Solved

In what cases will server send empty session id during TLS handshake

Posted on 2016-08-16
3
116 Views
Last Modified: 2016-09-03
HI,
I was reading : https://tools.ietf.org/html/rfc5246
And came across this line :
The server
      may return an empty session_id to indicate that the session will
      not be cached and therefore cannot be resumed.


This i also saw happening in one of our company servers which sent : Session ID length: 0  in TLS record.
Why will any server do that. Isnt it always beneficial to give the option to cache the session. So the next time the client
wants to connect it can be done faster ?

Thanks
0
Comment
Question by:Rohit Bajaj
  • 2
3 Comments
 
LVL 62

Accepted Solution

by:
gheist earned 300 total points
ID: 41761534
If apache does not have properly cinnected session id storage it does so (i.e on first connection it says it suppots sessions, on connection client sends session ID for next, apache neuters that because it is not found in its non-existant database.
0
 
LVL 22

Assisted Solution

by:eeRoot
eeRoot earned 200 total points
ID: 41764544
Likely to let the client app know that the session will not be held open.  An application developer may use this field to determine if re-auth is needed while the user session or application is still running.
0
 
LVL 62

Expert Comment

by:gheist
ID: 41765664
https://www.ietf.org/rfc/rfc5077.txt

   The server uses a zero-length SessionTicket extension to indicate to
   the client that it will send a new session ticket using the
   NewSessionTicket handshake message described in Section 3.3.  The
   server MUST send this extension in the ServerHello if it wishes to
   issue a new ticket to the client using the NewSessionTicket handshake
   message.  The server MUST NOT send this extension if it does not
   receive one in the ClientHello.
0

Featured Post

Free Tool: SSL Checker

Scans your site and returns information about your SSL implementation and certificate. Helpful for debugging and validating your SSL configuration.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

685 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question