Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: disable tls-resumption for tls jobs #2073

Merged
merged 26 commits into from
Mar 14, 2025

Conversation

DeagleGross
Copy link
Contributor

For Kestrel disable is done via SslServerAuthenticationOptions.AllowTlsResume.

For http.sys I have added code to control it as netsh parameters:

> netsh http add sslcert help
        enablesessionticket: When set, TLS session ticket resumption is enabled.
        disablesessionid: When set, TLS session id resumption is disabled.

but due to underlying OS dependency, not all agents support it, so I am controlling resumption via registry settings of SChannel.

New-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\' -Name MaximumCacheSize -PropertyType DWord -Value 0 
New-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\' -Name ServerCacheTime -PropertyType DWord -Value 0
Restart-Service -Name Http -Force

Validation of TLS Resumption being turned off was done via openssl traces. In example

openssl s_client -connect 10.0.4.15:5000 -sess_out session13.pem -tls1_3
...
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
SSL-Session: // returned session-id and session-ticket
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: BA80...80B
Session-ID-ctx:
TLS session ticket:
0000 - 84 4a 00 00 ...

And for next request we can see still new tls handshake and another session-id and session-ticket:

openssl s_client -connect 10.0.4.15:5000 -sess_in session13.pem -tls1_3
...
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
SSL-Session:
Protocol : TLSv1.3
Cipher : TLS_AES_256_GCM_SHA384
Session-ID: 487C...633
TLS session ticket:
0000 - f1 43 00 00 ...

That confirms that even trying to reuse the same session from client side, we end up establishing new tls handshake.

@DeagleGross DeagleGross self-assigned this Mar 14, 2025
@DeagleGross DeagleGross merged commit 5e7eb42 into aspnet:main Mar 14, 2025
2 checks passed
@DeagleGross DeagleGross deleted the dmkorolev/tls/disable-resumption branch March 14, 2025 18:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant