https://wiki.openssl.org/index.php/SSL_and_TLS_Protocols : Session Resumption


the protocol provides ways to reuse existing credentials to reissue new secret keys for new connections ( new TCP connections ) or to renew existing connections.

As per OpenSSL wiki: we can re-issue the secret key which was derived from master secret using session resumption.

I use session ticket-based session resumption. How can I re-issue the secret keys from the existing credentials?

1 Answer 1


I think you can't

I'm not sure. But I think if you resume, then you're stuck with the old keys. If you want to rekey, then do one of these things:

This bit sounds interesting. But I don't really understand it. Sounds like you could sort of do a "rekey-lite":

Liberally reformatted from the Client Hello section of the TLS 1.2 RFC:

The ClientHello message includes a variable-length session identifier.

If not empty, the value identifies a session between the same client and server whose security parameters the client wishes to reuse. The session identifier MAY be from

  1. an earlier connection,
  2. this connection, or
  3. from another currently active connection.


  • The second option is useful if the client only wishes to update the random structures and derived values of a connection, and
  • the third option makes it possible to establish several independent secure connections without repeating the full handshake protocol.
  • Thanks @StackzOfZtuff. I will look into that.. Yes, i want to resume the session with Session Ticket and Session ID with new secret key.. that's my goal. Jan 11, 2017 at 8:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .