The handshake failed and the session id is accessed through your access logging pattern.

Looking at the Panama code there could be an optimistic use of the SSL_get_session call (it would return NULL if there's no session because handshake failed).

The native code seems to have the same problem, since it does:
    UNREFERENCED(o);
    session = SSL_get_session(ssl_);
    session_id = SSL_SESSION_get_id(session, &len);

While other places do:
    session  = SSL_get_session(ssl_);
    if (session) {
        return SSL_get_time(session);
    } else {
        tcn_ThrowException(e, "ssl session is null");
        return 0;
    }

Proposed patch for tcnative:

diff --git a/native/src/ssl.c b/native/src/ssl.c
index d59246ea3..5329a93da 100644
--- a/native/src/ssl.c
+++ b/native/src/ssl.c
@@ -2001,8 +2001,12 @@ TCN_IMPLEMENT_CALL(jbyteArray, SSL, getSessionId)(TCN_STDARGS, jlong ssl)
     }
     UNREFERENCED(o);
     session = SSL_get_session(ssl_);
-    session_id = SSL_SESSION_get_id(session, &len);
+    if (NULL == session) {
+        tcn_ThrowException(e, "ssl session is null");
+        return NULL;
+    }
 
+    session_id = SSL_SESSION_get_id(session, &len);
     if (len == 0 || session_id == NULL) {
         return NULL;
     }
diff --git a/native/src/sslnetwork.c b/native/src/sslnetwork.c
index 6e5960f91..46b253ec8 100644
--- a/native/src/sslnetwork.c
+++ b/native/src/sslnetwork.c
@@ -689,7 +689,7 @@ TCN_IMPLEMENT_CALL(jint, SSLSocket, renegotiate)(TCN_STDARGS,
 
 #if defined(SSL_OP_NO_TLSv1_3)
     session  = SSL_get_session(con->ssl);
-    if (SSL_SESSION_get_protocol_version(session) == TLS1_3_VERSION) {
+    if (NULL != session && SSL_SESSION_get_protocol_version(session) == TLS1_3_VERSION) {
         // TLS 1.3 renegotiation
         retVal = SSL_verify_client_post_handshake(con->ssl);
         if (retVal <= 0) {

JF seems to think simply return NULL; is enough (I agree this is not an error). I left the bug open since it has not been addressed. I don't maintain the native code and I am more likely to inadvertently break something.

Also the second check may not be needed, on renegotiate there would be a session I suppose.

in openssl: ./ssl/ssl_sess.c
{
    if (len)
        *len = (unsigned int)s->session_id_length;
    return s->session_id;
}

So +1 for testing for NULL.

I am curious how you manage to get error, I don't see how the jakarta.servlet.request.ssl_session_id could be read with a failed handshake...

(In reply to Remy Maucherat from comment #3)
> JF seems to think simply return NULL; is enough (I agree this is not an
> error).

Aha, so simply return NULL instead of throwing an exception?

> Also the second check may not be needed, on renegotiate there would be a
> session I suppose.

I just figured an extra check is better than a crash... just in case :)

Thanks all for the report, proposed patch and review.

Variation of patch applied to 1.2.x for 1.2.33 onwards.