This enables periodic reauthentication of the upstream authenticator's certificate on an ongoing basis during an established EAP-TLS session, rather than validating that certificate only once at the initial handshake and then trusting the session indefinitely. An admin enables this to reduce the exposure window if the upstream server's certificate is revoked or replaced mid-session, since a one-time validation at connection time wouldn't catch a certificate that goes bad sometime after the session was already established. For example, in a long-lived uplink connection that stays authenticated for weeks at a time, enabling this ensures the switch periodically re-checks the peer's certificate rather than continuing to trust a session whose original certificate validation is now weeks stale.