http持久连接和ssl会话
HTTP 是一种应用程序协议，底层 TCP 连接可以关闭并重新打开，而不会影响 HTTP 应用程序（性能除外）。
通过使用 HTTP1.1，我们使用持久连接，但服务器或客户端仍然可以随时关闭连接。
为了安全起见，HTTP 通过 SSL/TLS 使用 TCP。
我的理解是 SSL 的行为很像一个应用程序，至少 TCP 是这样“查看”SSL 的。
我的问题是，如果底层 TCP 套接字在建立安全连接后的某个时间点关闭，这是否意味着 SSL 会话变得无效并且各方应重新开始 ssl 握手？
或者底层 TCP 连接与 TLS 会话无关？
谢谢！
HTTP is an application protocol and the underlying TCP connection could be closed and reopen without affecting the HTTP application (except performance).
By using HTTP1.1 we use persistent connections but still a server or client could close the connection at any time.
For security HTTP uses TCP via SSL/TLS.
My understanding is that SSL acts much like an application, at least this is how TCP "views" SSL.
My question is if the underlying TCP socket closes at a point after the secure connection has been established, does this mean that the SSL session becomes invalid and the parties should start over the ssl handshake?
Or the underlying TCP connection is irrelevant to the TLS session?
Thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，SSL/TLS 会话结束，必须重新建立握手。 TLS 包括恢复会话的机制（仍然会执行一些操作，但少于完全握手时的操作），但并非所有应用程序都支持它。
有关技术详细信息，请参阅 http://ietf.org/rfc/rfc2246.txt、F.1.4恢复时。
Yes, the SSL/TLS session is over and handshake must be re-established. TLS includes mechanisms for resuming the session (there still will be some operations performed, but less than in full handshake), but not all applications support it.
See http://ietf.org/rfc/rfc2246.txt, F.1.4 for technical details on resuming.
http://publib.boulder.ibm.com/httpserv/ihsdiag/ihs_performance .html#SSL ：
SSL 会话是客户端和 Web 服务器之间用于安全通信的逻辑连接。在 SSL 会话建立期间，公钥加密用于在客户端和服务器之间交换共享秘密主密钥，并确定通信的其他特征（例如密码）。随后通过会话传输的数据将使用对称密钥加密技术进行加密和解密，并使用 SSL 握手期间创建的共享密钥。
共享密钥的生成非常消耗 CPU 资源。为了避免为每个 TCP 连接生成共享密钥，可以为多个连接重用相同的 SSL 会话。客户端必须请求在后续握手中重用相同的 SSL 会话，并且服务器必须缓存 SSL 会话标识符。当满足这些要求时，后续 TCP 连接的握手所需的服务器 CPU 会少得多（在某些测试中减少 80%）。所有常用的 Web 浏览器都能够重复使用相同的 SSL 会话。然而，自定义 Web 客户端有时没有必要的支持。
http://publib.boulder.ibm.com/httpserv/ihsdiag/ihs_performance.html#SSL :
An SSL session is a logical connection between the client and web server for secure communications. During the establishment of the SSL session, public key cryptography is used to to exchange a shared secret master key between the client and the server, and other characteristics of the communication, such as the cipher, are determined. Later data transfer over the session is encrypted and decrypted with symmetric key cryptography, using the shared key created during the SSL handshake.
The generation of the shared key is very CPU intensive. In order to avoid generating the shared key for every TCP connection, there is a capability to reuse the same SSL session for multiple connections. The client must request to reuse the same SSL session in the subsequent handshake, and the server must have the SSL session identifier cached. When these requirements are met, the handshake for the subsequent TCP connection requires far less server CPU (80% less in some tests). All web browsers in general use are able to reuse the same SSL session. Custom web clients sometimes do not have the necessary support, however.