What is TLS session resumption?

Short answer

TLS session resumption is a previously connected client continuing its previous session without performing a full handshake; it reduces the computational cost and the latency of the handshake. There are two methods: returning to the session record kept by the server with a session ID, or presenting back the encrypted session ticket that the server gave the client. In TR7, while Restart Undefined TLS Requests in the TLS Security Profile is on (it is on in the Default Profile and in a new profile), session tickets are not used and resumption is performed with the session record kept on the server side; the ratio of resumed sessions is monitored on the SSL tab of the vService Dashboard, in the SSL Session Reuse panel.

Where It Is Used in TR7

Where	Field / label	What for
Certificates & PKI → TLS Security Profiles → Frontend-only Settings	Restart Undefined TLS Requests	Turning off session tickets while it is on; resumption only with the session record on the server side. The setting is not present as a column in the profile list; it is seen in the preview
vService → Dashboard → SSL tab	SSL Session Reuse	The percentage of SSL sessions resumed from the cache
vService → Dashboard → SSL tab	SSL New Connections (TPS)	The number of new SSL connections per second

How Does It Work?

• Session ID: The server keeps the session parameters in its own cache and gives the client an identifier; the client sends this identifier in the next connection.
• Session ticket: The server encrypts the session parameters with its own key and gives them to the client (RFC 5077); no record is kept on the server side.
• TLS 1.3: Resumption is performed with the PSK (pre-shared key) given in the previous connection (RFC 8446).

Common Misconceptions

• "Session resumption weakens TLS security." Resumption does not change the encryption; it only shortens the full handshake.
• "A session cannot be resumed while session tickets are off." Even while Restart Undefined TLS Requests is on, resumption is performed with the session record on the server side.
• "If the SSL Session Reuse ratio is high, there is no handshake load." The ratio shows only the resumed sessions; each new client still performs a full handshake (What is the TLS handshake?).

How it is done in the documentation

• TLS Security Profiles · Restart Undefined TLS Requests
• Dashboard · SSL Session Reuse

Related questions

• What is the TLS handshake?
• What is a TLS Security Profile, and what does it configure?
• What is SSL offloading (termination), and how is it set up?