Forum Discussion

Neihls_298286's avatar
Neihls_298286
Icon for Nimbostratus rankNimbostratus
Oct 11, 2017

SSL Server Profile - Always Send Null Session ID in Client Hello

I have a VirtualServer accepting TCP connections, with a server-side TLS connection to a media pool member. I'd like the F5 to send TLS Client Hello with a Null Session ID every time it tries to open a new server-side connection. Instead, it often offers an old SSL session id and my server sometimes simply sends TCP FIN if it doesn't recognize the SSL Session ID from the Client Hello.

 

If this were a Client SSL Profile, I could use the option "No session resumption on renegotiation". I can't find a similar option for the SSL Server Profile.

 

Any ideas?

 

application delivery
BIG-IP
LTM

2 Replies

Sort By
  • John_Beckmann's avatar
    John_Beckmann
    Icon for Employee rankEmployee
    Nov 29, 2018

    Just set the SSL Session "Cache Size" to 0 and it will always set the Session ID to 0, as the cache is disabled. Or reduce the Cache Timeout. Default is 3600 seconds, so just make it lower than the timeout on the backend server.