With OpenSSL 1.1.0 I can no longer copy SSL_SESSION from one client-side connection to another
Pseudo-code:
ctx = SSL_CTX_new(TLSv1_2_method())
ssl1 = SSL_new(ctx)
// connect and perform handshake
sess = SSL_get1_session(ssl1);
SSL_shutdown(ssl1)
SSL_free(ssl1)
ssl2 = SSL_new(ctx)
SSL_set_session(ssl2, sess)
// connect and perform handshake
This approach works perfectly fine in OpenSSL 1.0.2 and earlier. I'm using it in my patch for Python 3.6
https://bugs.python.org/issue19500. With OpenSSL 1.1.0 the feature is broken. Wireshark shows that the second connection does not send a session id and session id length of 0. PyOpenSSL is also affected, pyca/pyopenssl#528
Session resumption works correctly when I either
- delay or omit SSL_free() calls
- dump the session with PEM_write_bio_SSL_SESSION and reload it with PEM_read_bio_SSL_SESSION.
As soon as I use SSL_set_session(ssl, NULL) or SSL_free(ssl) with an SSL object, its session can no longer be used to resume another client session.
With OpenSSL 1.1.0 I can no longer copy SSL_SESSION from one client-side connection to another
Pseudo-code:
This approach works perfectly fine in OpenSSL 1.0.2 and earlier. I'm using it in my patch for Python 3.6
https://bugs.python.org/issue19500. With OpenSSL 1.1.0 the feature is broken. Wireshark shows that the second connection does not send a session id and session id length of 0. PyOpenSSL is also affected, pyca/pyopenssl#528
Session resumption works correctly when I either
As soon as I use SSL_set_session(ssl, NULL) or SSL_free(ssl) with an SSL object, its session can no longer be used to resume another client session.