Connect-only connections don't support TLS 1.3 when using schannel

[Marc-Aldorasi-Imprivata]

I did this

1. Compiled the following C++ program

#include <thread>
#include <iostream>
#include <chrono>

#include <curl/curl.h>

using namespace std::literals;

int main()
{
	CURL* curl = curl_easy_init();
	curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
	curl_easy_setopt(curl, CURLOPT_URL, "https://localhost:1234/");
	curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);

	auto error = curl_easy_perform(curl);

	if (error != CURLE_OK)
	{
		std::cerr << "perform failed: " << curl_easy_strerror(error) << '\n';
		return 1;
	}

	char c;
	while (true)
	{
		std::size_t bytes_read;
		error = curl_easy_recv(curl, &c, 1, &bytes_read);
		if (error == CURLE_AGAIN)
		{
			std::this_thread::sleep_for(20ms);
			continue;
		}
		if (error != CURLE_OK)
		{
			std::cerr << "recv failed: " << curl_easy_strerror(error) << '\n';
			return 1;
		}
		if (bytes_read == 0)
		{
			std::cerr << "recv got eof\n";
			return 1;
		}
		break;
	}
	std::cout << "Read byte '" << c << "'; exiting\n";
	return 0;
}

2. Ran it against a TLS 1.3 server (using yes | openssl s_server -accept 1234 -cert cert.pem -key key.pem -tls1_3)

3. Received the error "recv failed: A libcurl function was given a bad argument"

I bisected this to 242a143. Earlier commits (I tested back to 8.9.1) work correctly.

This works correctly on Linux (using OpenSSL 3.5.2). TLS 1.3 works with schannel when not using a connect-only handle.

I expected the following

The output "Read byte 'y'; exiting"

curl/libcurl version

Bisected commit:
curl 8.12.1-DEV (Windows) libcurl/8.12.1-DEV Schannel
Release-Date: [unreleased]
Protocols: http https ws wss
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IPv6 Kerberos Largefile NTLM SPNEGO SSL SSPI threadsafe UnixSockets

Latest tested commit (0780de2):
curl 8.17.0-DEV (Windows) libcurl/8.17.0-DEV Schannel
Release-Date: [unreleased]
Protocols: http https ws wss
Features: alt-svc AsynchDNS HSTS HTTPS-proxy IPv6 Kerberos Largefile NTLM SPNEGO SSL SSPI threadsafe UnixSockets

operating system

Windows 11

[mitchellwong]

The bug appears to be because prior to 242a143, easy_perform correctly sets a Curl_ssl_scache in data->multi.ssl_scache, which was then stored in data->state.ssl_scache, so it survived after data->multi is destroyed at the end of easy_perform and could be used later on when curl_easy_recv causes cf_ssl_scache_get to get called. 242a143 removed data->state.ssl_scache, so cf_ssl_scache_get always returns NULL, which causes Curl_ssl_scache_add_obj to always return CURLE_BAD_FUNCTION_ARGUMENT.

[icing]

@mitchellwong the call to Curl_ssl_scache_add_obj() happens before the TLS handshake is done. Does in your case curl_easy_perform() return before the TLS handshake is finished? That seems wrong.

It would probably help if you could add a DEBUGFUNCTION to your sample, call curl_global_trace("all") once and attach here the traces.

[mitchellwong]

@icing the bug isn't exhibited in curl_easy_perform, it's in the later call to curl_easy_recv.

[icing]

@icing the bug isn't exhibited in curl_easy_perform, it's in the later call to curl_easy_recv.

Understood. I try to clarify what a libcurl application expects to happen, so we can make a meaningful and supportive implementation.

