Nginx How to activate ssl "Session Resumption"?

rdan · Jul 8, 2014

We both have it disable here:
http://tools.maxcdn.com/ssl?d1=www.phcorner.net
http://tools.maxcdn.com/ssl?d1=community.centminmod.com

Looks like it's nice to enable, but how @eva2000 ?

rdan · Jul 8, 2014

I just look at my config, and I got this:

ssl_session_cache shared:SSL:30m;
ssl_session_timeout 12h;
Click to expand...

That's it right?
How come it didn't work?

eva2000 · Jul 8, 2014

might have found an answer at http://forum.nginx.org/read.php?2,152294,152328#msg-152328 from thread http://forum.nginx.org/read.php?2,152294,152294#msg-152294

Session establishmen/resumption happens before SNI handling.
Therefore configuring session cache within SNI-only server{} won't
work, you have to configure one in default server for the socket
in question.

This is how it's done in OpenSSL, and it seems to be what actually
required by RFC4366 (http://tools.ietf.org/html/rfc4366#section-3):

- If, on the other hand, the older session is resumed, then the
server MUST ignore the extensions and send a server hello
containing none of the extension types. In this case, the
functionality of these extensions negotiated during the original
session initiation is applied to the resumed session.

One can't resume session stored somewhere in server name related
context while following "MUST ignore" rule.

Maxim Dounin
Click to expand...

also http://forum.nginx.org/read.php?2,152294,152401#msg-152401

I've played a bit with this, and it seems the only working
configuration is having identical ssl_session_cache in all
SNI server{}'s.

Anything else will not work due to the fact that OpenSSL uses
initial context (i.e. default server's one) for session caching,
but current context (i.e. server name matched server's) e.g. to
decide whether advertise session id to client or not.

I.e. the following configuration will not cache sessions to
"test.example.com":

ssl_session_cache off;

server {
listen 443 ssl default;
ssl_session_cache shared:SSL:10m;
...
}

server {
listen 443;
server_name test.example.com;
...
}

Additionally, when shared cache is used, nginx will be confused by
new session/remove session callbacks called with ssl connection
with context which is not expected to have any session callbacks.
E.g. this configuration will generate SIGSEGV on request to
"test.example.com":

server {
listen 443 ssl default;
ssl_session_cache shared:SSL:10m;
...
}

server {
listen 443;
server_name test.example.com;
ssl_session_cache builtin;
...
}

Simpliest (and recommended) workaround for both problems is to use
ssl_session_cache defined at http{} level. I.e.

ssl_session_cache shared:SSL:10m;

server {
...
}

...

Maxim Dounin
Click to expand...

But i have managed to enable both SSL resumption for caching and tickets at https://www.ssllabs.com/ssltest/analyze.html?d=sslpatch.centminmod.com&hideResults=on but fails at http://tools.maxcdn.com/ssl?d1=sslpatch.centminmod.com so might be maxcdn tool/test problem or it does as Maxim stated above and checks for nginx default_server hostname for Centmin Mod ?
Code:
Session resumption (caching)    Yes
Session resumption (tickets)    Yes

rdan · Jul 8, 2014

And so we have it working already or not?
I'm sorry I do not understand it fully

eva2000 · Jul 8, 2014

basically ignore maxcdn version and use ssllabs version https://www.ssllabs.com/ssltest/analyze.html?d=phcorner.net&hideResults=on
Code:
Session resumption (caching)    Yes
Session resumption (tickets)    Yes

rdan · Jul 8, 2014

Aw
Thanks!
I read most likely 20+ pages result from google search how to fix this when it's already working my bad

Log in / Register

Forums

Want to subscribe to topics you're interested in?

Nginx How to activate ssl "Session Resumption"?

rdan Well-Known Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

.

Log in / Register

Useful Searches

Want to subscribe to topics you're interested in?

Nginx How to activate ssl "Session Resumption"?

rdan Well-Known Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

eva2000 Administrator Staff Member

rdan Well-Known Member

.