-
Notifications
You must be signed in to change notification settings - Fork 819
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
TLS session tickets broken in ATS 7 #1943
Comments
I assume that you are sharing ticket keys between firstmachine and secondmachine? Can you share your ssl_multicert.config file? Persia is having a hard time reproducing the issue. |
Turns out the behavior has changed with ATS 7. The session ticket is no longer controlled by ssl_multicert. Instead, its in records.config: We need to update our documentation for this. |
Yes. I will remove the field for ticket key from ssl_multicert and update the docs. The documentation on proxy.config.ssl.server.ticket_key.filename is in |
Oh -- this is a pretty big pain to rotate keys now -- now, you have to change the filename string in records.config to rotate. Before, ssl_multicert would get reloaded pretty frequently, and as a result, just changing the file contents of the ticket would get picked up. Now, if you change the file content and reload configs, ATS won't realize the ticket file has changed, and thus won't reload. |
@mlibbey Can you file a Github issue on this? Or should we keep / change this Issue to an RFE for better config reload ? |
In ATS 6, TLS session tickets worked (ticket_key_name in ssl_multicert). It appear broken in 7.0 and 7.1.
Here's 2 machines with ATS6.1:
(the thing to look for is the "read 142 bytes" -- that its much smaller in the 2nd response.
In ATS 7.0 and 7.1
The read bytes is equal for both the 1st and 2nd machine (and details about the cert are written out twice).
The text was updated successfully, but these errors were encountered: