3

I want to know if a HTTP server (Apache, nginx etc.) can access a SSL/TLS session ID. Assume we have some hardware which does only SSL/TLS and behind a webserver which sends and receives the requests. Can the webserver "see" the SSL session ID. If not, how is the connection between the HTTP requests and the SSL session handled?

2

Whether the SSL session identifier is made accessible, by your SSL hardware, to the rest of the server, is entirely up to the interface that this hardware offers.

A decent SSL hardware box should offer some kind of session management, so that the consumer (your Apache / nginx / whatever server behind the box) may know whether successive connections are from the same client (i.e. the client reconnected, offered to do an "abbreviated handshake", and the box accepted because it still remembers the SSL session parameters). How this session management is offered is up to the box; it may or may not use the same "session identifiers" as what is exchanged in the SSL handshake (in the ClientHello and ServerHello messages). You will have to use to documentation for that box.

If the hardware does not offer session management of any kind, then it is junk and you should switch vendors.

1

NGiNX
SSL Session ID available in $ssl_session_id variable.

Other NGiNX SSL variables can be found here, Embedded Variables section.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.