0

Is using the source IP address in generating the session ID by servers common? I've seen this behavior with a banking website. You visit the website with IP 1.1.1.1, SSL session is generated and used by the browser for SSL session resumption. Now if your IP changes to 1.1.1.2, and if you just refresh the page, the browser will error out. Firefox will complain about BAD_RECORD_MAC, chrome will just say ssl error. I still don't understand exactly why this happens, because according to the RFC if the session is not recognized a full handshake should be initiated but here everything just fails.

Using firefox with ssl session identifiers disabled doesn't have this problem which is why I think the server is using the source IP to create the session.

  • You title seems to ask about a failed SSL handshake. The body of your question instead starts with the question if binding the source IP to the TLS session is common - which is a different question than in the title. You then provide some indicators that changing source IP causes handshake errors. But unfortunately you neither provide sufficient information to be sure that it is really really the cause of your problem nor you provide enough information to let others reproduce it. Please fix your question so that others can actually help you with your problem. – Steffen Ullrich Feb 9 at 6:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.