1

I recently was tasked with installing an SSL cert on our existing server which has been using http protocol only for the existing vhost. I created the new *:443 NameVirtualHost vhost config for the system and restarted apache. It appeared to start up without any hitches.

However, users continuing to use the normal port 80 based website started experiencing extremely slow response from the server.

When I removed the *:443 vhost from the system, performance returned to normal. I have never seen an implementation of an SSL-based vhost cause such an extreme impact on performance and would love it if someone could assist with this.

Performance on the non-SSL site was impacted by roughly 70% slow down in response.

The new vhost is as follows;

NameVirtualHost *:443

<VirtualHost *:443>
  ServerName    securedomain.com
  ServerAlias   www.securedomain.com
  ServerAdmin   [email protected]
  DocumentRoot  /var/www/vhosts/sf

  ErrorLog      logs/ssl_securedomain.com-error_log
  TransferLog   logs/ssl_securedomain.com-access_log
  CustomLog     logs/ssl_securedomain.com-access_log "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

  SSLEngine on
  SSLCertificateFile            /etc/httpd/conf/ssl.crt/securedomain.com.crt
  SSLCertificateKeyFile         /etc/httpd/conf/ssl.key/securedomain.com.key

  SSLProtocol -All +SSLv3
  SSLCipherSuite HIGH:!SSLv2:!EXPORT:!LOW:!MEDIUM:!ADH-DES-CBC3-SHA

  <Files ~ "\.(cgi|shtml|phtml|php?)$">
    SSLOptions +StdEnvVars
  </Files>
  <Directory "/var/www/cgi-bin">
    SSLOptions +StdEnvVars
  </Directory>

  SetEnvIf User-Agent ".*MSIE.*" nokeepalive ssl-unclean-shutdown
</VirtualHost>

Any help would be immensely appreciated.

Thanks.

Requested by posters:

vmstat
procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------
r  b   swpd   free   buff  cache   si   so    bi    bo   in   cs us sy id wa st
1  0      0 30728140 487812 790560    0    0     7    34    3    3  5  0 94  1  0

uptime
12:47:42 up 16 days,  9:02, 10 users,  load average: 0.48, 0.65, 0.62

top
top - 12:48:33 up 16 days,  9:03, 10 users,  load average: 0.36, 0.59, 0.60
Tasks: 358 total,   1 running, 354 sleeping,   0 stopped,   3 zombie
Cpu(s):  4.6%us,  0.2%sy,  0.0%ni, 94.5%id,  0.6%wa,  0.0%hi,  0.1%si,  0.0%st
Mem:  33278556k total,  2330932k used, 30947624k free,   487428k buffers
Swap:  2097144k total,        0k used,  2097144k free,   793324k cached

netstat -ntp result is far too large to paste here
Improve this question
6
  • What is the operating system? Did you have time to look at vmstat, top, free, netstat -ntp and apache status when ssl was enabled? Could you also post entire apache conf, at least all parts relative to ssl (eg SSLSessionCache ) ? Are there any nfs or smb shares involved in architecture?
    – user130370
    Aug 16, 2012 at 15:00
  • In addition to the info Eric asked for, any interesting messages from your log files might be helpful...
    – voretaq7
    Aug 16, 2012 at 16:00
  • I added some of Eric's requested info. Those values are not with the SSL vhost enabled as enabling it will have dramatic performance issues with our user base. (roughly 300-500 customer service personnel)
    – Skittles
    Aug 16, 2012 at 16:52
  • There are no nfs or smb shares also.
    – Skittles
    Aug 16, 2012 at 17:21
  • So just to be certain, have you tried disabling the SSL site temporarily, and checking the performance again to be certain that was the change the cause your problems?
    – Zoredache
    Aug 16, 2012 at 17:29

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .