[FIXED] How does SSL session caching and expiry works

Issue

In order to understand how connection is established in rest web service, I am learning about handshakes (TCP & SSL).

I am trying to figure out about the additional overheads with respect to time when it comes to SSL handshaking and TCP Handshaking.

So what I know is that SSL Handshaking happens over TCP layer. And TCP layer communication again happens using TCP Handshaking.

So lets say first TCP handshaking happens, and then there must be some time for which that handshake remains valid.

So in this, SSL handshake happens, so that also must have some validity and expiry.

So how does this connection breaks. Due to TCP session expiry.

How do I identify the default timings for these session validity and can they be updated?

I might be asking wrong questions as well. These questions I had in my mind based on my limited understanding of TCP protocol and SSL.

Any guidance is appreciated.

Solution

.. there must be some time for which that handshake remains valid.

There is no such thing as an expiration for the TCP or SSL handshake. A TCP connection ends with a explicit TCP shutdown (i.e. packet with FIN flag) and similar a SSL "connection" is properly finished with an explicit SSL shutdown (i.e. "SSL shutdown alert"). As long as nothing is explicitly closed it is considered open.

Answered By - Steffen Ullrich

Answer Checked By - David Goodson (PHPFixing Volunteer)