# Various debugging info not shown ( **URL:** \ **Category:** NGINX\ **Created:** [October 27, 2013, 10:31am UTC](https://www.ruby-forum.com/t/various-debugging-info-not-shown/237160 "2013-10-27T10:31:59Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![musicdenotation](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea666f/32.png) [@musicdenotation](https://www.ruby-forum.com/u/musicdenotation)\ **Post date:** [October 27, 2013, 10:31am UTC](https://www.ruby-forum.com/t/various-debugging-info-not-shown/237160/1 "2013-10-27T10:31:59Z")
Hi, I am trying to debug handshakes and ticket reuse. Lot’s of debugging information is shown in my error\_log, but some info is skipped. Specifically, info from: /src/event/ngx\_event\_openssl.c. For example, ngx\_log\_debug3(NGX\_LOG\_DEBUG\_EVENT, c-\>log, 0, “ssl new session: %08XD:%d:%d”, hash, sess-\>session\_id\_length, len); ngx\_log\_debug2(NGX\_LOG\_DEBUG\_EVENT, c-\>log, 0, “ssl get session: %08XD:%d”, hash, len); Don’t seem to be executed - i.e. neither is shown in my logs. On the other hand if (SSL\_session\_reused(c-\>ssl-\>connection)) { ngx\_log\_debug0(NGX\_LOG\_DEBUG\_EVENT, c-\>log, 0, “SSL reused session”); } get’s executed, i.e. “SSL reused session” is shown in the logs. Any ideas? Thanks * * * My setup: nginx 1.5.6, with --with-debug compiled in nginx.conf, events { debug\_connection: } site uses SSL, with ssl\_session\_cache shared:SSL:10m; and ssl\_session\_timeout 1680m; SSL configuration is working fine. ---
**Author:** ![alex](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/db5fbb/32.png) [@alex](https://www.ruby-forum.com/u/alex)\ **Post date:** [October 27, 2013, 3:10pm UTC](https://www.ruby-forum.com/t/various-debugging-info-not-shown/237160/2 "2013-10-27T15:10:36Z")
Hello! On Sun, Oct 27, 2013 at 10:30:53AM +0100, Alex wrote: > Any ideas? > What makes you think that “info is skipped”, rather than assuming > the relevant code isn’t executed for some reason? – Maxim D. [http://nginx.org/en/donation.html](http://nginx.org/en/donation.html) ---
**Author:** ![alex](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/db5fbb/32.png) [@alex](https://www.ruby-forum.com/u/alex)\ **Post date:** [October 27, 2013, 4:05pm UTC](https://www.ruby-forum.com/t/various-debugging-info-not-shown/237160/3 "2013-10-27T16:05:33Z")
Hi Maxim, Good question. I have been debugging a SSL configuration for some time, and one of the things I’ve been testing for is the renewal of session tickets. I used a thin client for that purpose: [https://github.com/grooverdan/rfc5077](https://github.com/grooverdan/rfc5077) Anyhow, according to the test, session renewal appears to work as intended: ./gnutls-client -r -d 10 mysite 443 [✔] Parse arguments. [✔] Initialize GNU TLS library. [✔] Solve mysite:443: │ Will connect to myip [✔] Initialize TLS session. [✔] Enable use of session tickets (RFC 5077). [✔] Connect to mysite:443. [✔] Start TLS renegotiation. [✔] Check if session was reused: │ SSL session was not used [✔] Get current session: │ Session context: │ Protocol : TLS1.2 │ Cipher : AES-256-CBC │ Kx : DHE-RSA │ Compression : NULL │ PSK : (null) │ ID : D18B216F82B277FCA97B95E35E91A323F922873483FD02FB025FE94106CB50C3 [✔] Send HTTP GET. [✔] Get HTTP answer: │ HTTP/1.1 301 Moved Permanently [✔] End TLS connection. [✔] waiting 10 seconds. [✔] Initialize TLS session. [✔] Enable use of session tickets (RFC 5077). [✔] Copy old session. [✔] Connect to mysite:443. [✔] Start TLS renegotiation. [✔] Check if session was reused: │ SSL session correctly reused [✔] Get current session: │ Session context: │ Protocol : TLS1.2 │ Cipher : AES-256-CBC │ Kx : DHE-RSA │ Compression : NULL │ PSK : (null) │ ID : D18B216F82B277FCA97B95E35E91A323F922873483FD02FB025FE94106CB50C3 [✔] Send HTTP GET. [✔] Get HTTP answer: │ HTTP/1.1 301 Moved Permanently [✔] End TLS connection. So I thought when I enable full debugging, I’d see the relevant debug information in the error log, such as ssl new session / ssl get session from ngx\_event\_openssl.c - of which nothing is shown however. FWIW, the reason why I am actually trying to debug this is because for some reason, when I choose a larger delay between the two test renegotiation, instead of 10s, let’s say 3600s, then the previous session would not get reused - despite the fact that in my nginx site config, I set a very large session timeout (1680m). Cheers, Alex ---
**Author:** ![alex](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/db5fbb/32.png) [@alex](https://www.ruby-forum.com/u/alex)\ **Post date:** [October 28, 2013, 9:16pm UTC](https://www.ruby-forum.com/t/various-debugging-info-not-shown/237160/4 "2013-10-28T21:16:38Z")
Hi, > Any ideas? Your client is using TLS Session Tickets (client-side caching), so nginx-side cache isn’t used for that sessions. Best regards, Piotr S. ---
**Author:** ![alex](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/db5fbb/32.png) [@alex](https://www.ruby-forum.com/u/alex)\ **Post date:** [October 27, 2013, 10:18pm UTC](https://www.ruby-forum.com/t/various-debugging-info-not-shown/237160/5 "2013-10-27T22:18:52Z")
OK, I found out why sessions wouldn’t be resumed after 3600s in my testings… it’s not that nginx would have stopped caching the session, but it’s the client. For example, openssl wouldn’t cache sessions for longer than two hours: /ssl/t1\_lib.c (same also for sslv3) long tls1\_default\_timeout(void) { /\* 2 hours, the 24 hours mentioned in the TLSv1 spec \* is way too long for http, the cache would over fill _/ return(60_60\*2); } Oh well. rfc2246 states that cached sessions may be used for up to 24 hours ([RFC 2246 - The TLS Protocol Version 1.0](http://tools.ietf.org/html/rfc2246#appendix-F.1.4)). Curious how popular browsers such as Chrome or Firefox behave in this regard. Anyhow, I am still not sure why the nginx debug data didn’t show anything about session resumption in my case, but I guess I won’t need the information now. Thanks again. Alex