SSL Session 和 Session Tickets
背景
在对http和https性能比较的时候，可以发现http性能比https高出几个数量级。 因为https使用了tls/SSL协议，客户端与服务端进行ssl握手， 在握手的时候需要进行密钥协商，密钥交换，身份认证等过程，尤其是在 这中间必须要传递证书确定身份。
为了在安全和性能之间寻找一个平衡点，SSL Session 是解决这个问题的一个方法。 SSL Session的安全性是建立在必需要获取整个 Session ，只是获取明文传输的的 Session ID 是无法握手成功的，Session是缓存在客户端中，要窃取客户端的Session 是非常困难的。
SSLSessionTickets在apache中是默认开启的。如果需要关闭必须加上 SSLSessionTickets Off。
Client Server
ClientHello
(SessionTicket extension) -------->
ServerHello
(empty SessionTicket extension)
NewSessionTicket
[ChangeCipherSpec]
<-------- Finished
[ChangeCipherSpec]
Finished -------->
Application Data <-------> Application Data
测试session ticket重用
openssl s_client -connect host:port -sess_out session_file
openssl s_client -connect host:port -sess_in session_file
第一次访问的New session
New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 596B3F7202A4E299F7EACF4C73818ED048085DFEA6DF31780C225C5D3045DD9A
Session-ID-ctx:
Master-Key: E96BA7797E9415D0C052F5212BEC6F9D009877C277535CB7B121B091BF24AA1FA06FD2FABE9E59EDBA6499412CD404B1
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - a0 b1 ee 17 03 57 df 58-f0 fc 7e 34 8e f7 c1 13 .....W.X..~4....
0010 - 7a af d5 05 49 ea 1c 34-07 01 6e 08 f2 92 90 3f z...I..4..n....?
0020 - e0 82 f9 c3 5f 27 88 98-fc 2e d3 36 bf d0 71 c3 ...._'.....6..q.
0030 - c2 41 93 dd ac ba 80 15-9c 6f c2 07 ac 28 0f a7 .A.......o...(..
0040 - 3a 1a 0e 58 74 09 36 0b-ce fe 52 95 6b b6 f1 f7 :..Xt.6...R.k...
0050 - dd 75 b8 04 8e ae 08 65-c5 e0 bb 49 0c f6 8a 9f .u.....e...I....
0060 - 51 f1 36 44 35 a3 1d 07-dd 3a 48 63 4a e7 74 a4 Q.6D5....:HcJ.t.
0070 - c5 3e 0a 1e 5a fd 10 66-18 0f ae e2 c0 87 77 3c .>..Z..f......w<
0080 - 32 73 68 12 4e 89 76 aa-0f c3 99 90 96 36 2a 40 2sh.N.v......6*@
0090 - d2 60 a6 6d 8d da a6 46-13 16 89 56 a0 28 f1 2c .`.m...F...V.(.,
00a0 - 9c 7d 21 df 05 b6 1e 7c-99 cb 7b 5a a8 97 f3 72 .}!....|..{Z...r
00b0 - ba 1d 6d 7e a3 99 bc 4b-a8 81 a6 7a b9 e3 9e d4 ..m~...K...z....
Start Time: 1490175208
Timeout : 300 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
使用session访问
Reused, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES256-GCM-SHA384
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1.2
Cipher : ECDHE-RSA-AES256-GCM-SHA384
Session-ID: 596B3F7202A4E299F7EACF4C73818ED048085DFEA6DF31780C225C5D3045DD9A
Session-ID-ctx:
Master-Key: E96BA7797E9415D0C052F5212BEC6F9D009877C277535CB7B121B091BF24AA1FA06FD2FABE9E59EDBA6499412CD404B1
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
TLS session ticket lifetime hint: 300 (seconds)
TLS session ticket:
0000 - a0 b1 ee 17 03 57 df 58-f0 fc 7e 34 8e f7 c1 13 .....W.X..~4....
0010 - 7a af d5 05 49 ea 1c 34-07 01 6e 08 f2 92 90 3f z...I..4..n....?
0020 - e0 82 f9 c3 5f 27 88 98-fc 2e d3 36 bf d0 71 c3 ...._'.....6..q.
0030 - c2 41 93 dd ac ba 80 15-9c 6f c2 07 ac 28 0f a7 .A.......o...(..
0040 - 3a 1a 0e 58 74 09 36 0b-ce fe 52 95 6b b6 f1 f7 :..Xt.6...R.k...
0050 - dd 75 b8 04 8e ae 08 65-c5 e0 bb 49 0c f6 8a 9f .u.....e...I....
0060 - 51 f1 36 44 35 a3 1d 07-dd 3a 48 63 4a e7 74 a4 Q.6D5....:HcJ.t.
0070 - c5 3e 0a 1e 5a fd 10 66-18 0f ae e2 c0 87 77 3c .>..Z..f......w<
0080 - 32 73 68 12 4e 89 76 aa-0f c3 99 90 96 36 2a 40 2sh.N.v......6*@
0090 - d2 60 a6 6d 8d da a6 46-13 16 89 56 a0 28 f1 2c .`.m...F...V.(.,
00a0 - 9c 7d 21 df 05 b6 1e 7c-99 cb 7b 5a a8 97 f3 72 .}!....|..{Z...r
00b0 - ba 1d 6d 7e a3 99 bc 4b-a8 81 a6 7a b9 e3 9e d4 ..m~...K...z....
Start Time: 1490175208
Timeout : 300 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
session-id 重用测试
openssl s_client -connect host:port -reconnect
New, TLSv1/SSLv3, Cipher is AES256-SHA
Server public key is 2048 bit
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID: 405763BDF7B0AFC42E44F865DFCB277167E347CCC393B374544671FC161570D5
Session-ID-ctx:
Master-Key: 566E880A4F167098ECFE1EC4230B4BF7A932211DBDE24033976C90BCA7D04813457E7D395D2FEF19B12175181C070C55
Key-Arg : None
Start Time: 1490175819
Timeout : 300 (sec)
Verify return code: 19 (self signed certificate in certificate chain
---
drop connection and then reconnect
CONNECTED(00000003)
---
Reused, TLSv1/SSLv3, Cipher is AES256-SHA
SSL-Session:
Protocol : TLSv1
Cipher : AES256-SHA
Session-ID: 405763BDF7B0AFC42E44F865DFCB277167E347CCC393B374544671FC161570D5
Session-ID-ctx:
Master-Key: 566E880A4F167098ECFE1EC4230B4BF7A932211DBDE24033976C90BCA7D04813457E7D395D2FEF19B12175181C070C55
Key-Arg : None
Start Time: 1490175819
Timeout : 300 (sec)
Verify return code: 19 (self signed certificate in certificate chain)
---
refer:openssl cookbook