jgh at wizmail.org
Wed Apr 3 20:16:10 UTC 2019
On 02/04/2019 17:03, Viktor Dukhovni wrote:
> Does the server have a temporally stable ticket decryption key?
> Is this Exim? Is the server's SSL_CTX persistent and shared
> across multiple connections?
Ah, right. Unlike GnuTLS, the STEK is tied to the SSL_CTX and,
as you say, Exim initialises that fresh per connection.
Rearchitecting that is more effort than it's worth spending
on TLS 1.2, I think.
More information about the openssl-users