Spring boot 2 tomcat ssl handshake caching

user_980515 0
Viewed 417

with nginx is possible to cache the ssl handshake like this (https://docs.nginx.com/nginx/admin-guide/security-controls/terminating-ssl-tcp/):

ssl_session_cache     shared:SSL:20m;
ssl_session_timeout   4h;

Is it possible to do the same thing in SpringBoot 2 with Tomcat?

I'm asking because during our performance tests we see errors like the following (using Gatling):

 j.n.ConnectException: handshake timed out

If not is there any other options that can help me?
Thanks

spring-boot nginx tomcat ssl spring
1 Answers

Java's JSSE has already a default session cache of 20480 entries with an expiration of 24 hours.

If you want to change these values:

  • on a the global level you can set the system property javax.net.ssl.sessionCacheSize to the desired cache size (cf. customizing JSSE),
  • in an external Tomcat, you can use the properties sessionCacheSize and sessionTimeout of the <SSLHostConfig> element,
  • when you use the embedded Tomcat server, you can define a TomcatConnectorCustomizer, e.g.
@Component
public class SSLSessionCustomizer implements TomcatConnectorCustomizer {

   @Override
   public void customize(Connector connector) {
      for (final SSLHostConfig hostConfig : connector.findSslHostConfigs()) {
         hostConfig.setSessionCacheSize(40960);
         hostConfig.setSessionTimeout(2 * 24 * 60 * 60);
      }
   }
}

Remark: You can use openssl s_client -reconnect to test the session resumption. However in recent versions of Java, JSSE aborts session resumption if the TLS extension extended_master_secret is missing (cf. release notes). Older clients, like those based on OpenSSL 1.0 do not support this extension. If compatibility is important for you, you can set the system property:

jdk.tls.useExtendedMasterSecret=false
user_117484540
Related