RE: slow https conenctions
Hi, Just to let everyone know that the problem turned out to be that SSL applications on Windows (the TortoiseSVN client in our case) lookup www.download.windowsupdate.com to get updates to the certificate revocation list. See http://support.microsoft.com/kb/317541 We operate in an environment with no direct internet access (proxy only) so this request failed and made a 15 second pause on every connection. regards Matthew J Fletcher ** Serck Controls Ltd, Rowley Drive, Coventry, CV3 4FH, UK A company registered in England Reg. No. 4353634 Tel: +44 (0) 24 7630 5050 Fax: +44 (0) 24 7630 2437 Web: www.serck-controls.com Admin: p...@serck-controls.co.uk A subsidiary of Schneider Electric. ** This email and files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the above. Any views or opinions presented are those of the author and do not necessarily represent those of Serck Controls Ltd. This message has been scanned for malware by Mailcontrol. www.Mailcontrol.com __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: slow https conenctions
I suspect client behavior is incorrect. It could have to do with 1.1 HTTP, especially if client is PHP (because of 100 continue problems). There are several other documented delays including a 15 second default keep alive. There is also a cURL problem that can cause this on the client side. http://curl.haxx.se/mail/curlphp-2005-01/0011.html http://php.net/manual/en/function.file-get-contents.php Eric At 03:06 AM 4/26/2011, Matthew Fletcher wrote: Hi, I've come to this list in search of help with slow https conenctions (via the subversion, apache and finally mod_ssl lits). There is a 15 second ish delay whenever a client connects using https, i've tracked this down in the logs to the snippet shown. -- snip -- [Thu Apr 21 11:21:49 2011] [info] Connection: Client IP: 127.0.0.1, Protocol: TLSv1, Cipher: DHE-RSA-AES256-SHA (256/256 bits) [Thu Apr 21 11:22:07 2011] [debug] ssl_engine_io.c(1889): OpenSSL: read 5/5 bytes from BIO#c99cd0 [mem: ca14b0] (BIO dump follows) -- end -- But i really dont know how to get any further. This machine is pretty powerful, quad 3ghz xeon etc. Full log from startup bellow,.. any help / ideas much appreciated. [Thu Apr 21 11:21:16 2011] [info] Init: Initializing (virtual) servers for SSL [Thu Apr 21 11:21:16 2011] [info] Configuring server for SSL protocol [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(465): Creating new SSL context (protocols: SSLv3, TLSv1) [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(661): Configuring permitted SSL ciphers [ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM] [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(420): Configuring TLS extension handling [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(792): Configuring RSA server certificate [Thu Apr 21 11:21:16 2011] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(831): Configuring RSA server private key [Thu Apr 21 11:21:16 2011] [info] mod_ssl/2.2.17 compiled against Server: Apache/2.2.17, Library: OpenSSL/0.9.8r [Thu Apr 21 11:21:16 2011] [notice] Child 3268: Child process is running [Thu Apr 21 11:21:16 2011] [debug] mpm_winnt.c(408): Child 3268: Retrieved our scoreboard from the parent. [Thu Apr 21 11:21:16 2011] [info] Parent: Duplicating socket 276 and sending it to child process 3268 [Thu Apr 21 11:21:16 2011] [debug] mpm_winnt.c(605): Parent: Sent 1 listeners to child 3268 [Thu Apr 21 11:21:16 2011] [debug] mpm_winnt.c(564): Child 3268: retrieved 1 listeners from parent [Thu Apr 21 11:21:16 2011] [notice] Child 3268: Acquired the start mutex. [Thu Apr 21 11:21:16 2011] [notice] Child 3268: Starting 64 worker threads. [Thu Apr 21 11:21:16 2011] [notice] Child 3268: Listening on port 443. [Thu Apr 21 11:21:49 2011] [info] [client 127.0.0.1] Connection to child 0 established (server pl161.serck-uk.internal:443) [Thu Apr 21 11:21:49 2011] [info] Seeding PRNG with 144 bytes of entropy [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_kernel.c(1866): OpenSSL: Handshake: start [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: before/accept initialization [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1889): OpenSSL: read 11/11 bytes from BIO#c99cd0 [mem: ca14b0] (BIO dump follows) [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1822): +-+ [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | : 16 03 01 00 df 01 00 00-db 03 01 ... | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1867): +-+ [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1889): OpenSSL: read 217/217 bytes from BIO#c99cd0 [mem: ca14bb] (BIO dump follows) [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1822): +-+ [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | : 4d b0 05 3d 24 b5 92 40-cb c0 c7 84 df 99 b8 2f M..