[trafficserver] branch master updated: Session ticket resumption needs consistent CA-certificate version

[ml...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

mlibbey pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/trafficserver.git


The following commit(s) were added to refs/heads/master by this push:
     new 7c05be8  Session ticket resumption needs consistent CA-certificate version
7c05be8 is described below

commit 7c05be8f1a2c0eb7b8a46882ac2abb92b8f62642
Author: Miles Libbey <ml...@apache.org>
AuthorDate: Mon Aug 14 15:22:19 2017 -0700

    Session ticket resumption needs consistent CA-certificate version
    
    OpenSSL session tickets are sensitive to the version of the
    ca-certificates OEL/RHEL package.
    
    We had ~200 machines with 1 version of ca-certificates-... , and the
    rest with another version. Sessions generated with the “old”
    ca-cerficates do not resume with the newer CAs (and vice versa). Hoping
    other can avoid this confusion with this note.
---
 doc/admin-guide/files/records.config.en.rst | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/admin-guide/files/records.config.en.rst b/doc/admin-guide/files/records.config.en.rst
index 939d17d..933a8fc 100644
--- a/doc/admin-guide/files/records.config.en.rst
+++ b/doc/admin-guide/files/records.config.en.rst
@@ -3133,7 +3133,8 @@ SSL Termination
 
    The filename of the default and global ticket key for SSL sessions. The location is relative to the
    :ts:cv:`proxy.config.ssl.server.cert.path` directory. One way to generate this would be to run
-   ``head -c48 /dev/urandom | openssl enc -base64 | head -c48 > file.ticket``.
+   ``head -c48 /dev/urandom | openssl enc -base64 | head -c48 > file.ticket``. Also
+   note that OpenSSL session tickets are sensitive to the version of the ca-certificates.
 
 .. ts:cv:: CONFIG proxy.config.ssl.max_record_size INT 0
 

-- 
To stop receiving notification emails like this one, please contact
['"commits@trafficserver.apache.org" <co...@trafficserver.apache.org>'].