[CXF-2976] Allow to configure SSL session cache size and TTL on the client

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.2.6, 2.2.7
• Fix Version/s: 2.3
• Component/s: Transports

Environment

Windows/Linux, jdk1.6

• Estimated Complexity: Moderate
• Assignee: Freeman Yue Fang
• Reporter: Grzegorz Mucha
• Created: 07/Sep/10 08:38
• Updated: 11/Oct/10 15:08
• Resolved: 09/Sep/10 06:39

Description

JDK SSL connectivity maintains a cache of SSLSessions that it reuses for subsequent connection. Unfortunately the default TTL in this cache is set to 24h. We have ran into an issue with a specific environment setup on the server side - with a F5 loadbalancer doing SSL offloading, the SSL sessions were valid on the load balancer but were broken beyond that point. The problem turned out the TTL of that cache being too long - in our case tuning it down to 60 seconds resolved the issue. FWIW we have actually encountered this issue with multiple vendors.

The timeout can be configured via SSLSession.getClientSessionContext().setSessionTimeout(int) - the suggestion is to add this parameter to be configured via TLSClientParams. Unfortunately the only way that the SSLSession is now accessed/configured is inside HttpsURLConnectionFactory - and this class is right now tightly coupled to a HttpConduit. There isn't actually a way to set the default TTL - or set it globally in the JVM