Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

We need to stop using (insecure) SSL renegotiation for a series of e-commerce sites we provide due to PCI regulations.

Does anyone know of the implications of doing so assuming that we don't enable secure renegotiation?

Would SSL just re-establish a connect when required? I assume this would increase CPU load but would there be any other issues?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

For public web sites, TLS renegotiation is not something that would normally happen anyway, so you shouldn't see any performance issues.

Its chief legitimate use is for the server to request a client certificate, on enterprise web sites where the client must be verified by certificate. But these aren't going to be handling customers' credit card information (unless you've done something terribly wrong).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.