Can s SSL server in response to 'CLIENT_HELLO' request choose a NULL value for the session ID in its response, SERVER_HELLO? Is it OK?
From RFC 5246, section 126.96.36.199:
So yes, the server may return a session ID of length 0. This is allowed. Note that the server may also send a bunch of random bytes and simply refuse to resume any session; the overall effect would be identical.