I am trying to discard server side back effect.
Please, could someone confirm this strange behaviour or explain me what I have missed?
Many thanks

Please include a chrome://net-export log, as described at https://www.chromium.org/for-testers/providing-network-details

In general, this sounds like a server-side issue. A chrome://net-export will confirm.

Find here a chrome://net-export log

Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

I have set SSL level log on server side and it appears the problem is caused by a connection reset while writing TLSv1.2 data !

In the netlog, I see that it makes a new https connection every 20 seconds, and the https connections usually use TLS resumption, but on the one hour mark I see that the request is not resumed:
t=3618539 [st=269]     -SSL_CONNECT
                        --> cipher_suite = 49199
                        --> is_resumed = false
                        --> next_proto = "unknown"
                        --> version = "TLS 1.2"

If your server is using TLS session resumption to track user sessions, that would explain that. Chrome intentionally reuses TLS sessions only for a limited time.

HTTP obviously does not have TLS session resumption, so your server must be doing something else (cookies?). That would explain why the behavior is different between HTTP and HTTPS.

When I loaded your test site I saw the https version did not set any session cookie. The sites aren't loading for me anymore, so I can't confirm what the http site does.

So I'm thinking this is working as intended, you'll need to address this server side by changing how you implement sessions on HTTPS connections. Let us know if that analysis was correct or if I missed anything. 

Hi Matt,

On the sever side I have disabled TLS resumption and enabled cookies for SSL session tracking (instead SSL certificate) and voilà... ...no more connection resets with HTTPS scheme. You nailed it, I owe you a beer!

I have also read that paper (https://www.theregister.co.uk/2018/10/19/tls_handshake_privacy/) which basically says that "The most effective technique is to disable TLS session resumption in browsers completely".

Am I right to think that Chrome still uses TLS resumption only for compatibility reasons (because it's less secure) and is it planned to be disable on the future?

I thank you very much,

Manuel

P.S.
Are the sites still unavailable for you?

Thank you for providing more feedback. Adding the requester to the cc list.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

> Am I right to think that Chrome still uses TLS resumption only for compatibility reasons (because it's less secure) and is it planned to be disable on the future?

No.

Ok.

Could someone remove this issue as it not seems valuable?

Thanx