Let a client resume its session with an OpenSSL mTLS server

Without a session id context, OpenSSL answers a client resuming its
session with a fatal alert once client certificates are verified, which
curl and browsers run into on their second connection. Set one on every
server context. A changed client CA still stops resumption, as fcf7568
flushes the cache and rotates the ticket keys.
This commit is contained in:
yhirose committed 2026-10-16 21:38:40 -04:00
1 parent 489fe8e504
commit a7fce92ed0
2 files changed
+90 -7

No files matched your search

+4
View File
@@ -19812,6 +19812,10 @@ inline ctx_t create_server_context() {
SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION |
SSL_OP_NO_RENEGOTIATION);
SSL_CTX_set_min_proto_version(ctx, TLS1_2_VERSION);
// Without one, a client resuming its session is sent a fatal alert once
// client certificates are verified.
static const unsigned char sid_ctx[] = "cpp-httplib";
SSL_CTX_set_session_id_context(ctx, sid_ctx, sizeof(sid_ctx) - 1);
}
return static_cast<ctx_t>(ctx);
}