
February 8th, 2013, 12:16 AM
|
|
|
|
Setting the timeout on an SSL session causes the session to expire after the timeout, but that just means that the client has to create a new SSL session with a full handshake next time he connects (because a new connection cannot join an expired session). It doesn't mean that the existing connection gets invalidated.
SSL setup and data exchange over a TCP connection takes place in two phases: handshake and data transfer. The handshake phase involves negotiation of the cipher-suite, authentication of end-points and agreement on cryptographic keys for subsequent encryption and decryption of application data. This establishes a SSL Session between two end-points. The data transfer phase involves message digest computation, encryption and transmission of the encrypted data blocks at one end and reception, decryption and digest verification at the other end.
If a client has a invalid session because the session timed out, it has to go thru the handshaking process again. But the underlying TCP connection is still valid
The timeout is probably working since you didn't post the complete code but it appears that it is not working in the way I believe you expect it to work.
|