We have a server which supports TLS ticket based stateless session resumption. However, when I connect to the server using openssl s_client, I still see a session ID being generated along with the TLS ticket. What is the significance of this session ID and can it be used to resume the session?
What is the significance of this session ID and can it be used to resume the session?
You always get an ID.
You may establish more than one session with a server. The ID tells them apart. It's basically an index into a table where the server will find all necessary keys/etc. for that session.
The client can TRY session resumption by supplying the old ID during the handshake. But the server can just ignore that attempt and issue a new ID instead. Which is just what happens when that particular ID has expired from the server's ID table (session cache). It doesn't cost the client anything extra to try resumption.
Update 1. Empty IDs
I don't really understand this. Maybe some SE-user can expand on this.
I don't really understand the interaction when both IDs and Tickets are enabled. So I decided to read that section in my copy of "Bulletproof SSL and TLS":
(quote is from Chapter 2. Protocol | Extensions | Session Tickets)
When a server decides to use session tickets for session resumption, it sends back an empty session ID field (in its
ServerHellomessage). At this point, the session does not have a unique identifier. However, the ticket specification allows the client to select and submit a session ID (in its
ClientHello) in a subsequent handshake that uses the ticket. A server that accepts the ticket must also respond with the same session ID. This is why the session ID appears in the TLS web server logs even when session tickets are used as the session-resumption mechanism.
And having read this, now I'm not so sure anymore that I actually understand the concept of the session ID.
Anyway, the relevant section from the session ticket RFC is 3.4. Interaction with TLS Session ID.
And this seems to say that session IDs either don't exist or don't matter when tickets are in use. Dunno.