Re: Why is SSL_SESSION_ID changing?
On Tue, Oct 18, 2005 at 12:28:31PM +0200, Ryszard Lach wrote:[color=blue]
> We thought, that one of possible solutions will be binding user's
> session to SSL_SESSION_ID (i.e. keeping SSL_SESSION_ID in user's session
> and comparing it at every request with ID read from this request).
Don't - SSL_SESSION_ID isn't useable for longer lifetime sessions.
> The problem is, that SSL_SESSION_ID is changing regardles of
> SSLSessionCacheTimeout (we've set it to very high value). I suppose that
> it's not caused by server (mod_ssl after writing SESSION_ID to cache is
> able to get it back everytime, 100% hit rate).
> Is there any reason for which the ssl sessions are renegotiated
> (sometimes even three times during one minute)? Is it possible to block
> such a renegotiations at server/application side, or it is very
Lifetime can't be forced from the serverside, all you can do is set an
upper bound on it. The client may very well choose to cut the session
earlier. I've seen clients that let sessions live longer with a higher
level of security on the session - but it still isn't a good choice.
`Darn it, who spiked my coffee with water?!' - lwall
Apache Interface to OpenSSL (mod_ssl) [url]www.modssl.org[/url]
User Support Mailing List [email]email@example.com[/email]
Automated List Manager [email]firstname.lastname@example.org[/email]