https://issues.apache.org/bugzilla/show_bug.cgi?id=47055
--- Comment #46 from Roger Waldner <[email protected]> 2009-12-15 02:10:25 UTC --- Hi, we just ran into exactly the same problem. More analysis revealed that the impacts from this change ("be strict about session ID context matching") are stronger than anybody thought: a) performance: The performance of the server may suffer because every access to a client cert protected directory now forces a full renegotiation without resuming the session b) user annoyance: Users of browsers who cannot use a checkbox in the sense of "remember chosen certificate" are plagued with popups to confirm with the correct client cert c) change of SSL session ID: applications relying on the SSL session ID now are constantly faced with changing SSL session ids. Can anybody explain (eg. with an example) why this session ID context matching is now needed? Thanks Roger -- Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
