diff --git a/ssl/test/bssl_shim.cc b/ssl/test/bssl_shim.cc
index f8a84e6..f06ccd3 100644
--- a/ssl/test/bssl_shim.cc
+++ b/ssl/test/bssl_shim.cc
@@ -12,15 +12,22 @@
  * OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN
  * CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. */
 
-#include <sys/types.h>
-#include <sys/socket.h>
-#include <netinet/in.h>
 #include <arpa/inet.h>
+#include <netinet/in.h>
+#include <signal.h>
+#include <sys/socket.h>
+#include <sys/types.h>
 #include <unistd.h>
 
-#include <openssl/ssl.h>
 #include <openssl/bio.h>
 #include <openssl/bytestring.h>
+#include <openssl/ssl.h>
+
+static int usage(const char *program) {
+  fprintf(stderr, "Usage: %s (client|server) (normal|resume) [flags...]\n",
+          program);
+  return 1;
+}
 
 static const char *expected_server_name = NULL;
 static int early_callback_called = 0;
@@ -83,14 +90,12 @@
   return SSL_TLSEXT_ERR_OK;
 }
 
-static SSL *setup_test(int is_server) {
+static SSL_CTX *setup_ctx(int is_server) {
   if (!SSL_library_init()) {
     return NULL;
   }
 
   SSL_CTX *ssl_ctx = NULL;
-  SSL *ssl = NULL;
-  BIO *bio = NULL;
 
   ssl_ctx = SSL_CTX_new(
       is_server ? SSLv23_server_method() : SSLv23_client_method());
@@ -106,23 +111,38 @@
     goto err;
   }
 
+  SSL_CTX_set_session_cache_mode(ssl_ctx, SSL_SESS_CACHE_BOTH);
+
   ssl_ctx->select_certificate_cb = select_certificate_callback;
 
   SSL_CTX_set_next_protos_advertised_cb(
       ssl_ctx, next_protos_advertised_callback, NULL);
 
+  return ssl_ctx;
+
+ err:
+  if (ssl_ctx != NULL) {
+    SSL_CTX_free(ssl_ctx);
+  }
+  return NULL;
+}
+
+static SSL *setup_ssl(SSL_CTX *ssl_ctx, int fd) {
+  SSL *ssl = NULL;
+  BIO *bio = NULL;
+
   ssl = SSL_new(ssl_ctx);
   if (ssl == NULL) {
     goto err;
   }
 
-  bio = BIO_new_fd(3, 1 /* take ownership */);
+
+  bio = BIO_new_fd(fd, 1 /* take ownership */);
   if (bio == NULL) {
     goto err;
   }
 
   SSL_set_bio(ssl, bio, bio);
-  SSL_CTX_free(ssl_ctx);
 
   return ssl;
 
@@ -133,37 +153,30 @@
   if (ssl != NULL) {
     SSL_free(ssl);
   }
-  if (ssl_ctx != NULL) {
-    SSL_CTX_free(ssl_ctx);
-  }
   return NULL;
 }
 
-int main(int argc, char **argv) {
-  int i, is_server, ret;
+static int do_exchange(SSL_SESSION **out_session,
+                       SSL_CTX *ssl_ctx,
+                       int argc,
+                       char **argv,
+                       int is_server,
+                       int is_resume,
+                       int fd,
+                       SSL_SESSION *session) {
   const char *expected_certificate_types = NULL;
   const char *expected_next_proto = NULL;
+  expected_server_name = NULL;
+  early_callback_called = 0;
+  advertise_npn = NULL;
 
-  if (argc < 2) {
-    fprintf(stderr, "Usage: %s (client|server) [flags...]\n", argv[0]);
-    return 1;
-  }
-  if (strcmp(argv[1], "client") == 0) {
-    is_server = 0;
-  } else if (strcmp(argv[1], "server") == 0) {
-    is_server = 1;
-  } else {
-    fprintf(stderr, "Usage: %s (client|server) [flags...]\n", argv[0]);
-    return 1;
-  }
-
-  SSL *ssl = setup_test(is_server);
+  SSL *ssl = setup_ssl(ssl_ctx, fd);
   if (ssl == NULL) {
     BIO_print_errors_fp(stdout);
     return 1;
   }
 
