ddos-simulation.com
Build a test plan

Layer 6 · Security & Crypto · tls_session_resumption_stress

TLS Session Resumption Stress Test

Floods TLS ClientHello handshakes containing invalid, expired, or randomized session IDs and session tickets to evaluate asymmetric crypto computation overhead and session cache lock contention under load.

Layer L6/L7 Protocol TLS 1.2 / TLS 1.3 Command tls_session_resumption_stress Access Self-service / Quote

What session resumption stress does

TLS session resumption (via Session IDs or RFC 5077 / RFC 8446 session tickets) allows returning clients to skip expensive asymmetric key exchanges (ECDHE, RSA). When an attacker floods randomized or corrupt session tickets, the server is forced to miss the cache, decrypt ticket envelopes, and fall back to full public-key cryptographic handshakes. This multiplies CPU consumption by up to 10x per connection attempt.

How ddos-simulation.com simulates it safely

Simulates controlled bursts of TLS 1.2 and TLS 1.3 ClientHello records with varied resumption states against your verified target domain, measuring CPU load, handshake latency, and TLS negotiation success rates.

What the test exercises

  • Hardware and software TLS termination capacity (OpenSSL, BoringSSL, rustls)
  • Session cache spinlock and mutex contention in multi-worker environments (e.g. NGINX shared memory, HAProxy stick tables)
  • TLS handshake rate limits and connection throttling

Reading the results

Resilient: Handshake times remain under 20ms, worker CPU utilization scales linearly without locking, and legitimate TLS handshakes succeed without drops.

Under strain: Handshake timeouts spike, TLS negotiation drops with TLS_ERROR_HANDSHAKE_FAILURE, and CPU becomes bottlenecked on crypto routines.

Benchmark your TLS cryptographic headroom safely.

Build a test plan
← All DDoS simulations