What is the difference between SSL connection and SSL session?

This is what my lecture notes have to say which makes no sense to me (I am new to SSL):

SSL Connection:

  • A transient peer-to-peer communications link.
  • Each connection is associated with one SSL session.

SSL Session:

  • A session is an association between client and server.
  • It is created by the Handshake Protocol.
  • It defines a set of security parameters.
  • It may be shared by multiple SSL connections.
  • It is useful to avoid expensive negotiations of security parameters for each connection. Single session has many connections. Every connection has a different key

I tried googling it but the results didn't bring up anything useful.

The only thing I know is that a single SSL session can have multiple SSL connections.

Can someone explain to me in simple terms what the differences are?


In General:

A connection is a communication channel between a client and a server. For example: a TCP socket. Connections are usually short lived and servers are usually configured to timeout a connection if it is left idle for too long.

A session is a way of maintaining state on the server side. You can think of it as a memory chunk allocated on the server and this memory chunk is associated with a connection. Even if a connection dies, you can resume a session (using cookies in case of HTTP protocol).

You can read more about it in this whitepaper.

In context of SSL:

The same applies for SSL/TLS and for any other protocol. This is very well explained, in simple terms, in one of the results when you google it. Here you go:

Difference between connection and session is that connection is a live communication channel, and session is a set of negotiated cryptography parameters.

You can close connection, but keep session, even store it to disk, and subsequently resume it using another connection, may be in completely different process, or even after system reboot (of course, stored session should be kept both on the client and on the server).

On other hand, you can renegotiate TLS parameters and create entirely new session without interrupting connection.

| improve this answer | |
  • 1
    One might add that they refer to different levels of abstraction. The connection being the concrete entity, and the session being the time-bounded, temporal unit of context and continuity, by which you identify related work. – DTK Nov 29 '14 at 7:13
  • In addition to using a session for multiple connections separated in time -- although usually the endpoints impose a limit rarely more than a few hours -- you can also have multiple connections simultaneously "resuming" one session. Especially on today's web where a single page commonly requires tens to several hundreds of resources (HTTP transactions) browsers will commonly open and use several connections simultaneously. – dave_thompson_085 Nov 30 '14 at 5:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.