Forum Discussion
NimbostratusSSL Server Profile - Always Send Null Session ID in Client Hello
I have a VirtualServer accepting TCP connections, with a server-side TLS connection to a media pool member. I'd like the F5 to send TLS Client Hello with a Null Session ID every time it tries to open a new server-side connection. Instead, it often offers an old SSL session id and my server sometimes simply sends TCP FIN if it doesn't recognize the SSL Session ID from the Client Hello.
If this were a Client SSL Profile, I could use the option "No session resumption on renegotiation". I can't find a similar option for the SSL Server Profile.
Any ideas?
Leonardo_SouzaCirrocumulus
Have a look at the options Unclean Shutdown and Strict Resume. I think this is the cause of the behaviour you have.
https://support.f5.com/csp/article/K14806
John_BeckmannEmployee
Just set the SSL Session "Cache Size" to 0 and it will always set the Session ID to 0, as the cache is disabled. Or reduce the Cache Timeout. Default is 3600 seconds, so just make it lower than the timeout on the backend server.