SSL_CTX_SET_TIMEOUT(3ossl)

💅 SSL_CTX_SET_TIMEOUT (3ossl) — session cache timeouts, bestie edition

okay so this is one of those pages from the OpenSSL manual, section 3ossl — yes, the whole page is literally just about how long a session gets to live before it's old news. and honestly? it's giving underrated. let's go ✨

---

🌸 NAME 🌸

SSL_CTX_set_timeout, SSL_CTX_get_timeout — manipulate timeout values for session caching 🕰️

---

🎀 SYNOPSIS 🎀

#include <openssl/ssl.h>

long SSL_CTX_set_timeout(SSL_CTX *ctx, long t);
long SSL_CTX_get_timeout(SSL_CTX *ctx);

---

💖 DESCRIPTION 💖

okay so SSL_CTX_set_timeout() sets the timeout for newly created sessions for ctx to t. and t? must be given in seconds, no cap, no exceptions. ⏱️

and SSL_CTX_get_timeout() just returns the currently set timeout value for ctx. that's it. that's the whole function. icon behavior honestly. 🫶

---

✨ NOTES ✨

so here's the tea ☕ — whenever a new session is created, it gets assigned a maximum lifetime. this lifetime is specified by storing two things: the creation time of the session, and the timeout value valid at that time. and if the actual time is later than creation time plus timeout? the session is not reused. bye bestie 👋

due to this realization (their word, not mine), all sessions behave according to the timeout value valid at the time of the session negotiation. so changing the timeout value does not affect already established sessions. no retroactive glow-ups. 😭

the expiration time of a single session can be modified using the SSL_SESSION_get_time(3) family of functions. one little session, one little tune-up. 💅

expired sessions get removed from the internal session cache whenever SSL_CTX_flush_sessions(3) is called — either directly by the application, or automatically (see SSL_CTX_set_session_cache_mode(3)). very "the trash takes itself out" of it. 🗑️

the default value for session timeout is decided on a per protocol basis — see SSL_get_default_timeout(3). but plot twist: all currently supported protocols have the same default timeout value of 300 seconds. iconic of them to agree for once. 🤝

this timeout value is also used as the ticket lifetime hint for stateless session tickets. and it's also used as the timeout value within the ticket itself. double duty, main character energy. 👑

for TLSv1.3, RFC8446 limits transmission of this value to 1 week (604800 seconds). so no, you can't make it eternal, bestie, the RFC said no. 💀

for TLSv1.2, tickets generated during an initial handshake use the value as specified. but tickets generated during a resumed handshake have a value of 0 for the ticket lifetime hint. lowkey a vibe shift, highkey documented behavior. 🙈

---

🔥 RETURN VALUES 🔥

• SSL_CTX_set_timeout() returns the previously set timeout value. yes, it's a glow-up reveal — it shows you what it used to be. ✨
• SSL_CTX_get_timeout() returns the currently set timeout value. straightforward, no games. 💜

---

🦋 SEE ALSO 🦋

ssl(7), SSL_CTX_set_session_cache_mode(3), SSL_SESSION_get_time(3), SSL_CTX_flush_sessions(3), SSL_get_default_timeout(3)

like, go read these too. iykyk 📚

---

🌈 COPYRIGHT 🌈

Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page, bestie 🎀 this little beauty is from OpenSSL 3.5.6, dated 2026-04-07 — so yeah, fresh-ish, legally licensed, and fully documented. go set some timeouts. slay. 💅🌸