[Marc-Aldorasi-Imprivata]

Here is the program output when calling curl_global_trace("all") and setting CURLOPT_VERBOSE on the easy handle:

* [0-x] !!! WARNING !!!
* [0-x] This is a debug build of libcurl, do not use in production.
* [0-x] [MULTI] [INIT] added to multi, mid=1, running=1, total=2
* [0-x] [MULTI] [INIT] multi_wait(fds=0, timeout=0) tinternal=0
* [0-x] [MULTI] [INIT] -> [SETUP] (line 2411)
* [0-x] [MULTI] [SETUP] -> [CONNECT] (line 2427)
* [0-x] [READ] client_reset, clear readers
* [0-0] [MULTI] [CONNECT] [CPOOL] added connection 0. The cache now contains 1 members
* [0-0] Host localhost:1234 was resolved.
* [0-0] IPv6: ::1
* [0-0] IPv4: 127.0.0.1
* [0-0] [HTTPS-CONNECT] adding wanted h2
* [0-0] [HTTPS-CONNECT] added
* [0-0] [MULTI] [CONNECT] -> [CONNECTING] (line 2338)
* [0-0] [HTTPS-CONNECT] connect, init
* [0-0] [HAPPY-EYEBALLS] init ip ballers for transport 3
* [0-0] [HAPPY-EYEBALLS] starting first attempt for ipv6 -> 0
* [0-0]   Trying [::1]:1234...
* [0-0] [TCP] cf_socket_open() -> 0, fd=304
* [0-0] [TCP] local address ::1 port 50696...
* [0-0] [HAPPY-EYEBALLS] checked connect attempts: 1 ongoing, 0 inconclusive
* [0-0] [HAPPY-EYEBALLS] next HAPPY_EYBALLS timeout in 200ms
* [0-0] [TIMER] [HAPPY_EYEBALLS] set for 200000ns
* [0-0] [HTTPS-CONNECT] connect -> 0, done=0
* [0-0] [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
* [0-0] [TCP] adjust_pollset, !connected, POLLOUT fd=304
* [0-0] [HAPPY-EYEBALLS] adjust_pollset -> 0, 1 socks
* [0-0] [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
* [0-0] [MULTI] [CONNECTING] multi_wait pollset[fd=304 OUT], timeouts=1
* [0-0] [TIMER] [HAPPY_EYEBALLS] expires in 198931ns
* [0-0] [TIMER] [HAPPY_EYEBALLS] gives multi timeout in 199ms
* [0-0] [MULTI] [CONNECTING] multi_wait(fds=1, timeout=199) tinternal=199
* [0-0] [TCP] connected on fd=304
* [0-0] [HAPPY-EYEBALLS] connect attempt #0 successful
* [0-0] [TIMER] [HAPPY_EYEBALLS] cleared
* [0-0] [HAPPY-EYEBALLS] Connected to localhost (::1) port 1234
* [0-0] [SSL] cf_connect()
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 1/3)
* [0-0] [SSLS] find peer slot for localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G among 3 slots
* [0-0] [SSLS] peer not found for localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G
* [0-0] [SSLS] No cached session for 'localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G'
* [0-0] schannel: disabled server cert revocation checks
* [0-0] schannel: disabled automatic use of client certificate
* [0-0] ALPN: curl offers http/1.1
* [0-0] schannel: sending initial handshake data: sending 277 bytes.
* [0-0] [TCP] send(len=277) -> 0, 277
* [0-0] schannel: sent initial handshake data: sent 277 bytes
