Search code examples
csslopenssl

Gracefully Shutdown TLS connection in C OpenSSL

I just create a TLS connection and then immediately close it. For now this is my shutdown function:

This always results in TCP RST packets being sent. In the picture below my PC sends it first, sometimes its the server... Is this normal is there a better way to do shutdown. I tried with other functions with no luck.

enter image description here

Solution

  • SSL_shutdown just initiates the shutdown of the TLS session. It is expected that one is waiting for the peer to also shutdown the TLS session. If one does not wait for this then the SSL shutdown alert from the peer will be received but the socket is closed before reading it from the socket buffer - resulting in a TCP RST.

    To cite from the documentation:

    The shutdown process will then be considered completed once the peer responds in turn with a close_notify shutdown alert message... the preferred method of waiting for the shutdown to complete is to use SSL_read(3) until SSL_get_error(3) indicates EOF by returning SSL_ERROR_ZERO_RETURN