LIBRESSL-TLS_CONFIG_SET_SESSION_ID(3)

📦 version 4.4.0, in alpine 3.24, arch rolling

💅 tls_config_set_session_fd, tls_config_set_session_id, tls_config_set_session_lifetime, tls_config_add_ticket_key 💅

okay bestie so this is a page from the Library Functions Manual, and it's literally all about making TLS handshakes resume instead of starting from scratch every single time. four functions, one glow-up, let's go ✨

🌸 NAME 🌸

tls_config_set_session_fd, tls_config_set_session_id, tls_config_set_session_lifetime, tls_config_add_ticket_key — configure resuming of TLS handshakes 🫶

🦋 SYNOPSIS 🦋

library “libtls” libssl libcrypto #include <tls.h>
int
tls_config_set_session_fd(struct tls_config *config, int session_fd);
int
tls_config_set_session_id(struct tls_config *config,
    const unsigned char *session_id, size_t len);
int
tls_config_set_session_lifetime(struct tls_config *config,
    int lifetime);
int
tls_config_add_ticket_key(struct tls_config *config, uint32_t keyrev,
    unsigned char *key, size_t keylen);

✨ DESCRIPTION ✨

okay so there's four little functions here and each one handles a different part of session resuming. no cap, they're all doing their own thing 💖

🎀 tls_config_set_session_fd()

this one sets a file descriptor that's used to manage the data for TLS sessions — client only btw, just so we're clear.

the file descriptor you hand over has to be a regular file, and it must be owned by the current user, and its permissions have to be restricted so that only the owner can read and write it (0600). like, that's the vibe check and it's non-negotiable 🙈

if the file has a non-zero length, the client will try to read session data out of it and resume the previous TLS session with the server. and then upon a successful handshake, the file gets updated with the current session data — if available. slay 🔥

the caller is responsible for closing this file descriptor, but only after all the TLS contexts that have been configured to use it have been freed via tls_free(). don't be out here closing it early, bestie, that's not the move 💀

🦋 tls_config_set_session_id()

this one sets the session identifier that the TLS server will use when sessions are enabled — server only.

by default a random value is used. cute, automatic, iconic 👑

🌸 tls_config_set_session_lifetime()

sets the lifetime that's used for TLS sessions — server only again.

now listen: session support is disabled if you specify a lifetime of zero, and zero is the default. so yeah, sessions are off until you say otherwise. that's just how it is 🫶

⭐ tls_config_add_ticket_key()

adds a key that's used for the encryption and authentication of TLS tickets — server only, you already know.

by default, keys are generated and rotated automatically based on their lifetime. this function should only be used to synchronise the ticket encryption key across multiple processes. that's its whole thing, no cap.

also heads up: re-adding a known key will result in an error — unless it's the most recently added key. so don't come in here re-adding old keys and acting surprised 😭

💜 RETURN VALUES 💜

these functions return 0 on success or -1 on error. short, simple, iconique ✨

🌈 SEE ALSO 🌈

🧚 HISTORY 🧚

tls_config_set_session_id(), tls_config_set_session_lifetime() and tls_config_add_ticket_key() appeared in OpenBSD 6.1.

tls_config_set_session_fd() appeared in OpenBSD 6.3.

glow-ups in stages, we love to see it 💅

👑 AUTHORS 👑

  • Claudio Jeker <claudio@openbsd.org>
  • Joel Sing <jsing@openbsd.org>

and that's the whole page, bestie!! this one's from Debian, dated July 7, 2025, and its page name is TLS_CONFIG_SET_SESSION_ID(3) — go forth and resume those handshakes responsibly, ily, bye 🎀🦋💖

📦 where this page comes from