Does a browser tab that opens multiple SSL-secured TCP sockets to the same server use the same session ID and keys for those sockets? I’ve seen pages served using HTTP open 5 or 6 sockets at the same time to concurrently load multiple resources such as javascript, css & image files, and I assume pages served with HTTPS do the same.

Browsers try to reuse the same TLS session for multiple TCP connections to the same server. But if this is possible depends on the server: if the server does not support session reuse a full handshake need to be done for each new TLS connection.

Browsers try to reuse the same TLS session for multiple TCP connections to the same server. But if this is possible depends on the server: if the server does not support session reuse a full handshake need to be done for each new TLS connection.

Edit: This answer cuts across multiple issues without answering the question posed. It is true that browsers use "Connection: Keep alive" to keep sockets open to reduce overhead. It's also true that browsers use "socket pooling" to minimize the number of concurrent connections to a given server, and that TLS uses a Session-Id to avoid repeating the initial handshake that sets up a secure session.

It does not follow from any of this, however, that the multiple sockets a browser uses in concurrent TLS connections to the same server use the same Session keys. A vendor used WireShark to monitor such a connection for me after I posted this question and reports that each of the 6 sockets Chrome opened to the same server used different Session Ids, which suggests that Chrome may not.

But I'm searching for a definitive answer, preferably in the HTTP standard.

Thanks for your answer, nonetheless.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.