SSL: error:14094410 – session cache exhaustion in OpenSSL
0 reputation · 16 Feb 2026, 06:58 UTC
Background
OpenSSL's internal session cache has a fixed default size (SSL_SESS_CACHE_SIZE). When the cache fills, new handshakes can fail with SSL_ERROR_SYSCALL and the error string SSL: error:14094410:SSL routines:ssl3_read_bytes:tlsv1 alert unknown ca, because the library cannot retrieve a cached session and falls back to a full handshake that the peer rejects.
Constraints
The cache mode set by SSL_CTX_set_session_cache_mode (client, server, or off) determines which side stores sessions. In a pooled connection environment mixing modes can cause uneven usage. OpenSSL does not automatically evict expired entries; the application must call SSL_CTX_flush_sessions periodically. This manual cleanup window lets stale entries occupy slots, leading to intermittent exhaustion under high connection churn.
Open design question
Should OpenSSL implement automatic lazy expiration of stale cache entries?
What cache size tuning strategy is recommended for workloads with rapid connection turnover?
How does the interaction of SSL_CTX_set_session_cache_mode with pooling affect the likelihood of exhaustion?
openssl