Actually this can be improved since the client only needs network connectivity if it needs to renew the certificate.