mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-10-19 11:19:36 +00:00
Let a client resume its session with an OpenSSL mTLS server
Without a session id context, OpenSSL answers a client resuming its
session with a fatal alert once client certificates are verified, which
curl and browsers run into on their second connection. Set one on every
server context. A changed client CA still stops resumption, as fcf7568
flushes the cache and rotates the ticket keys.
This commit is contained in:
1 parent
489fe8e504
commit
a7fce92ed0
2 files changed
+90
-7
No files matched your search
@@ -19812,6 +19812,10 @@ inline ctx_t create_server_context() {
|
||||
SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION |
|
||||
SSL_OP_NO_RENEGOTIATION);
|
||||
SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
|
||||
// Without one, a client resuming its session is sent a fatal alert once
|
||||
// client certificates are verified.
|
||||
static const unsigned char sid_ctx[] = "cpp-httplib";
|
||||
SSL_CTX_set_session_id_context(ctx, sid_ctx, sizeof(sid_ctx) - 1);
|
||||
}
|
||||
return static_cast<ctx_t>(ctx);
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user