helpGnuTLS - Support: sr #108146, gnutls client tls library not...


sr #108146: gnutls client tls library not supporting session ticket renewing and aborting

Submitted by:  Daniel Black <danblack>
Submitted on:  Sun 30 Sep 2012 06:08:35 AM UTC
Category:  Core library Priority:  5 - Normal
Severity:  4 - Important Status:  Ready For Test
Privacy:  Public Assigned to:  nmav
Open/Closed:  Closed Operating System:  GNU/Linux
* Mandatory Fields

Add a New Comment (Rich Markup)

Comment Type & Canned Response:


Mon 01 Oct 2012 01:18:19 AM UTC, comment #3: 

thanks for the quick fix. Looked fairly extensive.

Daniel Black <danblack>
Sun 30 Sep 2012 11:17:11 AM UTC, comment #2: 

Thank you for reporting that and for the test site. This is indeed a bug in gnutls. It does not handle session tickets when received during resumption, and even worse it terminates the handshake when it sees them.

I committed a fix for the 3.0.x releases at:;a=commitdiff;h=52f373cdf26d50e05f5dd49e4ecc8b29fc742535

Nikos Mavrogiannopoulos <nmav>
Project Administrator
Sun 30 Sep 2012 06:13:33 AM UTC, comment #1: 

correction: was rfc5077 3.3 paragraph 2

Daniel Black <danblack>
Sun 30 Sep 2012 06:08:35 AM UTC, original submission:  

RFC5077 3.4 paragraph two allows for renewing session tickets.

I've used the openssl SSL_CTX_set_tlsext_ticket_key_cb returning the value 2 to perform a renew of the session ticket the following implementation in nginx.

I've setup a test site with 20 seconds expiry on session tickets and it attempts to renew the session ticket after 10 seconds.

A thin client program using is here:

running the following generates:

$ ./gnutls-client -r -r -r -d 15 443
[✔] Parse arguments.
[✔] Initialize GNU TLS library.
[✔] Solve
    │ Will connect to
[✔] Initialize TLS session.
[✔] Enable use of session tickets (RFC 5077).
[✔] Connect to
[✔] Start TLS renegotiation.
[✔] Check if session was reused:
    │ SSL session was not used
[✔] Get current session:
    │ Session context:
    │ Protocol : TLS1.2
    │ Cipher : AES-128-CBC
    │ Kx : RSA
    │ Compression : NULL
    │ PSK : (null)
    │ ID : D589B43480B198100389F2223D4FC3EA162E6402AD53D03A16509D6155D57FDD
[✔] Send HTTP GET.
[✔] Get HTTP answer:
    │ HTTP/1.1 200 OK
[✔] End TLS connection.
[✔] waiting 15 seconds.
[✔] Initialize TLS session.
[✔] Enable use of session tickets (RFC 5077).
[✔] Copy old session.
[✔] Connect to
[✘] Start TLS renegotiation:
    │ Unable to start TLS renegotiation:
    │ An unexpected TLS packet was received.

This was running with gnutls version 2.12.17

Daniel Black <danblack>


(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:

No files currently attached


Depends on the following items: None found

Items that depend on this one: None found


Carbon-Copy List
  • -email is unavailable- added by nmav (Posted a comment)
  • -email is unavailable- added by danblack (Submitted the item)

    There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

    Only logged-in users can vote.





    Follow 3 latest changes.

    Date Changed by Updated Field Previous Value => Replaced by
    2014-02-06 nmav Open/ClosedOpen => Closed
    2012-09-30 nmav StatusNone => Ready For Test
        Assigned toNone => nmav

    Back to the top

    Powered by Savane 3.9