X.509 metadata can carry information through the firewall

Certificate exchange used as a side-channel before the certs get to work

Video A security researcher who last year demonstrated that X.509 certificate exchanges could carry malicious traffic has now published his proof-of-concept code."