Spring boot 2 tomcat ssl handshake caching

Java's JSSE has already a default session cache of 20480 entries with an expiration of 24 hours.

If you want to change these values:

• on a the global level you can set the system property javax.net.ssl.sessionCacheSize to the desired cache size (cf. customizing JSSE),
• in an external Tomcat, you can use the properties sessionCacheSize and sessionTimeout of the <SSLHostConfig> element,
• when you use the embedded Tomcat server, you can define a TomcatConnectorCustomizer, e.g.

@Componentpublic class SSLSessionCustomizer implements TomcatConnectorCustomizer {   @Override   public void customize(Connector connector) {      for (final SSLHostConfig hostConfig : connector.findSslHostConfigs()) {         hostConfig.setSessionCacheSize(40960);         hostConfig.setSessionTimeout(2 * 24 * 60 * 60);      }   }}

Remark: You can use openssl s_client -reconnect to test the session resumption. However in recent versions of Java, JSSE aborts session resumption if the TLS extension extended_master_secret is missing (cf. release notes). Older clients, like those based on OpenSSL 1.0 do not support this extension. If compatibility is important for you, you can set the system property:

jdk.tls.useExtendedMasterSecret=false