-  for (i = 2; i < argc; i++) {
+  for (int i = 0; i < argc; i++) {
     if (strcmp(argv[i], "-fallback-scsv") == 0) {
       if (!SSL_enable_fallback_scsv(ssl)) {
         BIO_print_errors_fp(stdout);
@@ -227,6 +240,14 @@
     }
   }
 
+  if (session != NULL) {
+    if (SSL_set_session(ssl, session) != 1) {
+      fprintf(stderr, "failed to set session\n");
+      return 2;
+    }
+  }
+
+  int ret;
   if (is_server) {
     ret = SSL_accept(ssl);
   } else {
@@ -238,6 +259,11 @@
     return 2;
   }
 
+  if (is_resume && !SSL_session_reused(ssl)) {
+    fprintf(stderr, "session was not reused\n");
+    return 2;
+  }
+
   if (expected_server_name) {
     const char *server_name =
         SSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
@@ -299,6 +325,68 @@
     }
   }
 
+  if (out_session) {
+    *out_session = SSL_get1_session(ssl);
+  }
+
+  SSL_shutdown(ssl);
   SSL_free(ssl);
   return 0;
 }
+
+int main(int argc, char **argv) {
+  int is_server, resume;
+
+  signal(SIGPIPE, SIG_IGN);
+
+  if (argc < 3) {
+    return usage(argv[0]);
+  }
+
+  if (strcmp(argv[1], "client") == 0) {
+    is_server = 0;
+  } else if (strcmp(argv[1], "server") == 0) {
+    is_server = 1;
+  } else {
+    return usage(argv[0]);
+  }
+
+  if (strcmp(argv[2], "normal") == 0) {
+    resume = 0;
+  } else if (strcmp(argv[2], "resume") == 0) {
+    resume = 1;
+  } else {
+    return usage(argv[0]);
+  }
+
+  SSL_CTX *ssl_ctx = setup_ctx(is_server);
+  if (ssl_ctx == NULL) {
+    BIO_print_errors_fp(stdout);
+    return 1;
+  }
+
+  SSL_SESSION *session;
+  int ret = do_exchange(&session,
+                        ssl_ctx,
+                        argc - 3, argv + 3,
+                        is_server, 0 /* is_resume */,
+                        3 /* fd */, NULL /* session */);
+  if (ret != 0) {
+    return ret;
+  }
+
+  if (resume) {
+    int ret = do_exchange(NULL,
+                          ssl_ctx, argc - 3, argv + 3,
+                          is_server, 1 /* is_resume */,
+                          4 /* fd */,
+                          is_server ? NULL : session);
+    if (ret != 0) {
+      return ret;
+    }
+  }
+
+  SSL_SESSION_free(session);
+  SSL_CTX_free(ssl_ctx);
+  return 0;
+}
diff --git a/ssl/test/runner/runner.go b/ssl/test/runner/runner.go
index 06ca860..539a746 100644
--- a/ssl/test/runner/runner.go
+++ b/ssl/test/runner/runner.go
@@ -76,6 +76,9 @@
 	certFile string
 	// keyFile is the path to the private key to use for the server.
 	keyFile string
+	// resumeSession controls whether a second connection should be tested
+	// which resumes the first session.
+	resumeSession bool
 	// flags, if not empty, contains a list of command-line flags that will
 	// be passed to the shim program.
 	flags []string
@@ -261,7 +264,15 @@
 	},
 }
 
-func doExchange(tlsConn *Conn, messageLen int) error {
+func doExchange(testType testType, config *Config, conn net.Conn, messageLen int) error {
+	var tlsConn *Conn
+	if testType == clientTest {
+		tlsConn = Server(conn, config)
+	} else {
+		config.InsecureSkipVerify = true
+		tlsConn = Client(conn, config)
+	}
+
 	if err := tlsConn.Handshake(); err != nil {
 		return err
 	}
@@ -308,7 +319,7 @@
 	return exec.Command("xterm", xtermArgs...)
 }
 
