SSL session reuse - how to find if supported?

Before I delve deeper, its a good idea to be clear about SSL session reuse. Every time when a client (browser, curl, etc.) connects to a server over SSL, the server creates a session for that connection. This session ID is sent as a part of the Server Hello message. This is to make things efficient, in case the client has any plans of closing the current connection and reconnect in the near future. Most of the servers have a time out for these sessions (I think 24 hours is a common value, unless pressed for space).

When the client connects to the same server again, it can send the same session ID as a part of the Client Hello. The server will first look up if it can find any sessions with that ID. If found, the same session will be reused. Thus the time spent in verifying the certs and negotiating the keys is saved. If the server cannot find a matching session, then it responds with a new session ID and its certificate in Server Hello message. The client knows that it has to verity the cert and negotiate the key again.

Considerable amount of time is spent in validating server certs. Reusing SSL session will save this time.

But when there is more than one server behind a load balancer, and the client connects only to the load balancer, there is a likelihood that the load balancer forwards second connection to a different server. But luckily, most of the load balancers today can be configured to provide the SSL session stickiness, and hence they will forward the request properly. From my understanding, most of the load balancers achieve SSL session stickiness through IP stickiness.

The question is: how to find out if a server supports SSL session reuse? Or, if you are hitting load balancer, how to find out if the load balancer maintains SSL session stickiness?

OpenSSL has a useful application called "s_client" which can be used to find out if SSL session is supported. The following command will do the magic:
openssl s_client -reconnect -state -prexit -connect ServerURL
The important option here is "-reconnect". It will disconnect and reconnect to the server 5 times using the same SSL session ID, that came in the first Server Hello message. It will print each time if the same session ID is reused or a new session ID is sent in the Server Hello message.

Comments

Prashanth Rao said…
Very useful tip. Exactly what I was looking for. Thanks.
2/08/2008 02:07:00 PM
Anonymous said…
Hmmm. Is there anyway to get this to work while changing the timing?

I need to test persistence based on the SSL Session ID (for one of those load balancers you mentioned), but I need to vary the interval (say, at 5, 10, 30 and 300 seconds).
5/27/2008 02:17:00 PM
Anonymous said…
good explanation. I am exactlying look for this to test session id resuse
1/08/2009 11:00:00 AM
Anonymous said…
You can also use the following:
openssl s_client -connect HOSTNAME:PORT -sess_out new.sess

This will export the used ssl session to a file
Than you can use
penssl s_client -connect HOSTNAME:PORT -sess_in new.sess

to reuse the session from before.

Ron
9/05/2011 06:07:00 AM
JJ said…
magician, I found what I need, tnx lot ;-)
9/29/2013 01:02:00 AM
Post a Comment

Popular posts from this blog

The mysterious ORA-03111 error

Recently one of the applications that I developed started throwing exceptions, that had the following message: SQL state [72000]; error code [1013]; ORA-03111: break received on communication channel When I googled around, I couldn't come across anything useful. Sadly enough most of the sites just showed the documentation for that error, without any explanation from anyone experiencing that issues. So here you go, with the best possible explanation that I could come up with. My application sets two things on the connection that is throwing this exception: It sets the fetchSize to be 2500 rows It sets the query timeout to be 10 seconds The database server and the application are separated over a long latency network (actually there is a NetEm box that emulates the long latency between these two boxes) which has a latency characteristic of 50+/-5 milliseconds. This is the whole setup. It is important to understand how the timeout is handled by the Oracle client (in my case JDBC clien...
Read more

Note on allocationSize parameter of @SequenceGenerator while using JPA

I ran into what I thought as an issue while I was using the sequence ID generation strategy in JPA. The JPA provider I am using is Hibernate. I think sharing my experience will save someone some time. To use a sequence (For e.g. Oracle sequence) to generate values and assign them to the ID field of your persistence object, you will following something like this: @Id @Column(name = "ITEM_ID") @GeneratedValue(strategy = GenerationType.SEQUENCE, generator="ItemIdSeqGenerator") @SequenceGenerator(name="ItemIdSeqGenerator", sequenceName="ITEM_ID_SEQ", allocationSize=1) private long itemId; This means the following things: The @Id annotation says that the field itemId is a primary key. The @Column annotation says that the corresponding column in the database is ITEM_ID. The @GeneratedValue says that the value that needs to be populated in the itemId should be generated, while that object is persisted. The strategy to generate the value is to...
Read more

xVM's vboxmanage.exe command

You can view and edit the configuration of your guest OSs using the vboxmanage command. To view the list of guest OSs you have, give the following command: C:\Program Files\Sun\xVM VirtualBox>VBoxManage.exe list vms VirtualBox Command Line Management Interface Version 2.2.2 (C) 2005-2009 Sun Microsystems, Inc. All rights reserved. "MySolaris" {dc6dc85f-5583-4a1b-bf3e-969941a2cd91} "Ubuntu" {eb973bbf-d86e-4579-85eb-6ea2cd12bf95} "Debian" {3e784597-89d8-4f17-90cb-63e866c651a3} "openSUSE" {6862884e-60e1-4c65-8aab-b57ec38a3922} "Debian-Lenny" {4b561432-abac-4a27-a501-b42af956b96b} To view the specific guest, you can use the UUID of the guest. For e.g. C:\Program Files\Sun\xVM VirtualBox>VBoxManage.exe showvminfo eb973bbf-d86e-4579-85eb-6ea2cd12bf95 VirtualBox Command Line Management Interface Version 2.2.2 (C) 2005-2009 Sun Microsystems, Inc. All rights reserved. Name: Ubuntu Guest OS: Ubuntu UUID: eb973bb...
Read more