Retrieve SSL session id in asp.net

Question

Hi all,

is there any way to retrieve the SSL session Id serverside in asp.net?

thanks in advance and greetings

Tim

Answer 1

Tim,

Are you really "just" trying to retrieve the Session ID string or do you maybe lose all session information when switching to SSL? this would be a quite common problem, because the session on serverside is lost when using "InProc" session storage, and the session cookie on the client might be lost when not stored in a common domain.

Therefore, you should switch to state server or sql server session management in Web.config file, for example:

<sessionState mode="SQLServer"
   cookieless="true"
   regenerateExpiredSessionId="true"
   timeout="30"
   sqlConnectionString="Data Source=MySqlServer;Integrated Security=SSPI;"
   stateNetworkTimeout="30" />

Beside that, I don't really know why you shouldn't be able to retrieve HttpContext.Current.Session.SessionID also in SSL mode as well.

Some MSDN Links:

• MSDN: HttpSessionState.SessionID Property
• MSDN: ASP.NET Session State Overview

Maybe this helps somehow.

Best regards

Answer 2

Hi Tim, the short answer is no. This is an intentional limitation of IIS, so as to prevent people from taking a dependency on something that isn't dependable.

Out on the market, you will find various hardware load-balancers that will offer features like server persistence based on SSL Session ID, but they don't work very well because SSL renegotiation can happen at any time. In Internet Explorer 8, for example, a new SSL session is negotiated for every tab that is opened to a web site. You can expect similar behaviour from other multi-process browsers. So, I must stress that you should not use SSL Session ID for any kind of user identification purposes.

That said -- If you really need the SSL Session ID information for some specialized task, I recommend using Apache, mod_ssl and mod_proxy as a front-end to your IIS system. With a bit of fiddling, you could coerce mod_ssl into giving you the session ID, which you could then add to a proxied request to your IIS server as a query string parameter.... or you could store it in a database.