tree 1a8a5da9c30639700d006f56851f69f77cd1fff2
parent bb871227f5fe5cb466a0bd8a500eb772bfa1c85b
author Maxim Dounin <mdounin@mdounin.ru> 1551102174 +0300
committer Maxim Dounin <mdounin@mdounin.ru> 1551102174 +0300

SSL: adjusted session id context with dynamic certificates.

Dynamic certificates re-introduce problem with incorrect session
reuse (AKA "virtual host confusion", CVE-2014-3616), since there are
no server certificates to generate session id context from.

To prevent this, session id context is now generated from ssl_certificate
directives as specified in the configuration.  This approach prevents
incorrect session reuse in most cases, while still allowing sharing
sessions across multiple machines with ssl_session_ticket_key set as
long as configurations are identical.