=$..@.../ | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0010: 1c 49 78 19 74 74 b3 0d-3f 89 d3 3d 7a 90 7c 50 .Ix.tt..?..=z.|P | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0020: 00 00 5c c0 14 c0 0a 00-39 00 38 00 88 00 87 c0 ..\\.9.8. | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0030: 0f c0 05 00 35 00 84 c0-12 c0 08 00 16 00 13 c0 5... | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0040: 0d c0 03 00 0a c0 13 c0-09 00 33 00 32 00 9a 00 ..3.2... | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0050: 99 00 45 00 44 c0 0e c0-04 00 2f 00 96 00 41 00 ..E.D./...A. | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0060: 07 c0 11 c0 07 c0 0c c0-02 00 05 00 04 00 15 00 | [Thu Apr 21 11:21:49 20
Re: slow https conenctions
Hi, > Thanks for the input guys, however the 15 second pause exists even if i > explicitly disable reverse lookups in apache 'Hostnamelookups Off' in > httpd.conf and my server is operating on an internal network in a company so > although i cant say for sure i doubt there is much IPV6 stuff around. the debug will probably show you this - but I dont think its a server issue per se - its an issue at the client end. check the behaviour and environment of the end client alan __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: slow https conenctions
Matthew Fletcher wrote: Hi, Thanks for the input guys, however the 15 second pause exists even if i explicitly disable reverse lookups in apache 'Hostnamelookups Off' in httpd.conf and my server is operating on an internal network in a company so although i cant say for sure i doubt there is much IPV6 stuff around. Does anyone how how i would establish if there was a DNS related delay ? some tool that could test DNS and name lookup speeds ? i am a software guy trying to use SVN not a network guy tcpdump/wireshark/ethereal to watch what packets are sent, where and with what timings. The fact it works with a non-SSL connection means little, as the non-SSL connection won't be trying to do a reverse lookup to see if the certficate name matches the name bound to the IP address __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: slow https conenctions
* Matthew Fletcher, Wednesday, April 27, 2011 12:40 PM > I guess that does not 100% rule out DNS/Network stuff, as SSL > could be doing extra network lookups. > > Are there any more SSL diagnostics i can enable to try and > pinpoint the problem ? maybe checking with strace -ttt -p ... which operation takes so long? oki, Steffen About Ingenico: Ingenico is a leading provider of payment, transaction and business solutions, with over 15 million terminals deployed in more than 125 countries. Over 3,000 employees worldwide support merchants, banks and service providers to optimize and secure their electronic payments solutions, develop their offer of services and increase their point of sales revenue. http://www.ingenico.com/. This message may contain confidential and/or privileged information. If you are not the addressee or authorized to receive this for the addressee, you must not use, copy, disclose or take any action based on this message or any information herein. If you have received this message in error, please advise the sender immediately by reply e-mail and delete this message. Thank you for your cooperation. P Please consider the environment before printing this e-mail __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: slow https conenctions