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 2/3)
* [0-0] [TCP] recv(len=4096) -> 81, 0
* [0-0] schannel: failed to receive handshake, need more data
* [0-0] [SSL] cf_connect() -> 0, done=0
* [0-0] [HTTPS-CONNECT] connect -> 0, done=0
* [0-0] [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
* [0-0] [SSL] adjust_pollset, POLLIN fd=304
* [0-0] [TCP] adjust_pollset, !active, POLLIN fd=304
* [0-0] [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
* [0-0] [MULTI] [CONNECTING] multi_wait pollset[fd=304 IN], timeouts=0
* [0-0] [MULTI] [CONNECTING] multi_wait(fds=1, timeout=190) tinternal=190
* [0-0] [SSL] cf_connect()
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 2/3)
* [0-0] [TCP] recv(len=4096) -> 0, 1359
* [0-0] schannel: sending next handshake data: sending 80 bytes.
* [0-0] [TCP] send(len=80) -> 0, 80
* [0-0] schannel: SSL/TLS handshake complete
* [0-0] schannel: connection hostname (localhost) validated against certificate name (localhost)
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 3/3)
* [0-0] ALPN: server did not agree on a protocol. Uses default.
* [0-0] [SSLS] find peer slot for localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G among 3 slots
* [0-0] [SSLS] peer not found for localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G
* [0-0] [SSL] cf_connect() -> 0, done=1
* [0-0] [HTTPS-CONNECT] connect+handshake h2: 27ms, 1st data: 13ms
* [0-0] [HTTPS-CONNECT] connect -> 0, done=1
* [0-0] [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=1
* [0-0] Established connection to localhost (::1 port 1234) from ::1 port 50696
* [0-0] [MULTI] [CONNECTING] -> [PROTOCONNECT] (line 2466)
* [0-0] [MULTI] [PROTOCONNECT] -> [DO] (line 2497)
* [0-0] [MULTI] [DO] -> [DONE] (line 2105)
* [0-0] [MULTI] [DONE] multi_done: status: 0 prem: 0 done: 0
* [0-0] [WRITE] [OUT] done
* [0-0] [READ] client_reset, clear readers
* [0-x] [MULTI] [DONE] multi_done_locked, in use=0
* [0-0] Connection #0 to host localhost:1234 left intact
* [0-0] [MULTI] [DONE] -> [COMPLETED] (line 2632)
* [0-0] [MULTI] [COMPLETED] [TIMEOUT] all cleared
* [0-0] [MULTI] [COMPLETED] -> [MSGSENT] (line 2740)
* [0-0] [MULTI] [COMPLETED] removed from multi, mid=1, running=0, total=1
* [0-0] [TCP] recv(len=4096) -> 0, 4096
* [0-0] schannel: remote party requests renegotiation
* [0-0] schannel: renegotiating SSL/TLS connection
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 2/3)
* [0-0] schannel: SSL/TLS handshake complete
* [0-0] schannel: connection hostname (localhost) validated against certificate name (localhost)
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 3/3)
* schannel: renegotiation failed
recv failed: A libcurl function was given a bad argument

