Hello, Apart from flagging OpenSSL to NOT lookup the internal cache for session-id's, we should ALSO tell OpenSSL to NOT store the sessions ! This fixes my problem where the httpd process size keeps increasing when SSLVerifyClient is enabled along with SSLSessionCache.
-Madhu Index: ssl_engine_init.c =================================================================== RCS file: /home/cvs/httpd-2.0/modules/ssl/ssl_engine_init.c,v retrieving revision 1.126 diff -u -r1.126 ssl_engine_init.c --- ssl_engine_init.c 5 Mar 2004 02:44:40 -0000 1.126 +++ ssl_engine_init.c 25 Mar 2004 23:27:02 -0000 @@ -450,7 +450,7 @@ * to ignore process local-caching and * to always get/set/delete sessions using mod_ssl's callbacks. */ - cache_mode = SSL_SESS_CACHE_SERVER|SSL_SESS_CACHE_NO_INTERNAL_LOOKUP; + cache_mode = SSL_SESS_CACHE_SERVER|SSL_SESS_CACHE_NO_INTERNAL; } SSL_CTX_set_session_cache_mode(ctx, cache_mode);