Hi, Just to test if my slowness is SSL or DNS/Network related i switched the server in http mode and got the guys to re-connect. Connection times are now sub-second. So my slowness is definatly https / SSL related. I guess that does not 100% rule out DNS/Network stuff, as SSL could be doing extra network lookups. Are there any more SSL diagnostics i can enable to try and pinpoint the problem ? regards Matthew J Fletcher ** Serck Controls Ltd, Rowley Drive, Coventry, CV3 4FH, UK A company registered in England Reg. No. 4353634 Tel: +44 (0) 24 7630 5050 Fax: +44 (0) 24 7630 2437 Web: www.serck-controls.com Admin: p...@serck-controls.co.uk A subsidiary of Schneider Electric. ** This email and files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the above. Any views or opinions presented are those of the author and do not necessarily represent those of Serck Controls Ltd. This message has been scanned for malware by Mailcontrol. www.Mailcontrol.com __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
RE: slow https conenctions
Hi, Thanks for the input guys, however the 15 second pause exists even if i explicitly disable reverse lookups in apache 'Hostnamelookups Off' in httpd.conf and my server is operating on an internal network in a company so although i cant say for sure i doubt there is much IPV6 stuff around. Does anyone how how i would establish if there was a DNS related delay ? some tool that could test DNS and name lookup speeds ? i am a software guy trying to use SVN not a network guy regards Matthew J Fletcher > -Original Message- > From: Alan Buxey [mailto:a.l.m.bu...@lboro.ac.uk] > Sent: 26 April 2011 23:05 > To: openssl-users@openssl.org > Cc: Matthew Fletcher > Subject: Re: slow https conenctions > > Hi, > > On 04/26/11 3:06 AM, Matthew Fletcher wrote: > > > I've come to this list in search of help with slow https > conenctions (via the subversion, apache and finally mod_ssl lits). > > > > > > There is a 15 second ish delay whenever a client connects using > > > https, > > > > 15 seconds sounds to *me* like a DNS related timeout. perhaps the > > server is doing a reverse lookup on the client? > > ...or is getting a record, trying to connect to that > IPv6 addressand failing, then falling back to IPv4 > > alan > ** Serck Controls Ltd, Rowley Drive, Coventry, CV3 4FH, UK A company registered in England Reg. No. 4353634 Tel: +44 (0) 24 7630 5050 Fax: +44 (0) 24 7630 2437 Web: www.serck-controls.com Admin: p...@serck-controls.co.uk A subsidiary of Schneider Electric. ** This email and files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the above. Any views or opinions presented are those of the author and do not necessarily represent those of Serck Controls Ltd. This message has been scanned for malware by Mailcontrol. www.Mailcontrol.com __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: slow https conenctions
Hi, > On 04/26/11 3:06 AM, Matthew Fletcher wrote: > > I've come to this list in search of help with slow https conenctions (via > > the subversion, apache and finally mod_ssl lits). > > > > There is a 15 second ish delay whenever a client connects using https, > > 15 seconds sounds to *me* like a DNS related timeout. perhaps the > server is doing a reverse lookup on the client? ...or is getting a record, trying to connect to that IPv6 addressand failing, then falling back to IPv4 alan __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
Re: slow https conenctions
On 04/26/11 3:06 AM, Matthew Fletcher wrote: I've come to this list in search of help with slow https conenctions (via the subversion, apache and finally mod_ssl lits). There is a 15 second ish delay whenever a client connects using https, 15 seconds sounds to *me* like a DNS related timeout. perhaps the server is doing a reverse lookup on the client? __ OpenSSL Project http://www.openssl.org User Support Mailing Listopenssl-users@openssl.org Automated List Manager majord...@openssl.org
slow https conenctions
