I understand the ssl handshake flow, but I'm facing a logic problem. When a user selects a certificate I need to validate it against application to know that its reliable and match with any system user. But if not, I must allow for user ask again to select another one. Maybe the user has multiple certificates installed on their machine and selected a wrong certificate by mistake.
In my actual scenario, to select another certificate, the user must close the browser and open again, but it gives a negative user experience and I want to improve it.
The solution does a handshake for every request, so It allows user to select another one.
But how to do that?
The most relevant e question that I found was https://security.stackexchange.com/questions/56623/avoiding-ssl-handshake-for-each-call.
- The full handshake is what a client and server do when they don't know each other (they have not talked previously, or that was long ago). In the full handshake, certificates are sent, and asymmetric cryptography (RSA, Diffie-Hellman...) occurs.
- The abbreviated handshake is what a client and server remember each other; moreaccurately, they remember the algorithms and keys that they established in a previous full handshake, and agree to reuse them (technically, they reuse the "master secret" and derive from it fresh encryption keys for this connection).
I can free any cookie, close tab, and disable keep alive, a second handshake doesn't open certificate prompt. It is using the previous selected, and for chrome for example, there is no option "remember my decision", Firefox has. The same happens with Edge, Opera, Edge etc. Is it a standard?
I guess, that it can be controlled by server side, requesting a new SSL Handshake. I made some interventions to try solve it by myself, but was unsuccessful
at client-side:
- Clear all data, even history.
- Open in another sub-domain cookieless
at server-side:
- Send "Connection: close" header
- Disable keep-alive
Close the browser is the only effective for a new SSL Handshake, but it will promote a bad user experience.
Well, If I'm cleaning all data from the browser, closing connections, removing any alive one, and it's still using the 1st certificate selected on a second request until I close the browser (kill all process), there is something wrong, or with a browser (all of it) or with the server.
If my application uses SSL to authenticate users, I can't use multiple logins without close the browser, it's not right, it should have a way to renegotiate this authentication.
