# Nginx + lua-nginx, get ssl\_session\_id **URL:** \ **Category:** NGINX\ **Created:** [November 26, 2014, 5:30pm UTC](https://www.ruby-forum.com/t/nginx-lua-nginx-get-ssl-session-id/233244 "2014-11-26T17:30:00Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![addis\_a](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/c4cdca/32.png) [@addis\_a](https://www.ruby-forum.com/u/addis_a)\ **Post date:** [November 26, 2014, 5:30pm UTC](https://www.ruby-forum.com/t/nginx-lua-nginx-get-ssl-session-id/233244/1 "2014-11-26T17:30:00Z")
Hi! I’m trying to modify one of auth modules for nginx and I need to get content of either ssl\_session\_id or any other ssl\_\* variables with uniq client id to identify connection. But I’ve got a problems with accessing to this variables from lua. For testing purposes I’m using self-signed ssl cert. ngx.log(ngx.DEBUG, “session\_id=”, ngx.var.ssl\_session\_id) prints “nil” in the logs. How can I get access to this variable? lua script is called with access\_by\_lua directive. Thanks in advance! P.S. If I do “set $test\_session\_id $ssl\_session\_id;” in config, test\_session\_id var is also empty. Best regards, Vladimir Smirnov. Posted at Nginx Forum: > **[Nginx + lua-nginx, get ssl\_session\_id](https://forum.nginx.org/read.php?2,255157,255157#msg-255157)** > > Hi! I'm trying to modify one of auth modules for nginx and I need to get content of either ssl\_session\_id or any other ssl\_\* variables with uniq client id to identify connection. But I've got a problems with accessing to this variables from lua. For... ---
**Author:** ![VladimirSmirnov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/dfb087/32.png) [@VladimirSmirnov](https://www.ruby-forum.com/u/VladimirSmirnov)\ **Post date:** [November 26, 2014, 9:29pm UTC](https://www.ruby-forum.com/t/nginx-lua-nginx-get-ssl-session-id/233244/2 "2014-11-26T21:29:31Z")
Hello! On Wed, Nov 26, 2014 at 8:29 AM, VladimirSmirnov wrote: > For testing purposes I’m using self-signed ssl cert. > > ngx.log(ngx.DEBUG, “session\_id=”, ngx.var.ssl\_session\_id) prints “nil” in > the logs. How can I get access to this variable? It’s very likely that your client sends TLS session tickets (in addition to session IDs) and server-side OpenSSL prefers the former (and ignores the latter, if any). I can reproduce the nil value when my SSL client sends the TLS session tickets. One quick way for testing non-empty $ssl\_session\_id values is to _temporarily_ make your nginx https server support the SSLv3 protocol _only_ (so as to disable TLS session tickets at all). This can be achieved by adding the following line to your corresponding server {} block: ``` ssl_protocols SSLv3; ``` And then your example produces the expected debugging log message like this: ``` [debug] 4662#0: *3 [lua] access_by_lua(nginx.conf:36):2: ``` session\_id=c292f1d3fbb0d3c2353d04bacf02e8e86bf0920bbd86ea84c61a2619b86d99db Well, this is just a hacky way to quickly test this thing. Do not use SSLv3 exclusively in production! TLS session tickets are way more effective (and cheaper) than SSL session IDs (if available). BTW, for such ngx\_lua questions, please post to the openresty-en mailing list in the future instead. See [OpenResty® - High-Concurrency Web Platform Built on Nginx + LuaJIT](http://openresty.org/#Community) for details. That way you may get responses faster and get more responses than posting here. Best regards, -agentzh ---
**Author:** ![VladimirSmirnov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/dfb087/32.png) [@VladimirSmirnov](https://www.ruby-forum.com/u/VladimirSmirnov)\ **Post date:** [November 29, 2014, 6:03am UTC](https://www.ruby-forum.com/t/nginx-lua-nginx-get-ssl-session-id/233244/3 "2014-11-29T06:03:55Z")
Hello! On Thu, Nov 27, 2014 at 12:07 AM, VladimirSmirnov wrote: > P.S. As pointed by resty.session author, I’ve disabled ssl\_session\_ticket > and now I’m receiving ssl\_session\_id even with TLS enabled. But I’m not sure > that it’s best way to deal with this problem. No, you don’t really want this. To quote my warning in my previous email: “Well, this is just a hacky way to quickly test this thing. Do not use SSLv3 exclusively in production! TLS session tickets are way more effective (and cheaper) than SSL session IDs (if available).” Disabling session tickets to force sessions IDs is a complete loss. The session tickets are almost always preferred. > P.S.S. I’ve used this mail-listing, because it’s not Lua-related problem. The openresty-en mailing list is not a Lua-specific list 🙂 Regards, -agentzh ---