[jay]

• [0-0] Connection #0 to host localhost:1234 left intact
• [0-0] [MULTI] [DONE] -> [COMPLETED] (line 2632)
• [0-0] [MULTI] [COMPLETED] [TIMEOUT] all cleared
• [0-0] [MULTI] [COMPLETED] -> [MSGSENT] (line 2740)
• [0-0] [MULTI] [COMPLETED] removed from multi, mid=1, running=0, total=1
• [0-0] [TCP] recv(len=4096) -> 0, 4096
• [0-0] schannel: remote party requests renegotiation
• [0-0] schannel: renegotiating SSL/TLS connection
• [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 2/3)
• [0-0] schannel: SSL/TLS handshake complete
• [0-0] schannel: connection hostname (localhost) validated against certificate name (localhost)
• [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 3/3)
• schannel: renegotiation failed
  recv failed: A libcurl function was given a bad argument

What version of curl is this? Please make sure you are using the latest version. curl 8.16.0 has a renegotiation fix for schannel.

Regardless, during renegotiation schannel's connected state changes to step2 to renegotiate. So to reach the connected state again (as like any initial connection) it goes through step2 to schannel_connect_step3. If I had to guess it is failing here in step3:

curl/lib/vtls/schannel.c

Lines 1586 to 1596 in 11b9912

	/* save the current session data for possible reuse */
	if(ssl_config->primary.cache_session) {
	Curl_ssl_scache_lock(data);
	/* Up ref count since call takes ownership */
	backend->cred->refcount++;
	result = Curl_ssl_scache_add_obj(cf, data, connssl->peer.scache_key,
	backend->cred, schannel_session_free);
	Curl_ssl_scache_unlock(data);
	if(result)
	return result;
	}

It seems to me that Schannel should be able to do that during renegotiation, or am I wrong? Although, on the other hand, renegotiation is a continuation of the same session so maybe the initial save is sufficient. Also I notice it's the only backend we have that calls that function. Another thing is why do you think it is renegotiating a TLS 1.3 session since TLS 1.3 doesn't have renegotiation.

[Marc-Aldorasi-Imprivata]

That output was from 0780de2, which was the master commit when I filed this issue. I checked against the current master commit (f8cd64e) and the output is the same (aside from irrelevant data like line numbers, file descriptor values, etc).

[jay]

Regarding the renegotiation question, I took another look at this and although TLS 1.3 forbids renegotiation, Schannel's DecryptMessage returns SEC_I_RENEGOTIATE for session tickets. The OpenSSL server sends two session tickets immediately after a TLS 1.3 handshake is complete. For example:

TLSv1.3 Record Layer: Handshake Protocol: New Session Ticket

TLSv1.3 Record Layer: Handshake Protocol: New Session Ticket
    Opaque Type: Application Data (23)
    Version: TLS 1.2 (0x0303)
    Length: 250
    [Content Type: Handshake (22)]
    [Sequence Number: 0]
    Handshake Protocol: New Session Ticket
        Handshake Type: New Session Ticket (4)
        Length: 229
        TLS Session Ticket
            Session Ticket Lifetime Hint: 7200 seconds (2 hours)
            Session Ticket Age Add: 1751163263
            Session Ticket Nonce Length: 8
            Session Ticket Nonce: 0000000000000000
            Session Ticket Length: 208
            Session Ticket […]: 3d20cb51ce26c33ce7fa1557afbb7b79aad204d12a003cd70dc3f2765d75f0da249ee52adc2f156fa8ca4190c8d6b4ec05442022076e78da055ef7047a67257548c6c5a71e36fc67dff3c7540dca3dfaa800675325b5926d1b8ab6c7b037326549a98f864c8a157b6c131a863
            Extensions Length: 0

TLSv1.3 Record Layer: Handshake Protocol: New Session Ticket

TLSv1.3 Record Layer: Handshake Protocol: New Session Ticket
    Opaque Type: Application Data (23)
    Version: TLS 1.2 (0x0303)
    Length: 250
    [Content Type: Handshake (22)]
    [Sequence Number: 1]
    Handshake Protocol: New Session Ticket
        Handshake Type: New Session Ticket (4)
        Length: 229
        TLS Session Ticket
            Session Ticket Lifetime Hint: 7200 seconds (2 hours)
            Session Ticket Age Add: 1349700199
            Session Ticket Nonce Length: 8
            Session Ticket Nonce: 0000000000000001
            Session Ticket Length: 208
            Session Ticket […]: 3d20cb51ce26c33ce7fa1557afbb7b79cd9d0278a789cd24a33e4f7ee2ce95644867a7ad3667572be9d998b651817aa0760246d1e96c3c61c13d9f0d22ba27c163f18b1ce95f48c24c56cfc8b6d142dd66e913409a5ae87acc5edbf719e5858027ce8f5628cf7268f47b22535
            Extensions Length: 0

Normally, without connect_only, that will cause two "renegotiations" which update the ssl session. For example:

log of "schannel: remote party requests renegotiation" (verbose, trace all, DEBUGBUILD and CURL_SCHANNEL_DEV_DEBUG)

