up vote 2 down vote favorite
1
share [g+] share [fb]

I have trouble with some problem using HTTPS. Sometimes, HTTPS connection is too slow only Chrome. I couldn't find any problem on server. It use load balancer with 2 web server(apache) on Amazon EC2. The certification for SSL is in the each server.

I don't know how to examine this problem. I tried to examine using TCP trace, Chrome diagnostic tool. It seems to look okay.

How can I examine this problem?

Thanks!

link|improve this question
If you're using a load balancer, why don't you have the SSL certificate on it? i.e. A load balancing SSL proxy – HTTP500 Dec 11 '11 at 20:42
@HTTP500 That'd violate some organizations' security policies, as the decrypted data would be travelling in-the-clear across Amazon's network after that. – ceejayoz Dec 11 '11 at 21:40
@ceejayoz, Good point, I didn't know you STILL can't get a private VLAN with AWS. I'd go to another cloud provider that can offer. – HTTP500 Dec 12 '11 at 15:59
You can with VPC. – ceejayoz Dec 12 '11 at 16:01
@ceejayoz, Then I'd use VPC and put the SSL certificate on the LB SSL proxy. – HTTP500 Dec 12 '11 at 18:18
show 2 more comments
feedback

3 Answers

up vote 0 down vote

Could be related to your CRL(*). AFAIK chrome does checks CRL while Firefox does not, and I don't know about IE.

Try with "check for server certificate revocation" enabled and disabled. I have no idea though how often chrome checks the CRL lists.

That's what I can think of. Could be something else as well.

--cut here--

(*) For those who happen to be new to SSL: CRL (Certificate Revocation List) - normally SSL certificate stores an address where it's possible to check if this certificate is not revoked. There's two protocols for such check - one is OSCP another one is CRL. Browsers once encounter SSL certificate may check if it isn't revoked (if they actually do it or not depends on browser and your settings). This check often disabled, but when it is enabled, browser may first contact revocation server and only then load the web page.

link|improve this answer
I've also tested with "check for server certificate revocation" But It looks same problem if I don't check it. – Hwan Dec 11 '11 at 22:17
If so it's probably not CRL issue – Sandman4 Dec 11 '11 at 23:03
feedback
up vote 0 down vote

If you own the SSL private key and certificate, you can take a tcpdump on your web servers and read the traces using wireshark. You will want to configure wireshark to decrypt your ssl traffic, which you can then read as if they were http requests and responses. You should be able to get a good idea on what Chrome is doing on those requests that take too long.

The wireshark wiki has a doc that provides all the information you need to set wireshark up to decrypt ssl and most of the downloadable wireshark binaries have already had this support compiled into it (so you don't need to worry about compiling your own version). One thing to keep in mind is that you will want to download a copy of the private key(s) to your workstation and any modifications you need to make to those keys to strip out passwords should not be uploaded to your production keys on your servers.

link|improve this answer
feedback
up vote 0 down vote accepted

It was just a problem on Amazone Load Balancer. After restarting, It works well.

Thanks All!

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.