What is SSL Session resumption and can we disable it on the server side or it is just the client side can do it?


Session resumption essentially means to continue with an already established TLS session, i.e. where the certificate was checked, the common cipher determined and the key exchange was done. The idea behind this is similar to a session cookie in HTTP which is used to continue with an already existing session instead of requiring the client to login again and again.

And similar to a HTTP cookie a server might simply not support (or has it disabled) session resumption in which case it will not provide such a session "cookie" (i.e. session id or session ticket in TLS) and the client has to do a full handshake every time. And the client might also not send a previously provided session id or session ticket back to the server in which case also a full handshake need to be done.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.