I know that most browsers nowadays support around 6 concurrent TCP sessions per hostname, to perform multiple requests at the same time.

For sites which utilise SSL, is there a separate handshake performed for each TCP session, or is a single SSL handshake performed, with the resulting symmetric key being reused for each concurrent TCP session?

  • This isn't a security question, it's a protocol question. You should be asking over in StackOverflow. Jan 6, 2015 at 2:17
  • @SteveSether While that may be true, I'm inclined to believe that people who have questions about SSL that aren't code-related will come here. In fact, this question would probably be closed on SO. SuperUser might be the better place? It's a gray-area question... Jan 8, 2015 at 0:27
  • SO is really limited then if they'd reject that question. It really needs to be broken out into multiple groups. There really needs to be a web development group specifically for the web. Jan 8, 2015 at 2:24

1 Answer 1


Each new connection does a separate TCP handshake and a separate TLS handshake. But if there is an existing SSL session they will try to reuse it, so all but the first connection to a server only do an abbreviated handshake if the server supports session reuse. In case of session reuse no key exchange is performed, that is the same symmetric key is re-used. See also How does SSL/TLS work?.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .