Changeset fdd3bf0 in mod_gnutls for doc/mod_gnutls_manual.mdwn

Timestamp:

Sep 30, 2018, 1:36:26 PM (2 years ago)

Author:

Fiona Klute <fiona.klute@…>

Branches:

debian/master, master, proxy-ticket

Children:

bac1a32

Parents:

bd2b48b

git-author:

Fiona Klute <fiona.klute@…> (09/30/18 13:26:54)

git-committer:

Fiona Klute <fiona.klute@…> (09/30/18 13:36:26)

Message:

Enable session tickets by default if GnuTLS version >= 3.6.4

GnuTLS 3.6.4 introduced automatic master key rotation, and TLS 1.3
takes care of other reasons not to use tickets while requiring them
for session resumption.

File:

• doc/mod_gnutls_manual.mdwn (modified) (1 diff)

doc/mod_gnutls_manual.mdwn

@@ -139 +139 @@
     GnuTLSSessionTickets [on|off]
 
-Default: `off`\
-Context: server config, virtual host
-
-To avoid storing data for TLS session resumption the server can
-provide clients with tickets, to use on return. Tickets are an
-alternative to using a session cache, mostly used for busy servers
-with limited storage. For a pool of servers this option is not
-recommended since the tickets are bound to the issuing server only.
+Default: `on` with GnuTLS 3.6.4 and newer, `off` otherwise\
+Context: server config, virtual host
+
+Session tickets allow TLS session resumption without session state
+stored on the server, using encrypted tickets provided to the clients
+instead. Tickets are an alternative to using a session cache, and
+currently the only session resumption mechanism in TLS 1.3. For a pool
+of servers this option is not recommended since the tickets are bound
+to the issuing server only.
 
 If this option is set in the global configuration, virtual hosts
 without a `GnuTLSSessionTickets` setting will use the global setting.
 
-*Warning:* Currently the master key that protects the tickets is
-generated only on server start, and there is no mechanism to roll over
-the key. If session tickets are enabled it is highly recommened to
-restart the server regularly to protect past sessions in case an
-attacker gains access to server memory.
+*Warning:* With GnuTLS version before 3.6.4 the master key that
+protects the tickets is generated only on server start, and there is
+no mechanism to roll over the key. If session tickets are enabled it
+is highly recommended to restart the server regularly to protect past
+sessions in case an attacker gains access to server memory. GnuTLS
+3.6.4 introduced an automatic TOTP-based key rollover, so this warning
+does not apply any more and tickets are enabled by default.
 
 ### GnuTLSClientVerify