Thread: TLS session tickets disabled?

TLS session tickets disabled?

From

Cameron Vogt

Date:

13 August, 00:19:22

I recently updated one of my PostgreSQL databases to 16.4. Since updating, I am unable to refresh Power BI reports that rely on the database. The error message in my PostgreSQL server's log file is "could not accept SSL connection: session id context uninitialized". I looked up the error message and found my issue in another mailing list: https://www.postgresql.org/message-id/CADT4RqBU8N-csyZuzaook-c795dt22Zcwg1aHWB6tfVdAkodZA%40mail.gmail.com.

After reading the old thread, it looks like the resolution was to make the PostgreSQL server pass SSL_OP_NO_TICKET to SSL_CTX_set_options. I believe the 16.4 update has resurrected this issue. In the 16.4 release notes, I found a bullet point that says:

"Disable creation of stateful TLS session tickets by OpenSSL.

This avoids possible failures with clients that think receipt of a session ticket means that TLS session resumption is supported."

Would it be possible to get this change reverted in the next update?

Thank you,

Cameron Vogt

Don’t forget to RSVP for our annual Customer Appreciation Day!

September 20^th, 2024, from 11am-3pm

Cameron Vogt | Software Developer
Direct:314-756-2302 | Cell: 636-388-2050
cvogt@automaticcontrols.net

1585 Fencorp Drive
Fenton, Missouri 63026

Attachment

Re: TLS session tickets disabled?

From

Tom Lane

Date:

13 August, 21:05:34

Cameron Vogt <cvogt@automaticcontrols.net> writes:
> I recently updated one of my PostgreSQL databases to 16.4. Since updating, I am unable to refresh Power BI reports
thatrely on the database. The error message in my PostgreSQL server's log file is "could not accept SSL connection:
sessionid context uninitialized". I looked up the error message and found my issue in another mailing list:
https://www.postgresql.org/message-id/CADT4RqBU8N-csyZuzaook-c795dt22Zcwg1aHWB6tfVdAkodZA%40mail.gmail.com.
> After reading the old thread, it looks like the resolution was to make the PostgreSQL server pass SSL_OP_NO_TICKET to
SSL_CTX_set_options.I believe the 16.4 update has resurrected this issue. In the 16.4 release notes, I found a bullet
pointthat says: 

> "Disable creation of stateful TLS session tickets by OpenSSL.
> This avoids possible failures with clients that think receipt of a session ticket means that TLS session resumption
issupported." 

> Would it be possible to get this change reverted in the next update?

What is your argument that it's not the client that is broken?
AFAIK, it should not be requiring a session ticket to exist.

            regards, tom lane