2 files changed, 4 insertions, 0 deletions

diff --git a/NEWS b/NEWS
index ef6548a5..901eaeda 100644
--- a/NEWS
+++ b/NEWS
@@ -20,6 +20,7 @@ This file documents the major additions and syntax changes between releases.
         Fix check_procs where regex input of '|' would get displayed in output - now replaced with ','
         Fix segfault in check_host when hostname returns multiple IP addresses (Sebastian Harl)
         Fix check_smtp and check_tcp where duplicate messages were displayed for certificate errors
+        Disable RFC4507 support, to work around SSL negotiation issues with (at least) some Tomcat versions
 
 1.4.15 27th July 2010
         ENHANCEMENTS
diff --git a/plugins/sslutils.c b/plugins/sslutils.c
index 0bc61ed3..6e86dc62 100644
--- a/plugins/sslutils.c
+++ b/plugins/sslutils.c
@@ -52,6 +52,9 @@ int np_net_ssl_init_with_hostname (int sd, char *host_name) {
                                 printf ("%s\n", _("CRITICAL - Cannot create SSL context."));
                                 return STATE_CRITICAL;
                 }
+#ifdef SSL_OP_NO_TICKET
+                SSL_CTX_set_options(c, SSL_OP_NO_TICKET);
+#endif
                 if ((s = SSL_new (c)) != NULL){
 #ifdef SSL_set_tlsext_host_name
                                 if (host_name != NULL)