1

In my setup I am using client certs, and the client devices are iPhones running iOS 9.0.

In comparing some network traces I noticed that in some cases, the server asks for the client certificate for the first time, and then for all future connections (at least within the next minute) it will not ask for it again. After the first connection I will just see "Server Hello, Change Cipher Spec, Finished", where for the initial case I will the proper back and forth which involves transferring the server and well as the "RSA Encrypted PreMaster Secret".

However with some other clients (which have a different version of the software which handles the SSL) I see that the server will frequently ask the client again and again for the client Cert.

Which is these behaviors is correct and what elements determine whether the Server decides to ask same client (based IP address) again for the client cert?

2

SSL/TLS supports a performance optimization called session resumption. It allows you to continue a previous connection, reducing the standard 5 messages

enter image description here

down to 3 messages

enter image description here

(image from Vincent Berat's blog)

For session resumption to work, you need both a server and client that support this functionality. From your description, it sounds like your server and some of your clients support session resumption, while other clients don't. Note that just because both the client and server support session resumption, it doesn't mean it will happen. The client and/or the server may decide to free up the resources used to hold session resumption information for any reason. If they do this, a full TLS handshake will be required if there is further communication.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.