Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

HTTP(S) is stateless, right? But if I go to some site via HTTPS, I assume I don't need an SSL handshake for every single page request. Is it a combination of SSL session cache and cookies?

share|improve this question

A SSL session spans several SSL connections (e.g. TCP connections which got upgraded to SSL) and their lifetime is determined by the servers SSL stack. It is usually not directly related to the user session which is determined by the web application and spawns several HTTP requests. These multiple HTTP requests can be sent inside SSL connection (which might have the same SSL session but does not need to) or TCP session without SSL or both. User sessions are usually maintained with HTTP level cookies, while SSL sessions have a similar mechanism, but bound to the SSL protocol.

share|improve this answer
For example, in nginx the session cache lifetime is specified in ssl_session_timeout directive. – Tero Kilkanen May 4 '14 at 10:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.