* [0-0] schannel: remote party requests renegotiation
* [0-0] schannel: renegotiation caller is schannel_recv
* [0-0] schannel: renegotiating SSL/TLS connection
* [0-0] schannel: SSL/TLS connection with [REMOVED] port 1234 (step 2/3)
* [0-0] schannel: encrypted data buffer: offset 5222 length 17408
* [0-0] schannel: encrypted data length: 4967
* [0-0] schannel: SSL/TLS handshake complete
* [0-0] schannel: SSL/TLS connection with [REMOVED] port 1234 (step 3/3)
* [0-0] [SSLS] find peer slot for [REMOVED]:1234:NO-VRFY-PEER:NO-VRFY-HOST:TLSVER-6-0:IMPL-Schannel:G among 3 slots
* [0-0] schannel: SSL/TLS connection renegotiated
* [0-0] schannel: decrypted data length: 0
* [0-0] schannel: decrypted data added: 0
* [0-0] schannel: decrypted cached: offset 0 length 16384
* [0-0] schannel: encrypted data length: 4967
* [0-0] schannel: encrypted cached: offset 4967 length 17408
* [0-0] schannel: remote party requests renegotiation
* [0-0] schannel: renegotiation caller is schannel_recv
* [0-0] schannel: renegotiating SSL/TLS connection
* [0-0] schannel: SSL/TLS connection with [REMOVED] port 1234 (step 2/3)
* [0-0] schannel: encrypted data buffer: offset 4967 length 17408
* [0-0] schannel: encrypted data length: 4712
* [0-0] schannel: SSL/TLS handshake complete
* [0-0] schannel: SSL/TLS connection with [REMOVED] port 1234 (step 3/3)
* [0-0] [SSLS] find peer slot for [REMOVED]:1234:NO-VRFY-PEER:NO-VRFY-HOST:TLSVER-6-0:IMPL-Schannel:G among 3 slots
* [0-0] schannel: SSL/TLS connection renegotiated

However for connect_only this breaks, as best described by @mitchellwong , because Curl_ssl_scache_add_obj returns an error since there's no cache (cf_ssl_scache_get returns NULL). See what I mentioned earlier:

curl/lib/vtls/schannel.c

Lines 1586 to 1596 in 11b9912

	/* save the current session data for possible reuse */
	if(ssl_config->primary.cache_session) {
	Curl_ssl_scache_lock(data);
	/* Up ref count since call takes ownership */
	backend->cred->refcount++;
	result = Curl_ssl_scache_add_obj(cf, data, connssl->peer.scache_key,
	backend->cred, schannel_session_free);
	Curl_ssl_scache_unlock(data);
	if(result)
	return result;
	}

So it seems to me Schannel code is doing what is intended in that case and 242a143 is indeed to blame.

---

repro notes:

To reproduce this I used openssl s_server in Ubuntu and a modified version of the repro code in Windows 11. I used the s_server's -www feature to send a http response because it was easier to read the packet capture than using yes to send tons of yyyyys to the client. Also I logged the SSL keys from the server instead of client to decrypt in Wireshark and confirm the existence of session tickets. (Schannel client doesn't allow logging ssl keys although I'm sure there's some way around that)

server: ubuntu 16 lts vm and OpenSSL 3.5.2 5 Aug 2025

/usr/local/ssl/bin/openssl \
 req -new -x509 -newkey rsa:2048 \
 -subj /CN=server -nodes \
 -out server.crt -keyout server.key

/usr/local/ssl/bin/openssl \
 s_server -accept 1234 -tls1_3 -www \
 -cert server.crt \
 -key server.key \
 -keylogfile /mnt/hgfs/shared/sslkeylog

client: windows 11 and libcurl f8cd64e 2025-10-15

cmake_minimum_required(VERSION 3.12)
project(project1 LANGUAGES CXX)

