Usually, one SSL session is used by many connections. I was reading about SSL while I encountered something interesting. It said that:

In theory, it may also be possible that multiple sessions are shared by a single connection.

I tried to look more about this online but, was not able to find something good enough to explain how, when and why this can be done.
It also said that this feature is not used in practice.

If it is not used then why was it allowed in the first place?
How can multiple sessions be used in a single connection in SSL and what is its significance?


In theory, it may also be possible that multiple sessions are shared by a single connection.

This is true, but not at the same time. Instead an active SSL session inside the connection can be replaced by a new session using renegotiation. Renegotiation is required if the sequence number of a TLS session would wrap (i.e. after 2^64-1 SSL frames) which is unlikely in practice. More common is a renegotiation of a session without client authentication to a session with client authentication (i.e. client certificate). This can happen in HTTPS if only some parts of the site require client authentication and the browser tries to access some URL which requires such authentication while already having an established connection.

Multiple SSL sessions after each other inside the same TCP connection can also happen if after the TCP connect there is an SSL handshake followed by an SSL shutdown later and then again an SSL handshake inside the same connection. While uncommon it can be done in FTPS where AUTH TLS is used to initiate an upgrade from plain TCP to TLS and CCC is used to initiate the downgrade from TLS to plain TCP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.