I know that most browsers nowadays support around 6 concurrent TCP sessions per hostname, to perform multiple requests at the same time.

For sites which utilise SSL, is there a separate handshake performed for each TCP session, or is a single SSL handshake performed, with the resulting symmetric key being reused for each concurrent TCP session?

  • This isn't a security question, it's a protocol question. You should be asking over in StackOverflow. – Steve Sether Jan 6 '15 at 2:17
  • @SteveSether While that may be true, I'm inclined to believe that people who have questions about SSL that aren't code-related will come here. In fact, this question would probably be closed on SO. SuperUser might be the better place? It's a gray-area question... – Chris Cirefice Jan 8 '15 at 0:27
  • SO is really limited then if they'd reject that question. It really needs to be broken out into multiple groups. There really needs to be a web development group specifically for the web. – Steve Sether Jan 8 '15 at 2:24

Each new connection does a separate TCP handshake and a separate TLS handshake. But if there is an existing SSL session they will try to reuse it, so all but the first connection to a server only do an abbreviated handshake if the server supports session reuse. In case of session reuse no key exchange is performed, that is the same symmetric key is re-used. See also How does SSL/TLS work?.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.