Can SSL server choose a session ID '0' in the 'Server Hello' message?

Question

Can s SSL server in response to 'CLIENT_HELLO' request choose a NULL value for the session ID in its response, SERVER_HELLO? Is it OK?

Answer 1

From RFC 5246, section 7.4.1.3:

The server may return an empty session_id to indicate that the session will not be cached and therefore cannot be resumed.

So yes, the server may return a session ID of length 0. This is allowed. Note that the server may also send a bunch of random bytes and simply refuse to resume any session; the overall effect would be identical.