Monitoring encrypted communication sessions

A system comprising:

• one or more computing nodes having a memory and a processor;
• and
• a computer readable storage medium of the one or more computing nodes having program instructions embodied therewith, the program instructions executable by the processor to cause the system to:
• intercepting first messages of a handshaking procedure between a client device and a first server device, the handshaking procedure establishing an encrypted communication session between the client and first server devices;
• determine, from the first messages, a session context for the encrypted communication session and an identifier associated with the session context;
• store the session context in a database indexed by the identifier;
• intercept, subsequent to the storing, second messages of a second handshaking procedure between the client device and a second server device, the second handshaking procedure resuming the encrypted communication session after an interruption;
• determine that the second messages includes the identifier associated with the session context;
• retrieve, from the database, the session context;
• and
• monitor the resumed encrypted communication session using the session context.

A computer program product monitoring an encrypted communication session between computing devices, the computer program product including a computer readable storage medium having program instructions embodied therewith, wherein the computer readable storage medium is not a transitory signal per se, the program instructions executable by a processing circuit to cause the processing circuit to perform a method comprising:

• intercepting first messages of a handshaking procedure between a client device and a first server device, the handshaking procedure establishing an encrypted communication session between the client and first server devices;
• determining, from the first messages, a session context for the encrypted communication session and an identifier associated with the session context;
• storing the session context in a database indexed by the identifier;
• intercepting, subsequent to the storing, second messages of a second handshaking procedure between the client device and a second server device, the second handshaking procedure resuming the encrypted communication session after an interruption;
• determining that the second messages includes the identifier associated with the session context;
• retrieving, from the database, the session context;
• and
• monitoring the resumed encrypted communication session using the session context.