On Fri, May 19, 2006 at 08:42:06PM +0800, Roger Zhang wrote:
> Thanks for your help! After I set with SSL_CTX_set_session_id_context, the
> problem is gone. But O'Reilly openssl book 5.2.1.2 says session caching is
> disabled by default, looks like the author is wrong.
>
Well, by default there is no session id context, so the author is not
that wrong.
External session caching is off by default, because it is implemented via
an application dependent access mechanism.
Also in the SSL client, the application needs to explicitly load a
suitable cached session, it is up to the application to determine which
session object, if any, is appropriate for any given connection. On
the server, the session id offered by the client will be automatically
retrieved from the internal session cache or any external cache via
a callback.
So, while the OpenSSL session cache is not "disabled" by default, it is
at least "dormant". You need to take appropriate steps to make use of
session caching in your application.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager [EMAIL PROTECTED]
