Bodo Moeller wrote:
>
> "Roger Bod�n" <[EMAIL PROTECTED]>:
>
> > I've noticed that the session re-use doesn't work if I turn on
> > client authentication in my SSL server, [...] A full SSL negotiation
> > is performed each time my client connects. If I turn off client
> > authentication the session cache works as intended.
>
> You have to set a "session ID context" for your SSL object so that the
> library knows which sessions belong in the same authorization class.
> The test in ssl_sess.c (function ssl_get_prev_session) is a little
> more paranoid than is usually necessary -- if the SSL_CTX-internal
> cache is used, usually one wouldn't really have to care about these,
> as the SSL_CTX is enough of a context then.
Are you sure a session from an external cache can't get recached in the
internal cache (I haven't checked)?
Cheers,
Ben.
--
http://www.apache-ssl.org/ben.html
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
- Indira Gandhi
______________________________________________________________________
OpenSSL Project http://www.openssl.org
Development Mailing List [EMAIL PROTECTED]
Automated List Manager [EMAIL PROTECTED]