Hi, I've come to this list in search of help with slow https conenctions (via the subversion, apache and finally mod_ssl lits). There is a 15 second ish delay whenever a client connects using https, i've tracked this down in the logs to the snippet shown. -- snip -- [Thu Apr 21 11:21:49 2011] [info] Connection: Client IP: 127.0.0.1, Protocol: TLSv1, Cipher: DHE-RSA-AES256-SHA (256/256 bits) [Thu Apr 21 11:22:07 2011] [debug] ssl_engine_io.c(1889): OpenSSL: read 5/5 bytes from BIO#c99cd0 [mem: ca14b0] (BIO dump follows) -- end -- But i really dont know how to get any further. This machine is pretty powerful, quad 3ghz xeon etc. Full log from startup bellow,.. any help / ideas much appreciated. [Thu Apr 21 11:21:16 2011] [info] Init: Initializing (virtual) servers for SSL [Thu Apr 21 11:21:16 2011] [info] Configuring server for SSL protocol [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(465): Creating new SSL context (protocols: SSLv3, TLSv1) [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(661): Configuring permitted SSL ciphers [ALL:!aNULL:!ADH:!eNULL:!LOW:!EXP:RC4+RSA:+HIGH:+MEDIUM] [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(420): Configuring TLS extension handling [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(792): Configuring RSA server certificate [Thu Apr 21 11:21:16 2011] [warn] RSA server certificate is a CA certificate (BasicConstraints: CA == TRUE !?) [Thu Apr 21 11:21:16 2011] [debug] ssl_engine_init.c(831): Configuring RSA server private key [Thu Apr 21 11:21:16 2011] [info] mod_ssl/2.2.17 compiled against Server: Apache/2.2.17, Library: OpenSSL/0.9.8r [Thu Apr 21 11:21:16 2011] [notice] Child 3268: Child process is running [Thu Apr 21 11:21:16 2011] [debug] mpm_winnt.c(408): Child 3268: Retrieved our scoreboard from the parent. [Thu Apr 21 11:21:16 2011] [info] Parent: Duplicating socket 276 and sending it to child process 3268 [Thu Apr 21 11:21:16 2011] [debug] mpm_winnt.c(605): Parent: Sent 1 listeners to child 3268 [Thu Apr 21 11:21:16 2011] [debug] mpm_winnt.c(564): Child 3268: retrieved 1 listeners from parent [Thu Apr 21 11:21:16 2011] [notice] Child 3268: Acquired the start mutex. [Thu Apr 21 11:21:16 2011] [notice] Child 3268: Starting 64 worker threads. [Thu Apr 21 11:21:16 2011] [notice] Child 3268: Listening on port 443. [Thu Apr 21 11:21:49 2011] [info] [client 127.0.0.1] Connection to child 0 established (server pl161.serck-uk.internal:443) [Thu Apr 21 11:21:49 2011] [info] Seeding PRNG with 144 bytes of entropy [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_kernel.c(1866): OpenSSL: Handshake: start [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_kernel.c(1874): OpenSSL: Loop: before/accept initialization [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1889): OpenSSL: read 11/11 bytes from BIO#c99cd0 [mem: ca14b0] (BIO dump follows) [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1822): +-+ [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | : 16 03 01 00 df 01 00 00-db 03 01 ... | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1867): +-+ [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1889): OpenSSL: read 217/217 bytes from BIO#c99cd0 [mem: ca14bb] (BIO dump follows) [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1822): +-+ [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | : 4d b0 05 3d 24 b5 92 40-cb c0 c7 84 df 99 b8 2f M..=$..@.../ | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0010: 1c 49 78 19 74 74 b3 0d-3f 89 d3 3d 7a 90 7c 50 .Ix.tt..?..=z.|P | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0020: 00 00 5c c0 14 c0 0a 00-39 00 38 00 88 00 87 c0 ..\\.9.8. | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0030: 0f c0 05 00 35 00 84 c0-12 c0 08 00 16 00 13 c0 5... | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0040: 0d c0 03 00 0a c0 13 c0-09 00 33 00 32 00 9a 00 ..3.2... | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0050: 99 00 45 00 44 c0 0e c0-04 00 2f 00 96 00 41 00 ..E.D./...A. | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0060: 07 c0 11 c0 07 c0 0c c0-02 00 05 00 04 00 15 00 | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0070: 12 00 09 00 14 00 11 00-08 00 06 00 03 00 ff 01 | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0080: 00 00 56 00 00 00 0e 00-0c 00 00 09 6c 6f 63 61 ..V.loca | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 0090: 6c 68 6f 73 74 00 0b 00-04 03 00 01 02 00 0a 00 lhost... | [Thu Apr 21 11:21:49 2011] [debug] ssl_engine_io.c(1861): | 00a0: 34 00 32 00 01 00 02 00-03 00 0