-func runTest(test *testCase) error {
+func openSocketPair() (shimEnd *os.File, conn net.Conn) {
 	socks, err := syscall.Socketpair(syscall.AF_UNIX, syscall.SOCK_STREAM, 0)
 	if err != nil {
 		panic(err)
@@ -316,13 +327,22 @@
 
 	syscall.CloseOnExec(socks[0])
 	syscall.CloseOnExec(socks[1])
-	shimEnd := os.NewFile(uintptr(socks[0]), "shim end")
+	shimEnd = os.NewFile(uintptr(socks[0]), "shim end")
 	connFile := os.NewFile(uintptr(socks[1]), "our end")
-	conn, err := net.FileConn(connFile)
+	conn, err = net.FileConn(connFile)
+	if err != nil {
+		panic(err)
+	}
 	connFile.Close()
 	if err != nil {
 		panic(err)
 	}
+	return shimEnd, conn
+}
+
+func runTest(test *testCase) error {
+	shimEnd, conn := openSocketPair()
+	shimEndResume, connResume := openSocketPair()
 
 	const shim_path = "../../../build/ssl/test/bssl_shim"
 	flags := []string{}
@@ -330,7 +350,15 @@
 		flags = append(flags, "client")
 	} else {
 		flags = append(flags, "server")
+	}
 
+	if test.resumeSession {
+		flags = append(flags, "resume")
+	} else {
+		flags = append(flags, "normal")
+	}
+
+	if test.testType == serverTest {
 		flags = append(flags, "-key-file")
 		if test.keyFile == "" {
 			flags = append(flags, rsaKeyFile)
@@ -354,7 +382,7 @@
 		shim = exec.Command(shim_path, flags...)
 	}
 	// shim = gdbOf(shim_path, flags...)
-	shim.ExtraFiles = []*os.File{shimEnd}
+	shim.ExtraFiles = []*os.File{shimEnd, shimEndResume}
 	shim.Stdin = os.Stdin
 	var stdoutBuf, stderrBuf bytes.Buffer
 	shim.Stdout = &stdoutBuf
@@ -364,22 +392,23 @@
 		panic(err)
 	}
 	shimEnd.Close()
+	shimEndResume.Close()
 
 	config := test.config
-
-	var tlsConn *Conn
+	config.ClientSessionCache = NewLRUClientSessionCache(1)
 	if test.testType == clientTest {
 		if len(config.Certificates) == 0 {
 			config.Certificates = []Certificate{getRSACertificate()}
 		}
-		tlsConn = Server(conn, &config)
-	} else {
-		config.InsecureSkipVerify = true
-		tlsConn = Client(conn, &config)
 	}
-	err = doExchange(tlsConn, test.messageLen)
 
+	err := doExchange(test.testType, &config, conn, test.messageLen)
 	conn.Close()
+	if err == nil && test.resumeSession {
+		err = doExchange(test.testType, &config, connResume, test.messageLen)
+		connResume.Close()
+	}
+
 	childErr := shim.Wait()
 
 	stdout := string(stdoutBuf.Bytes())
@@ -473,6 +502,11 @@
 				continue
 			}
 
+			// Go's TLS implementation only implements session
+			// resumption with tickets, so SSLv3 cannot resume
+			// sessions.
+			resumeSession := ver.version != VersionSSL30
+
 			testCases = append(testCases, testCase{
 				testType: clientTest,
 				name:     ver.name + "-" + suite.name + "-client",
@@ -482,6 +516,7 @@
 					CipherSuites: []uint16{suite.id},
 					Certificates: []Certificate{cert},
 				},
+				resumeSession: resumeSession,
 			})
 
 			// Go's TLS implementation implements SSLv3 as a server,
@@ -499,8 +534,9 @@
 						CipherSuites: []uint16{suite.id},
 						Certificates: []Certificate{cert},
 					},
-					certFile: certFile,
-					keyFile:  keyFile,
+					certFile:      certFile,
+					keyFile:       keyFile,
+					resumeSession: resumeSession,
 				})
 			}
 		}