SSL Cache Timeout

Nevermind, what you said plus what is in SOL6767 answers my questions. I think what we see is complicated by the middleware that we run that accesses client certs on smart cards. It has a pin timeout of its own. It appears that if it has timed out before the Big IP forces renegotiation IE is unable to access the client cert and so sends no cert in the handshake. Then our users get redirected to the client cert required page in the middle of an active session. I'll do some testing to verify that theory tomorrow. If that's the case we'll probably have to either set the cache timeout to indefinite or at least make it longer than our typical users average session.