SSL_CTX_SET_NUM_TICKETS(3SSL)

💖 SSL_CTX_SET_NUM_TICKETS 💖

okay bestie, this is a page from the OpenSSL manual set — like, the 3SSL section, if you're keeping track of the shelf it lives on. sit down, grab a strawberry 🍓, and let's talk session tickets because this one is genuinely so fun.

---

✨ NAME ✨

SSL_set_num_tickets, SSL_get_num_tickets, SSL_CTX_set_num_tickets, SSL_CTX_get_num_tickets, SSL_new_session_ticket — these are the girlies that control how many TLSv1.3 session tickets get issued. 💅

---

🦋 SYNOPSIS 🦋

#include <openssl/ssl.h>

int SSL_set_num_tickets(SSL *s, size_t num_tickets);
size_t SSL_get_num_tickets(const SSL *s);
int SSL_CTX_set_num_tickets(SSL_CTX *ctx, size_t num_tickets);
size_t SSL_CTX_get_num_tickets(const SSL_CTX *ctx);
int SSL_new_session_ticket(SSL *s);

like, all of it, verbatim, no notes. 👑

---

🌸 DESCRIPTION 🌸

okay so starting with the setters: SSL_CTX_set_num_tickets() and SSL_set_num_tickets() are for a server application, and they set the number of TLSv1.3 session tickets that get sent to the client after a full handshake. you drop the number you want into the num_tickets argument — and yes, it could be 0, that's a real choice you're allowed to make. the typical move is to call these before the start of the handshake. no cap.

the default number of tickets is 2. and here's the plot twist: after a resumption, the number of tickets issued will never be more than 1, no matter what value you set via SSL_set_num_tickets() or SSL_CTX_set_num_tickets(). the settings don't override that. and if num_tickets is set to 0, then no tickets will be issued — not for a normal connection, not for a resumption. zero means zero, periodt. 💀

tickets also get issued when the server receives a post-handshake certificate from the client, following a request by the server using SSL_verify_client_post_handshake(3). those new tickets get associated with the updated client identity — meaning including their certificate and verification status. the number of tickets issued here will normally be the same as what was used for the initial handshake. and if that initial handshake was a full handshake, then SSL_set_num_tickets() can be called again, prior to calling SSL_verify_client_post_handshake(), to update the number of tickets that will be sent. little refresh moment. ✨

now, for tickets you want to issue after other events (application-layer changes and whatnot), there's SSL_new_session_ticket(). a server application uses it to request that a new ticket be sent when it's safe to do so. but — and this is the important bit — new tickets are only allowed to be sent this way after the initial handshake has completed, and only for TLS 1.3 connections. no exceptions, iykyk.

by default, the ticket generation and transmission are delayed until the server is starting a new write operation, so it gets bundled with other application data being written and properly aligned to a record boundary. however, if the connection was at a record boundary when SSL_new_session_ticket() was called, the ticket can be sent immediately — without waiting for the next application write — by calling SSL_do_handshake(). iconic behaviour honestly.

SSL_new_session_ticket() can be called more than once to request additional tickets. all of those requests get queued and written together when it's safe to do so, triggered by SSL_write() or SSL_do_handshake(). 🙈

⚠️ okay important vibe check: a successful return from SSL_new_session_ticket() indicates only that the request to send a ticket was processed — not that the ticket itself was sent. those are two different things, don't mix them up.

to be notified when the ticket itself actually goes out, you can register a new-session callback with SSL_CTX_sess_set_new_cb(3), which will be invoked as the ticket or tickets are generated. cute, right?

and finally the getters: SSL_CTX_get_num_tickets() and SSL_get_num_tickets() return the number of tickets set by a previous call to SSL_CTX_set_num_tickets() or SSL_set_num_tickets() — or 2 if no such call has been made. the default always comes back to haunt you. 💜

---

🎀 RETURN VALUES 🎀

• SSL_CTX_set_num_tickets(), SSL_set_num_tickets(), and SSL_new_session_ticket() return 1 on success or 0 on failure. simple as.
• SSL_CTX_get_num_tickets() and SSL_get_num_tickets() return the number of tickets that have been previously set.

---

🌈 SEE ALSO 🌈

• ssl(7)

---

⭐ HISTORY ⭐

• SSL_new_session_ticket() was added in OpenSSL 3.0.0.
• SSL_set_num_tickets(), SSL_get_num_tickets(), SSL_CTX_set_num_tickets(), and SSL_CTX_get_num_tickets() were added in OpenSSL 1.1.1.

---

👑 COPYRIGHT 👑

Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

---

and that's the whole page bestie 🫶 this was version 4.0.3, dated 2026-09-29, and you just read SSL_CTX_SET_NUM_TICKETS(3SSL). slay, go issue some tickets responsibly ✨💖