title: Enabling SSL session for Jetty to speed up HTTPS requests
body: <p>This is a follow up of my question <a href="https://stackoverflow.com/q/13048802/194609">here</a>, where I found a big query time differences with HTTPS vs. HTTP requests: the larger the distance to the server was the bigger was this difference. </p>
  
  <p>I found a <a href="http://www.semicomplete.com/blog/geekery/ssl-latency.html" rel="nofollow noreferrer">nice explanation</a> of this handshake overhead. And one cannot really solve that, but for further requests it is important to use a SSL session in combination with keep-alive. Keep-alive is turned on. But the SSL ID is different for every request (I'm using jetty and reading the <a href="https://stackoverflow.com/a/6269593/194609">ssl_session_id property</a>).</p>
  
  <p>It turns out that I need to change the client as well as the server according to this <a href="https://stackoverflow.com/questions/5643704/reusing-ssl-sessions-in-android-with-httpclient">question</a>, but I'm still confused and unsure (the answer for this question does not seem to sound solid):</p>
  
  <p>For the browser: do I need to enable that somehow if I make javascript queries to my API?</p>
  
  <p>For Jetty: Do I also need to turn off the allowRenegotiate setting for jetty as explained <a href="https://stackoverflow.com/a/6543263/194609">here</a>? But it looks like this would have several security implications, where I do not fully if now allowing is safe or not (taken from <a href="http://archive.eclipse.org/jetty/7.6.0.RC5/apidocs/org/eclipse/jetty/io/nio/SslConnection.html#setAllowRenegotiate%28boolean%29" rel="nofollow noreferrer">the docs</a>):</p>
  
  <p><em>Set if SSL re-negotiation is allowed. CVE-2009-3555 discovered a vulnerability in SSL/TLS with re-negotiation. If your JVM does not have CVE-2009-3555 fixed, then re-negotiation should not be allowed. CVE-2009-3555 was fixed in Sun java 1.6 with a ban of renegotiates in u19 and with RFC5746 in u22.</em> </p>