# Open 'Visual Studio 2022 Command Prompt'
# cd /d [REMOVED]\project1\build
# 32-bit: cmake .. -A Win32
# 64-bit: cmake .. -A x64

set(CMAKE_DISABLE_FIND_PACKAGE_Perl TRUE)

set(BUILD_CURL_EXE OFF)
set(BUILD_EXAMPLES OFF)
set(BUILD_LIBCURL_DOCS OFF)
set(BUILD_MISC_DOCS OFF)
set(BUILD_STATIC_LIBS OFF)
set(BUILD_TESTING OFF)
set(CURL_BROTLI OFF CACHE STRING "")
set(CURL_DISABLE_SOCKETPAIR OFF)
set(CURL_USE_LIBPSL OFF)
set(CURL_USE_LIBSSH2 OFF)
set(CURL_ZLIB OFF CACHE STRING "")
set(CURL_ZSTD OFF CACHE STRING "")
set(ENABLE_CURL_MANUAL OFF)
set(USE_LIBIDN2 OFF)
set(USE_NGHTTP2 OFF)

# the debug option is off because it would define DEBUGBUILD for both Debug & Release configs.
# instead DEBUGBUILD is defined for only the Debug configuration later on.
set(ENABLE_DEBUG OFF)

set(BUILD_SHARED_LIBS ON)
set(CURL_USE_SCHANNEL ON)
set(ENABLE_UNICODE ON)
set(USE_WIN32_IDN ON)

add_subdirectory(${CMAKE_CURRENT_SOURCE_DIR}/../curl ${CMAKE_CURRENT_BINARY_DIR}/curl)

# shared target: libcurl_shared
# static target: libcurl_static
set_target_properties(libcurl_shared PROPERTIES ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR})
set_target_properties(libcurl_shared PROPERTIES LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR})
set_target_properties(libcurl_shared PROPERTIES RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR})

target_compile_options(libcurl_object PRIVATE $<$<CONFIG:Debug>:-DDEBUGBUILD -DCURL_SCHANNEL_DEV_DEBUG>)
target_compile_options(libcurl_shared PRIVATE $<$<CONFIG:Debug>:-DDEBUGBUILD -DCURL_SCHANNEL_DEV_DEBUG>)

add_executable(project1 project1.cpp)

set_property(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR} PROPERTY VS_STARTUP_PROJECT project1)

set_target_properties(project1 PROPERTIES
  VS_DEBUGGER_ENVIRONMENT "PATH=${CMAKE_CURRENT_BINARY_DIR}/\$(Configuration);%PATH%"
)

target_link_libraries(project1 PRIVATE libcurl)

#include <thread>
#include <iostream>
#include <chrono>

#include <curl/curl.h>

int main(void)
{
	CURL* curl;
	CURLcode res = CURLE_FAILED_INIT;
	struct curl_slist* host = NULL;

	curl_global_trace("all");
	curl_global_init(CURL_GLOBAL_ALL);

	curl = curl_easy_init();

	curl_easy_setopt(curl, CURLOPT_VERBOSE, 1L);
	//curl_easy_setopt(curl, CURLOPT_DEBUGFUNCTION, my_trace);

	curl_easy_setopt(curl, CURLOPT_CONNECT_ONLY, 1L);
	curl_easy_setopt(curl, CURLOPT_URL, "https://[REMOVED]:1234/");
	curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 0L);
	curl_easy_setopt(curl, CURLOPT_SSL_VERIFYHOST, 0L);

	auto error = curl_easy_perform(curl);

	if (error != CURLE_OK)
	{
		std::cerr << "perform failed: " << curl_easy_strerror(error) << '\n';
		return 1;
	}

	char c;
	while (true)
	{
		std::size_t bytes_read;
		error = curl_easy_recv(curl, &c, 1, &bytes_read);
		if (error == CURLE_AGAIN)
		{
			Sleep(20);
			continue;
		}
		if (error != CURLE_OK)
		{
			std::cerr << "recv failed: " << curl_easy_strerror(error) << '\n';
			return 1;
		}
		if (bytes_read == 0)
		{
			std::cerr << "recv got eof\n";
			return 1;
		}
		break;
	}
	std::cout << "Read byte '" << c << "'; exiting\n";

	return 0;
}

[icing]

Thanks @jay! I made #19251 to address this: the SSL session cache is only used when configured and available. I hope this solves the issue.

