title: TLS session resumption on Windows
body: <p>We have C++ code that uses TCP/IP to communicate between a client and server and use TLS 1.2 for encryption between the two.  I'd like to implement TLS session resumption as it would speed up reconnections, which will be very often in our software.  I've scoured SO and lots of other places and come up with very little for definitive answers.  The closest I've found is this: <a href="https://forums.iis.net/t/1239418.aspx?How+to+enable+TLS+session+resumption+or+Optimize+TLS+handshake+on+Windows+2016+" rel="nofollow noreferrer">https://forums.iis.net/t/1239418.aspx?How+to+enable+TLS+session+resumption+or+Optimize+TLS+handshake+on+Windows+2016+</a></p>
  <p><em>The instructions from that site are reproduced here:</em></p>
  <p>To enable TLS session tickets on win2k12 r2 and win2k16, you need to follow these steps:</p>
  <ol>
  <li><p>Create a key (DWORD) in registry with value 1 HKLM\SYSTEM\CurrentControlSet\Services\HTTP\Parameters\EnableSslSessionTicket</p>
  </li>
  <li><p>Create a new TLS session ticket key through this powershell command: New-TlsSessionTicketKey -Password -Path &quot;C:\KeyConfig\TlsSessionTicketKey.config&quot; -ServiceAccountName &quot;System&quot; <a href="https://technet.microsoft.com/en-us/itpro/powershell/windows/tls/new-tlssessionticketkey" rel="nofollow noreferrer">https://technet.microsoft.com/en-us/itpro/powershell/windows/tls/new-tlssessionticketkey</a></p>
  </li>
  <li><p>Enable TLS session ticket key through this powershell command: Enable-TlsSessionTicketKey -Password -Path &quot;C:\KeyConfig\TlsSessionTicketKey.config&quot; -ServiceAccountName &quot;System&quot;https://technet.microsoft.com/en-us/itpro/powershell/windows/tls/enable-tlssessionticketkey</p>
  </li>
  <li><p>Reboot the server to enable TLS session ticket generation. Reboot is required for the registry entry to take effect.</p>
  </li>
  </ol>
  <p>But I have some issues with it.  I could do it in PowerShell, but I'd prefer to do it in C++ code.  We don't use HTTP, only TCP/IP.  And the service account you specify in Enable-TlsSessionTicketKey may be a user account and not one of the well-defined system accounts.</p>
  <p>It can't be this hard, can it?  It's not on by default, is it?  I'm looking at a Wireshark capture and it doesn't look like it's on.  In my Client Hello packets I see: session_ticket len=0, extended_master_secret len=0, renegotiation_info len=1.  In my Server Hello messages I don't see any session ticket.  I see: extended_master_secret len=0, renegotiation_info len=1.</p>