SSL_CTX_SET_TIMEOUT(3ossl)

💖 SSL_CTX_set_timeout, SSL_CTX_get_timeout — the session-cache timeout glow-up 💖

okay bestie, so this is from the OpenSSL 3ossl manual family, and it's literally just two lil functions that let you peek at and set how long sessions stay alive in the cache. no cap, that's the whole vibe.

---

✨ NAME ✨

SSL_CTX_set_timeout, SSL_CTX_get_timeout — manipulate timeout values for session caching 🎀

---

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

long SSL_CTX_set_timeout(SSL_CTX *ctx, long t);
long SSL_CTX_get_timeout(SSL_CTX *ctx);

---

🦋 DESCRIPTION 🦋

So SSL_CTX_set_timeout() sets the timeout for newly created sessions on ctx to t. And listen — t has to be in seconds. like, seconds, bestie, don't get cute with it. ⏱️

And SSL_CTX_get_timeout() just returns whatever timeout value ctx currently has set. that's it, that's the function. she's simple, she's iconic. 💅

---

👑 NOTES 👑

okay this is the part where you actually need to pay attention, so vibe check:

• Whenever a new session gets created, it's assigned a maximum lifetime. ✨
• This lifetime works by storing the creation time of the session plus the timeout value that was valid at that moment.
• If the actual current time is later than creation time + timeout, then the session is not reused. expired, goodbye, blocked. 💀

And because of how this is implemented, there's a really important consequence:

All sessions behave according to the timeout value valid at the time of the session negotiation. Changes of the timeout value do not affect already established sessions. 🔥

So if you change the timeout later, the sessions that already exist are like "not my problem, I was negotiated under the old rules." main character energy tbh.

If you wanna tweak the expiration time of a single session, you use the SSL_SESSION_get_time(3) family of functions. 🫶

Expired sessions get removed from the internal session cache whenever SSL_CTX_flush_sessions(3) is called — either directly by the application, or automatically (see SSL_CTX_set_session_cache_mode(3)). 🌈

The default value for the session timeout is decided on a per protocol basis, check SSL_get_default_timeout(3). And rn, all currently supported protocols have the same default timeout value of 300 seconds. ⭐

This timeout value is also used as the ticket lifetime hint for stateless session tickets. and yep, it's also used as the timeout value within the ticket itself. 🎀

Now, protocol-specific tea:

• For TLSv1.3, RFC8446 limits transmission of this value to 1 week (604800 seconds). so that's the ceiling, don't fight it. 🙈
• For TLSv1.2, tickets generated during an initial handshake use the value as specified. But tickets generated during a resumed handshake have a value of 0 for the ticket lifetime hint. 😭

---

💜 RETURN VALUES 💜

• SSL_CTX_set_timeout() returns the previously set timeout value.
• SSL_CTX_get_timeout() returns the currently set timeout value.

---

🌟 SEE ALSO 🌟

ssl(7), SSL_CTX_set_session_cache_mode(3), SSL_SESSION_get_time(3), SSL_CTX_flush_sessions(3), SSL_get_default_timeout(3)

---

🎀 COPYRIGHT 🎀

Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie, tysm for reading, mwah 💖✨

this was OpenSSL 3.5.9, dated 2026-09-29, from the SSL_CTX_SET_TIMEOUT(3ossl) manual — slay, go forth and cache responsibly 🦋💅