From 81e24988895a58fe2c664729dcd6bb2b6de40a99 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 2 May 2022 15:57:44 +0300 Subject: [PATCH] OpenSSL: Limit the number of TLS 1.3 session tickets to one One session ticket is sufficient for EAP-TLS, so do not bother generating more than a single session ticket. Signed-off-by: Jouni Malinen --- src/crypto/tls_openssl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/src/crypto/tls_openssl.c b/src/crypto/tls_openssl.c index 564f45b6f..f992f8bf9 100644 --- a/src/crypto/tls_openssl.c +++ b/src/crypto/tls_openssl.c @@ -1106,6 +1106,10 @@ void * tls_init(const struct tls_config *conf) SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_SERVER); SSL_CTX_set_timeout(ssl, data->tls_session_lifetime); SSL_CTX_sess_set_remove_cb(ssl, remove_session_cb); +#if OPENSSL_VERSION_NUMBER >= 0x10101000L + /* One session ticket is sufficient for EAP-TLS */ + SSL_CTX_set_num_tickets(ssl, 1); +#endif } else { SSL_CTX_set_session_cache_mode(ssl, SSL_SESS_CACHE_OFF); }