重新协商SSL握手

Question

Is it possible to do a renegotiation of the SSL handshake while the current SSL connection remains active. When the new handshake has succeeded the server should respond with a confirmation of the new handshake.

I've searched on SSL renegotiation but I couldn't find anything concrete. Does anyone know if something like this is possible?

Answer 1

Yes, renegotiation is part of TLS protocol. It can be both client- and server-initiated. Support for it depends on the implementation. Also, renegotiation made an attack on TLS possible.

Answer 2

I have faced this situation some time back, and we were using GoLang. Renegotiate mode can be set by setting tlsCfg.Renegotiation to one of the following values:

1. RenegotiateNever
2. RenegotiateOnceAsClient
3. RenegotiateFreelyAsClient which are defined in https://golang.org/src/crypto/tls/common.go

The following function can be used to set the request TLS Config.

func (r *request) SetRenegotiationMode(mode string) (IRequest, error) {

    modeMap := map[string]tls.RenegotiationSupport{
        "once":   tls.RenegotiateOnceAsClient,
        "freely": tls.RenegotiateFreelyAsClient,
        "never":  tls.RenegotiateNever,
    }

    if val, ok := modeMap[mode]; ok {
        if r.tlsCfg == nil {
            r.tlsCfg = &tls.Config{}
        }
        r.tlsCfg.Renegotiation = val
    } else {
        //if anything other than the allowed values is passed, it'll thrown an error
        return nil, <DEFINE AN ERROR>
    }

    return r, nil
}