@Marc-Aldorasi-Imprivata would you be able to verify this from your side? Thanks.

[Marc-Aldorasi-Imprivata]

@icing That fixes the issue for me, both in the original program and the program I posted in the OP.

Output on PR #19251

* [0-x] !!! WARNING !!!
* [0-x] This is a debug build of libcurl, do not use in production.
* [0-x] [MULTI] [INIT] added to multi, mid=1, running=1, total=2
* [0-x] [MULTI] [INIT] multi_wait(fds=0, timeout=0) tinternal=0
* [0-x] [MULTI] [INIT] -> [SETUP] (line 2415)
* [0-x] [MULTI] [SETUP] -> [CONNECT] (line 2431)
* [0-x] [READ] client_reset, clear readers
* [0-0] [MULTI] [CONNECT] [CPOOL] added connection 0. The cache now contains 1 members
* [0-0] Host localhost:1234 was resolved.
* [0-0] IPv6: ::1
* [0-0] IPv4: 127.0.0.1
* [0-0] [HTTPS-CONNECT] adding wanted h2
* [0-0] [HTTPS-CONNECT] added
* [0-0] [MULTI] [CONNECT] -> [CONNECTING] (line 2342)
* [0-0] [HTTPS-CONNECT] connect, init
* [0-0] [HAPPY-EYEBALLS] init ip ballers for transport 3
* [0-0] [HAPPY-EYEBALLS] starting first attempt for ipv6 -> 0
* [0-0]   Trying [::1]:1234...
* [0-0] [TCP] cf_socket_open() -> 0, fd=320
* [0-0] [TCP] local address ::1 port 51329...
* [0-0] [HAPPY-EYEBALLS] checked connect attempts: 1 ongoing, 0 inconclusive
* [0-0] [HAPPY-EYEBALLS] next HAPPY_EYBALLS timeout in 200ms
* [0-0] [TIMER] [HAPPY_EYEBALLS] set for 200000ns
* [0-0] [HTTPS-CONNECT] connect -> 0, done=0
* [0-0] [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
* [0-0] [TCP] adjust_pollset, !connected, POLLOUT fd=320
* [0-0] [HAPPY-EYEBALLS] adjust_pollset -> 0, 1 socks
* [0-0] [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
* [0-0] [MULTI] [CONNECTING] multi_wait pollset[fd=320 OUT], timeouts=1
* [0-0] [TIMER] [HAPPY_EYEBALLS] expires in 199864ns
* [0-0] [TIMER] [HAPPY_EYEBALLS] gives multi timeout in 200ms
* [0-0] [MULTI] [CONNECTING] multi_wait(fds=1, timeout=200) tinternal=200
* [0-0] [TCP] connected on fd=320
* [0-0] [HAPPY-EYEBALLS] connect attempt #0 successful
* [0-0] [TIMER] [HAPPY_EYEBALLS] cleared
* [0-0] [HAPPY-EYEBALLS] Connected to localhost (::1) port 1234
* [0-0] [SSL] cf_connect()
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 1/3)
* [0-0] [SSLS] find peer slot for localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G among 3 slots
* [0-0] [SSLS] peer not found for localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G
* [0-0] [SSLS] No cached session for 'localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G'
* [0-0] schannel: disabled server cert revocation checks
* [0-0] schannel: disabled automatic use of client certificate
* [0-0] ALPN: curl offers http/1.1
* [0-0] schannel: sending initial handshake data: sending 277 bytes.
* [0-0] [TCP] send(len=277) -> 0, 277
* [0-0] schannel: sent initial handshake data: sent 277 bytes
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 2/3)
* [0-0] [TCP] recv(len=4096) -> 81, 0
* [0-0] schannel: failed to receive handshake, need more data
* [0-0] [SSL] cf_connect() -> 0, done=0
* [0-0] [HTTPS-CONNECT] connect -> 0, done=0
* [0-0] [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
* [0-0] [SSL] adjust_pollset, POLLIN fd=320
