SSL_CTX_SET_TIMEOUT(3SSL)

📦
version 4.0.3 · 14 versions
, in ubuntu stonking

💖 SSL_CTX_SET_TIMEOUT 💖

okay bestie, welcome to the OpenSSL corner of the man pages, Volume 3SSL — today we're talking timeout values for session caching and honestly? it's giving control freak in the best way 🎀

✨ NAME ✨

SSL_CTX_set_timeout, SSL_CTX_get_timeout — manipulate timeout values for session caching 💅

🌸 SYNOPSIS 🌸

#include <openssl/ssl.h>

long SSL_CTX_set_timeout(SSL_CTX *ctx, long t);
long SSL_CTX_get_timeout(SSL_CTX *ctx);

yes bestie, that's literally it. two functions. tiny API, big consequences 🦋

👑 DESCRIPTION 👑

SSL_CTX_set_timeout() sets the timeout for newly created sessions for ctx to t. and t has to be in seconds, no cap 🕰️

SSL_CTX_get_timeout() returns the currently set timeout value for ctx. she just tells you what's up 💜

🌈 NOTES 🌈

okay so here's the lore, and it lowkey matters:

Whenever a new session is created, it gets assigned a maximum lifetime. That lifetime is stored by saving the creation time of the session plus the timeout value that was valid at that moment. So if the actual time is later than creation time plus timeout? the session is not reused. periodt 💀

Because of how this is realized, all sessions behave according to the timeout value that was valid at the time of the session negotiation. Changes to the timeout value do not affect already established sessions. not me changing the timeout and expecting old sessions to care 😭 they do not, bestie, they're committed to their original vibe

If you wanna tweak the expiration time of one single session, use the SSL_SESSION_get_time(3) family of functions. one session at a time, main character energy ⭐

Expired sessions get removed from the internal session cache whenever SSL_CTX_flush_sessions(3) is called — either directly by the application, or automatically (see SSL_CTX_set_session_cache_mode(3)). so the cleanup is happening, she's just the one doing it 🧚

The default value for session timeout is decided on a per protocol basis — go look at SSL_get_default_timeout(3). and btw, all currently supported protocols share the same default timeout value of 300 seconds. slay, consistency 💖

This timeout value does double duty: it's used as the ticket lifetime hint for stateless session tickets, and it's also used as the timeout value within the ticket itself. multi-talented fr fr 👑

For TLSv1.3, RFC8446 limits transmission of this value to 1 week (604800 seconds). so like, no, you can't just set it to a gazillion and call it a day 🙈

For TLSv1.2, tickets generated during an initial handshake use the value as specified. But tickets generated during a resumed handshake have a value of 0 for the ticket lifetime hint. yeah. 0. it is what it is 😌

💅 RETURN VALUES 💅

SSL_CTX_set_timeout() returns the previously set timeout value. (past you's value, not the new one — read carefully bestie 🎀)

SSL_CTX_get_timeout() returns the currently set timeout value.

🦋 SEE ALSO 🦋

Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie! 🫶 this was OpenSSL 4.0.3, dated 2026-09-29, and it was the SSL_CTX_SET_TIMEOUT(3SSL) manual page — go set your timeouts, love you, bye ✨🌸

📦 where this page comes from