How to set session ticket rotation lifetime from caddyfile?

Help
1

I’m running caddy 2.11.4 on Ubuntu 24.04

When testing my site with testssl.sh, it flags the TLS session ticket lifetime as being too long for FS purposes:

Session Ticket RFC 5077 hint 604800 seconds but: FS requires session ticket keys to be rotated < daily !

The caddy docs for the TLS module include this section:

	"session_tickets": {
		"key_source": {•••},
		"rotation_interval": 0,
		"max_keys": 0,
		"disable_rotation": false,
		"disabled": false
	},

But setting these in a Caddyfile like this:

    tls me@example.com {
        protocols tls1.2 tls1.3
        session_tickets {
            rotation_interval 12h
        }
    }

results in this error:

Error: adapting config using caddyfile: parsing caddyfile tokens for 'tls': unknown subdirective: session_tickets, at /etc/caddy/sites-enabled/mysite.caddyfile:34

I assume I am either doing this wrong, or session ticket options are not exposed to Caddyfiles, only JSON config. Which is it?

2

You’re using the JSON config documentation in the Caddyfile, and that’s wrong. They’re distinct formats. The configuration of session tickets isn’t exposed in the Caddyfile. You’ll have to use the JSON format if you want control over these low-level knobs.

3

Yes, that’s why I said “are not exposed to Caddyfiles, only JSON config”, and I was asking if it was indeed that way. I guess I’ll live with it as I’m not interested in switching to JSON.

4

It’s also a setting we don’t recommend changing, typically.

7 days is pretty aggressive already IMO, not sure I’ve heard of a test that requires sub-24-hour session tickets! It just means you get a slower connection every day.

5

I mentioned it was testssl.sh that flagged it. In its own code that happens here. RFC4346 says sessions should be <24h. RFC5077 does say:

The ticket lifetime may be longer than the 24-hour lifetime
recommended in RFC4346.

Meanwhile, RFC9846 says:

Servers MUST NOTuse any value greater than 604800 seconds (7 days). The value of zero indicates that the ticket should be discarded immediately. Clients MUST NOT use tickets for longer than 7 days after issuance, regardless of the ticket_lifetime, and MAY delete tickets earlier based on local policy

So 7 days is the absolute maximum value permitted.

Looking at other servers:

So 7 days as a default is definitely an outlier!

6

Interesting, that seems wild to me.
Want to open a PR to change the default?