No new connections to a partner

Existing connections to a partner are still running or have just ended normally, but new connections don't come up, even though the certificates are valid.

Connections between the two TLS adapters of a trust relationship, with the key agents' additional post-quantum secret; all operating models.

A TLS adapter opens a relationship connection only with a valid secret from the key agents. If the counterpart's agent is unreachable, existing connections run until the end of their lifetime, and new ones are opened as long as a valid secret is still available. After that, no new connection is opened. There's no silent fallback to TLS without the secret.

Other causes look the same: the relationship has expired, or the connection doesn't meet the cryptographic requirements of one of the two relationship policies.

1. In monitoring, check the age of the most recent secret for this agent pair. If it keeps growing, the other side is unreachable or the exchange is disrupted.
2. Get the counterpart's key agent reachable again; that's up to the partner. As soon as the agents have agreed on a new secret, connections come up again.
3. Check the rejected connections per relationship and reason. If the relationship has expired, agree on a new duration; if one policy requires properties the other side doesn't meet, align the requirements of both directions.

The age of the most recent secret drops back below the renewal interval (10 minutes by default), and rejected connections for this relationship stay at zero.

• PQ key exchange for TLS – failure behavior
• Federation and bilateral trust – duration and cryptographic requirements per direction
• Operations and emergencies – monitoring signals