SSL_CTX_FLUSH_SESSIONS(3ossl)

📦 version 3.5.0, in opensuse-leap 16.0

💅✨ SSL_CTX_FLUSH_SESSIONS — the "yeet the expired sessions" page

okay so bestie, you're on SSL_CTX_FLUSH_SESSIONS(3ossl) and honestly? this one's short, it's sweet, and it's about cleaning up your session cache before it turns into a hoarder situation. let's get into it 🎀

🌸 NAME

SSL_CTX_flush_sessions_ex, SSL_CTX_flush_sessions — remove expired sessions. that's it, that's the whole job. you call them, they go through the cache, expired sessions get evicted. iconic behavior honestly 👑

✨ SYNOPSIS

#include <openssl/ssl.h>

void SSL_CTX_flush_sessions_ex(SSL_CTX *ctx, time_t tm);

okay so here's where it gets a little messy. the following functions have been deprecated since OpenSSL 3.4, and you can hide them entirely by defining OPENSSL_API_COMPAT with a suitable version value — see openssl_user_macros(7) for the deets:

void SSL_CTX_flush_sessions(SSL_CTX *ctx, long tm);

like… she served her purpose, but she's retired now. periodt. 💀

🦋 DESCRIPTION

SSL_CTX_flush_sessions_ex() causes a run through the session cache of ctx to remove sessions expired at time tm. that's the whole vibe: you hand it a context and a timestamp, it goes shopping through the cache and clears out everything that's passed its expiry. lowkey satisfying 🌈

SSL_CTX_flush_sessions() is an older variant of the function that is not Y2038 safe — and the reason is literally that it uses the long datatype instead of time_t. so yeah. she's cute but she's not surviving the year 2038. do with that what you will 🙈

ngl, if you're writing new code, _ex is the main character here. the plain one is deprecated since OpenSSL 3.4, so like… noted. 💅

🧚 NOTES

so here's the lore 🍓 — if it's enabled, the internal session cache will collect all sessions established up to the specified maximum number (peep SSL_CTX_sess_set_cache_size() for that one). and since sessions will not be reused once they're expired, they should be removed from the cache to save resources.

and you've got two ways to handle that:

  1. automatically — whenever 255 new sessions were established (see SSL_CTX_set_session_cache_mode(3))
  2. manually — by calling SSL_CTX_flush_sessions_ex()

pick your fighter, both are valid 💖

the parameter tm specifies the time which should be used for the expiration test. in most cases the actual time given by time(0) will be used — that's your "right now, bestie" timestamp ⏰

and one detail you cannot skip: SSL_CTX_flush_sessions_ex() will only check sessions stored in the internal cache. when a session is found and removed, the remove_session_cb is however called to synchronize with the external cache (see SSL_CTX_sess_set_get_cb(3)). so the internal cache does the work, but the callback keeps your external cache in the loop. teamwork, fr fr 🤝

🫶 RETURN VALUES

SSL_CTX_flush_sessions_ex() does not return a value. nothing. void. she simply does the thing and leaves. no notes 👑✨

🔥 SEE ALSO

iykyk, go read those next 💜

⭐ HISTORY

SSL_CTX_flush_sessions_ex() was added in OpenSSL 3.4. newer function, fresher energy, we stan 🌸

Copyright 2001-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page!! 💖 this was version 3.5.0, dated 2026-09-25, and yes the date is in the future, don't @ me, that's literally what the footer said 🫶 go flush those sessions bestie, your cache will thank you ✨🌷

📦 where this page comes from