title: Lifetime of the SSL session in https
body: <p>We have an engaged (but friendly) discussion between coworkers about the life time of the SSL session underlying a https communication.</p>
  
  <p>When I establish a https connection to a server using a normal browser the underlying ssl creates a session (including a shared secret) using asymmetric encryption, the rest of the communication is encrypted using (faster) symmetric encryption. </p>
  
  <p>The question is: On a subsequent https requests (click on a link) to the same server, is the old ssl session used again, avoiding the overhead of the asymmetric encryption for establishing a session key? Or is a new asymmetric encrypted ssl handshake for establishing a ssl session necessary?</p>
  
  <p>Or to word it differently: Does a SSL session stays alive between https requests, or does it end with the end of the https request?</p>
  
  <p>Since we are a bunch of nitpicks over here a reference to some authorative source would be apreciated.</p>