientTrace{GotConn: func(info httptrace.GotConnInfo) { *reused = info.Reused }}
+	return req.WithContext(httptrace.WithClientTrace(req.Context(), trace))
+}
+
+// TestServe_CertlessConnectionIsNotReusedForTheAPI reproduces #77 over a real
+// TLS listener speaking HTTP/2 with the production TLS posture. The browser's
+// first request is for the anonymous web surface, so that handshake completes
+// with no client certificate. HTTP/2 then reuses the connection for the API,
+// which refuses it -- correctly, and it must keep doing so -- but a connection
+// with no certificate can never authenticate, so it must not stay open for the
+// next API call either. The server closes it, and the client's next request
+// performs a fresh handshake where the certificate can be offered.
+func TestServe_CertlessConnectionIsNotReusedForTheAPI(t *testing.T) {
+	caPath, ca, caKey := writeOperatorCA(t, t.TempDir())
+	tlsCfg, err := buildTLSConfig(config.Config{OperatorCAPath: caPath})
+	if err != nil {
+		t.Fatalf("buildTLSConfig: %v", err)
+	}
+
+	const apiPath = "/cryptos.fleet.v1.FleetService/"
+	srv := httptest.NewUnstartedServer(newRootHandler(
+		apiPath,
+		stubHandler(http.StatusOK, "api"),
+		stubHandler(http.StatusOK, "spa"),
+		authz.ClientCertMiddleware,
+		nil,
+	))
+	srv.EnableHTTP2 = true
+	srv.TLS = tlsCfg
+	srv.StartTLS()
+	t.Cleanup(srv.Close)
+
+	do := func(t *testing.T, c *http.Client, method, path string) (int, bool) {
+		t.Helper()
+		var reused bool
+		req, err := http.NewRequest(method, srv.URL+path, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		resp, err := c.Do(connTracker(req, &reused))
+		if err != nil {
+			t.Fatalf("%s %s: %v", method, path, err)
+		}
+		_, _ = io.Copy(io.Discard, resp.Body)
+		_ = resp.Body.Close()
+		if resp.ProtoMajor != 2 {
+			t.Fatalf("%s %s: proto = %s, want HTTP/2", method, path, resp.Proto)
+		}
+		return resp.StatusCode, reused
+	}
+
+	t.Run("no certificate", func(t *testing.T) {
+		c := srv.Client()
+		t.Cleanup(c.CloseIdleConnections)
+
+		if code, _ := do(t, c, http.MethodGet, "/"); code != http.StatusOK {
+			t.Fatalf("GET / = %d, want 200", code)
+		}
+		code, reused := do(t, c, http.MethodPost, apiPath+"WhoAmI")
+		if code != http.StatusUnauthorized {
+			t.Fatalf("API = %d, want 401", code)
+		}
+		if !reused {
+			t.Fatal("API call did not reuse the web connection; the test is not exercising #77")
+		}
+		// The refused connection is gone: the next request handshakes again.
+		code, reused = do(t, c, http.MethodPost, apiPath+"WhoAmI")
+		if code != http.StatusUnauthorized {
+			t.Fatalf("API retry = %d, want 401", code)
+		}
+		if reused {
+			t.Error("API retry reused the certless connection, want a fresh handshake")
+		}
+	})
+
+	t.Run("with certificate", func(t *testing.T) {
+		c := srv.Client()
+		tr := c.Transport.(*http.Transport).Clone()
+		tr.TLSClientConfig.Certificates = []tls.Certificate{operatorLeaf(t, ca, caKey)}
+		c = &http.Client{Transport: tr}
+		t.Cleanup(c.CloseIdleConnections)
+
+		if code, _ := do(t, c, http.MethodGet, "/"); code != http.StatusOK {
+			t.Fatalf("GET / = %d, want 200", code)
+		}
+		// An authenticated connection is left alone and keeps being reused.
+		for range 2 {
+			code, reused := do(t, c, http.MethodPost, apiPath+"WhoAmI")
+			if code != http.StatusOK {
+				t.Fatalf("API = %d, want 200", code)
+			}
+			if !reused {
+				t.Error("authenticated API call did not reuse its connection")
+			}
+		}
+	})
+}
@@ -19,6 +19,7 @@ limitations under the License.
 */
 
 import (
+	"log"
 	"math/big"
 	"net/http"
 	"strings"
@@ -50,6 +51,15 @@ func ClientCertMiddleware(next http.Handler) http.Handler {
 func ClientCertMiddlewareWithRevocation(revoker serialRevoker, next http.Handler) http.Handler {
 	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if r.TLS == nil || len(r.TLS.PeerCertificates) == 0 {
+			// A connection whose handshake carried no certificate can never
+			// authenticate, yet HTTP/2 would keep reusing it for every later
+			// API call -- typically because it was opened for the anonymous web
+			// surface (#77). Close it (GOAWAY on h2) so the client's next
+			// attempt makes a fresh handshake where a certificate can be
+			// offered. The request is refused either way.
+			w.Header().Set("Connection", "close")
+			log.Printf("authz: refused %s %q from %s: the TLS connection carries no client certificate; closing it so the client re-handshakes",
+				r.Method, r.URL.Path, r.RemoteAddr)
 			http.Error(w, "client certificate required", http.StatusUnauthorized)
 			return
 		}
 
@@ -86,6 +86,37 @@ func TestClientCertMiddleware_NoCert401(t *testing.T) {
 	}
 }
 
+// TestClientCertMiddleware_NoCertClosesConnection pins #77. A connection whose
+// handshake carried no client certificate can never authenticate, and HTTP/2
+// would otherwise keep reusing it for every later API call. Refusing with
+// Connection: close makes the server tear it down (GOAWAY on h2) so the client's
+// next attempt performs a fresh handshake, where a certificate can be offered.
+func TestClientCertMiddleware_NoCertClosesConnection(t *testing.T) {
+	for _, tc := range []struct {
+		name string
+		tls  *tls.ConnectionState
+	}{
+		{"no TLS", nil},
+		{"TLS without a peer certificate", &tls.ConnectionState{}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			rec := httptest.NewRecorder()
+			req := httptest.NewRequest(http.MethodPost, "/rpc", nil)
+			req.TLS = tc.tls
+			ClientCertMiddleware(http.HandlerFunc(func(http.ResponseWriter, *http.Request) {
+				t.Error("next must not be called without a client certificate")
+			})).ServeHTTP(rec, req)
+
+			if rec.Code != http.StatusUnauthorized {
+				t.Fatalf("status = %d, want 401", rec.Code)
+			}
+			if got := rec.Header().Get("Connection"); got != "close" {
+				t.Errorf("Connection = %q, want close", got)
+			}
+		})
+	}
+}
+
 func TestClientCertMiddleware_MissingExtension403(t *testing.T) {
 	// A verified peer cert that carries no access-level extension must be
 	// rejected (403), never passed through or defaulted to a privileged level.