Configuring Ssl Session Cache Timeout; Configuring Ssl Session Handshake Renegotiation - Cisco 11503 - CSS Content Services Switch Configuration Manual

Chapter 6 Configuring SSL Initiation

Configuring SSL Session Cache Timeout

Configuring SSL Session Handshake Renegotiation

OL-5655-01
In SSL, every time a client and server go through a full key exchange and establish
a new master secret key, a new session is created. Enabling a session cache
timeout allows the reuse of the master key on subsequent connections by the
client. When you disable the cache timeout, the full SSL handshake must occur
on each new connection to the SSL module (the virtual client). Use the
backend-server number session-cache command to configure the SSL module to
resume connection with a back-end SSL server using a previously established
secret key.
By default, the cache timeout is enabled with a timeout of 300 seconds
(5 minutes). The timeout value can range from 0 to 72000 (0 seconds to 20 hours).
A timeout value of 0 disables the session cache reuse.
For example, to configure the SSL session cache timeout of 500 seconds, enter:
(config-ssl-proxy-list[ssl_list1])# backend-server 1 session-cache 500
To reset the session cache ID reuse to the default of enabled with a timeout of
300 seconds, enter:
(config-ssl-proxy-list[ssl_list1])# no backend-server 1 session-cache
To disable session cache ID reuse, enter a timeout value of 0 seconds:
(config-ssl-proxy-list[ssl_list1])# backend-server 1 session-cache 0
The SSL session handshake commands send the SSL HelloRequest message to a
client to restart SSL handshake negotiation. SSL rehandshake is useful when a
connection has been established for a lengthy period of time and you want to
ensure security by reestablishing the SSL session between the CSS and the
back-end SSL server.
Use the backend-server number handshake data kbytes command to force an
SSL rehandshake after the exchange of a certain amount of data between the CSS
and the back-end SSL server, after which the CSS transmits the SSL handshake
message and reestablishes the SSL session.
Configuring Back-End SSL Servers in an SSL Initiation Proxy List
Cisco Content Services Switch SSL Configuration Guide
6-11