* [0-0] [TCP] adjust_pollset, !active, POLLIN fd=320
* [0-0] [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
* [0-0] [MULTI] [CONNECTING] multi_wait pollset[fd=320 IN], timeouts=0
* [0-0] [MULTI] [CONNECTING] multi_wait(fds=1, timeout=192) tinternal=192
* [0-0] [SSL] cf_connect()
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 2/3)
* [0-0] [TCP] recv(len=4096) -> 0, 1359
* [0-0] schannel: sending next handshake data: sending 80 bytes.
* [0-0] [TCP] send(len=80) -> 0, 80
* [0-0] schannel: SSL/TLS handshake complete
* [0-0] schannel: connection hostname (localhost) validated against certificate name (localhost)
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 3/3)
* [0-0] ALPN: server did not agree on a protocol. Uses default.
* [0-0] [SSLS] find peer slot for localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G among 3 slots
* [0-0] [SSLS] peer not found for localhost:1234:NO-VRFY-PEER:TLSVER-6-0:IMPL-Schannel:G
* [0-0] [SSL] cf_connect() -> 0, done=1
* [0-0] [HTTPS-CONNECT] connect+handshake h2: 29ms, 1st data: 16ms
* [0-0] [HTTPS-CONNECT] connect -> 0, done=1
* [0-0] [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=1
* [0-0] Established connection to localhost (::1 port 1234) from ::1 port 51329
* [0-0] [MULTI] [CONNECTING] -> [PROTOCONNECT] (line 2470)
* [0-0] [MULTI] [PROTOCONNECT] -> [DO] (line 2501)
* [0-0] [MULTI] [DO] -> [DONE] (line 2109)
* [0-0] [MULTI] [DONE] multi_done: status: 0 prem: 0 done: 0
* [0-0] [WRITE] [OUT] done
* [0-0] [READ] client_reset, clear readers
* [0-x] [MULTI] [DONE] multi_done_locked, in use=0
* [0-0] Connection #0 to host localhost:1234 left intact
* [0-0] [MULTI] [DONE] -> [COMPLETED] (line 2636)
* [0-0] [MULTI] [COMPLETED] [TIMEOUT] all cleared
* [0-0] [MULTI] [COMPLETED] -> [MSGSENT] (line 2744)
* [0-0] [MULTI] [COMPLETED] removed from multi, mid=1, running=0, total=1
* [0-0] [TCP] recv(len=4096) -> 0, 4096
* [0-0] schannel: remote party requests renegotiation
* [0-0] schannel: renegotiating SSL/TLS connection
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 2/3)
* [0-0] schannel: SSL/TLS handshake complete
* [0-0] schannel: connection hostname (localhost) validated against certificate name (localhost)
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 3/3)
* [0-0] schannel: SSL/TLS connection renegotiated
* [0-0] schannel: remote party requests renegotiation
* [0-0] schannel: renegotiating SSL/TLS connection
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 2/3)
* [0-0] schannel: SSL/TLS handshake complete
* [0-0] schannel: connection hostname (localhost) validated against certificate name (localhost)
* [0-0] schannel: SSL/TLS connection with localhost port 1234 (step 3/3)
* [0-0] schannel: SSL/TLS connection renegotiated
* [0-0] [TCP] recv(len=1534) -> 0, 1534
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
* [0-0] [TCP] recv(len=1024) -> 0, 1024
Read byte 'y'; exiting

[jay]

I made #19251 to address this: the SSL session cache is only used when configured and available.

AFAICT the fix makes it so that session cache is not available in this case, but should it be? In other words should SSL session tickets be recorded for connect_only connections?