On Mon, Feb 24, 2014 at 04:50:15PM -0800, Zi Hu wrote:
> > OpenSSL does this automatically, when the saved session includes
> > a ticket, which is true when the server sent a ticket. This requires
> > no new code on the OpenSSL client (OpenSSL needs to be recent enough
> > to support session tickets).
>
> OK, so no new code needed for the OpenSSL client. How about the server code?
> Do I need to call certain APIs explicitly to ask the server to send a
> session ticket to the client?
This too works by default, but the session ticket is encrypted with
a dynamically generated key. If your server is multi-threaded or
event based with all clients handled by a single process, you're fine.
If your server forks for every requests or runs as a pool of servers,
then you may need to arrange for servers to share a common set of
keys. OpenSSL provides functions for setting ticket encryption
and decryption keys. See the documentation (and RTFS) for:
SSL_CTX_set_tlsext_ticket_key_cb()
> > Resumption with session tickets is identical to resumption without
> > session tickets, the ticket is part of the cached session structure.
>
> I thought they are different. My understanding is that using session
> ticket for TLS resumption shifts the state from server to client.
It does, but the details are largely transparent to applications.
> That is if we use session ticket, the client needs to cache the ticket
> from the server, then uses it for later resumption. But the server doesn't
> need to remember anything.
Yes, but this requires no changes to either the client or server
application, except to the extent that servers running as multiple
processes need to synchronize key rotation.
> While if we DON'T use session ticket, the server needs to cache the session
> information (e.g. session id) for resumption.
>
> Am I misunderstanding something here?
Only how this impacts the client and server application API.
--
Viktor.
______________________________________________________________________
OpenSSL Project http://www.openssl.org
User Support Mailing List openssl-users@openssl.org
Automated List Manager majord...@openssl.org
