Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We need to stop using (insecure) SSL renegotiation for a series of e-commerce sites we provide due to PCI regulations.

Does anyone know of the implications of doing so assuming that we don't enable secure renegotiation?

Would SSL just re-establish a connect when required? I assume this would increase CPU load but would there be any other issues?

share|improve this question
up vote 1 down vote accepted

For public web sites, TLS renegotiation is not something that would normally happen anyway, so you shouldn't see any performance issues.

Its chief legitimate use is for the server to request a client certificate, on enterprise web sites where the client must be verified by certificate. But these aren't going to be handling customers' credit card information (unless you've done something terribly wrong).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.