**Author:** ![VladimirSmirnov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/dfb087/32.png) [@VladimirSmirnov](https://www.ruby-forum.com/u/VladimirSmirnov)\ **Post date:** [May 26, 2016, 1:05pm UTC](https://www.ruby-forum.com/t/nginx-lua-nginx-get-ssl-session-id/233244/4 "2016-05-26T13:05:10Z")
Face the same problem, empty $ssl\_session\_id variable. If ssl\_session\_ticket off, $ssl\_session\_id always contain ID. How can I identify client connection if no ssl session id available? I need “session” IDentificator to pass it to backend, which authorize requests by this ID. Posted at Nginx Forum: > **[Re: Nginx + lua-nginx, get ssl\_session\_id](https://forum.nginx.org/read.php?2,255157,267164#msg-267164)** > > Hi! I'm trying to modify one of auth modules for nginx and I need to get content of either ssl\_session\_id or any other ssl\_\* variables with uniq client id to identify connection. But I've got a problems with accessing to this variables from lua. For... ---
**Author:** ![VladimirSmirnov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/dfb087/32.png) [@VladimirSmirnov](https://www.ruby-forum.com/u/VladimirSmirnov)\ **Post date:** [May 26, 2016, 2:54pm UTC](https://www.ruby-forum.com/t/nginx-lua-nginx-get-ssl-session-id/233244/5 "2016-05-26T14:54:24Z")
On 26 May 2016 at 14:04, Dimka [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Face the same problem, empty $ssl\_session\_id variable. > > If ssl\_session\_ticket off, $ssl\_session\_id always contain ID. > > How can I identify client connection if no ssl session id available? I would also know answer for this. It is kinda either: 1. server and client store session id or 2. client sends tickets that contains info how to continue without server storing anything So with tickets you don’t have session id. I’m not sure could there still be some kind of identifier be counted from tickets that could be used as a identifier for multiple round trips, but I think not (?). Yes, it sucks a little bit. With session\_id we had nice way to identify client built-in the protocol, with tickets it seems we don’t. Regards Aapo ---
**Author:** ![VladimirSmirnov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/dfb087/32.png) [@VladimirSmirnov](https://www.ruby-forum.com/u/VladimirSmirnov)\ **Post date:** [November 27, 2014, 9:07am UTC](https://www.ruby-forum.com/t/nginx-lua-nginx-get-ssl-session-id/233244/6 "2014-11-27T09:07:48Z")
Thanks! Then what should I use for TLS connections? P.S. As pointed by resty.session author, I’ve disabled ssl\_session\_ticket and now I’m receiving ssl\_session\_id even with TLS enabled. But I’m not sure that it’s best way to deal with this problem. P.S.S. I’ve used this mail-listing, because it’s not Lua-related problem. Posted at Nginx Forum: > **[Re: Nginx + lua-nginx, get ssl\_session\_id](https://forum.nginx.org/read.php?2,255157,255177#msg-255177)** > > Hi! I'm trying to modify one of auth modules for nginx and I need to get content of either ssl\_session\_id or any other ssl\_\* variables with uniq client id to identify connection. But I've got a problems with accessing to this variables from lua. For... ---
**Author:** ![VladimirSmirnov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/dfb087/32.png) [@VladimirSmirnov](https://www.ruby-forum.com/u/VladimirSmirnov)\ **Post date:** [May 26, 2016, 3:46pm UTC](https://www.ruby-forum.com/t/nginx-lua-nginx-get-ssl-session-id/233244/7 "2016-05-26T15:46:59Z")
Yes, impossible. In my case, I can use remoteIP/Port, I think its enough to ident. I need it to prevent extra DB queries which done with first request. Posted at Nginx Forum: > **[Re: Nginx + lua-nginx, get ssl\_session\_id](https://forum.nginx.org/read.php?2,255157,267174#msg-267174)** > > Hi! I'm trying to modify one of auth modules for nginx and I need to get content of either ssl\_session\_id or any other ssl\_\* variables with uniq client id to identify connection. But I've got a problems with accessing to this variables from lua. For...