Method for SSL optimization for an SSL proxy
Described embodiments establish at least one secure connection for a session. An intermediary device may intercept a domain name service (DNS) request from a client. The device may determine, according to the intercepted DNS request and configuration data of the device, that the client is preparing to establish a session with a server. The device may send a client hello message of the device to the server for establishing a first secure connection between the device and the server for the session, prior to the client sending a client hello message of the client for establishing a second secure connection between the client and the device for the session. The second secure connection may be established between the client and the device using a specified value for a session identifier received from the server in response to the client hello message of the device.
1. A method for establishing at least one secure connection for a session, the method comprising:
intercepting, by a device intermediary between a client and a server, a domain name service (DNS) request from the client;
determining, by the device according to the intercepted DNS request and configuration data of the device, that the client is preparing to establish a session with the server;
sending, by the device responsive to the determination, a client hello message of the device to the server for establishing a first secure connection between the device and the server for the session, prior to the client sending a client hello message of the client for establishing a second secure connection between the client and the device for the session; and
establishing the second secure connection between the client and the device using a specified value for a session identifier received from the server in response to the client hello message of the device.
2. The method of claim 1 , wherein the determining comprises parsing the intercepted DNS request for information and comparing the information with the configuration data of the device.
3. The method of claim 1 , wherein establishing the second secure connection comprises performing an abbreviated secure socket layer (SSL) handshake to establish the second secure connection between the client and the device.
4. The method of claim 3 , wherein performing the abbreviated SSL handshake comprises avoiding to have the device transmit a SSL certificate of the device to the client for validation.
5. The method of claim 1 , wherein the configuration data comprises at least one of: a SSL profile of the client or the server, or historical data gathered about connections of the client or the server.
6. The method of claim 1 , wherein sending the client hello message of the device comprises sending the client hello message of the device with an empty or null value for the session identifier, to cause the server to set the session identifier to the specified value.
7. The method of claim 1 , further comprising receiving, by the device, the specified value of the session identifier from the server, prior to or at a time the client hello message of the client is received at the device.
8. The method of claim 1 , further comprising establishing the second secure connection between the client and the device using a session ticket that comprises a session state of the first secure connection.
9. The method of claim 1 , further comprising establishing, by the device, the first secure connection using the specified value for the session identifier received from the server.
10. The method of claim 1 , wherein establishing the second secure connection further comprises establishing the second secure connection by reusing the first secure connection established between the device and the server.
11. A system for establishing at least one secure connection for a session, the system comprising:
a device intermediary between a client and a server, the device configured to:
intercept a domain name service (DNS) request from the client;
determine, according to the intercepted DNS request and the configuration data of the device, that the client is preparing to establish a session with the server;
send, responsive to the determination, a client hello message of the device to the server for establishing a first secure connection between the device and the server for the session, prior to the client sending a client hello message of the client for establishing a second secure connection between the client and the device for the session; and
establish the second secure connection between the client and the device using a specified value for a session identifier received from the server in response to the client hello message of the device.
12. The system of claim 11 , wherein the device is further configured to parse the intercepted DNS request for information, and to compare the information with the configuration data of the device.
13. The system of claim 11 , wherein the device is further configured to establish the second secure connection by performing an abbreviated secure socket layer (SSL) handshake.
14. The system of claim 13 , wherein the device is further configured to perform the abbreviated SSL handshake by avoiding to have the device transmit a SSL certificate of the device to the client for validation.
15. The system of claim 11 , wherein the configuration data comprises at least one of: a SSL profile of the client or the server, or historical data gathered about connections of the client or the server.
16. The system of claim 11 , wherein the device is further configured to send the client hello message of the device with an empty or null value for the session identifier, to cause the server to set the session identifier to the specified value.
17. The system of claim 11 , wherein the device is further configured to receive the specified value of the session identifier from the server, prior to or at a time the client hello message of the client is received at the device.
18. The system of claim 11 , wherein the device is further configured to establish the second secure connection between the client and the device using a session ticket that comprises a session state of the first secure connection.
19. The system of claim 11 , wherein the device is further configured to establish the first secure connection using the specified value for the session identifier received from the server.
20. The system of claim 11 , wherein the device is further configured to establish the second secure connection by reusing the first secure connection established between the device and the server.