Home/ Questions/Q 207169
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-11T17:42:42+00:00

I’ve just started learning SSL and boy is it confusing Q1 – How long

  • 0

I’ve just started learning SSL and boy is it confusing

Q1 – How long does SSL connection between a client and server persist? Until client surfs to some other URL or…?

Q2

A) Assume a client (browser) establishes a SSL connection with a IIS server.

Now how does IIS figure out on each postback that it is dealing with same authenticated client/browser and thus that it already has a SSL connection established with that client?

B) Assuming SSL connection isn’t lost if browser surfs to some other URL:

Suppose that moments after SSL connection is established, client surfs to some other URL, and shortly there after it again requests ( via https ) the original page ( one with which it has SSL connection established).

How will IIS server be able to figure out that current request for a page comes from a client that already has SSL connection established with that page and thus will use already established SSL connection?

thanx

EDIT:

  • Assuming browser surfs to some other URL and if on returning back to original page the SSL connection is still established, how will browser “remember” the value of symetric encryption key, which the two sides used for communicating?

  • I realize it depends on what browser you use, but with IE and Firefox, I assume when you close a browser, it sends Connection.Close() ( or something to that effect ) to the server and thus SSL connection is immediately closed?

  • But if you browse away to some other URL, then if browsers doesn’t send any notification to the server, wouldn’t then SSL connection remain established for quite some time ( even 10 or more minutes ) and thus browser could easily surf back to that page as if nothing happened?!

I appreciate it

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    post-edit answers:

    What I think you may be missing is that SSL is linked intrinsically to TCP. You cannot have an SSL “connection” to the server that doesn’t ride on top of a TCP connection. You break one, you break the other.

    Most SSL implementations include “shortcut” negotiation where subsequent new connections can leverage the public key encryption that has already taken place and instead directly use the most recently negotiated symmetric key. The details of this, however, are hidden within the SSL implementation. From the point of view of the user and/or client software, the fiction is maintained that the entire negotiation took place just like it did on the first connection.

    1. If the SSL connection is still established, then it follows that the symmetric key information is still maintained on both ends.

    2. Yes.

    3. Yes, although it would be improbable for the client to keep a connection to a server once it has navigated away to some other site.

    • 0