Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm trying to debug a problem with SSL in Apache. I've used Wireshark to capture the packets, and I see the client hello message go out, and then about 10 seconds or so later, I get back a server hello. Once the SSL connection is established, subsequent HTTPS request are faster.

I am using /dev/urandom for entropy, and I think I have plenty available. My CPU load is next to nothing, but I receive about 10 requests/second.

I'm using the stock settings in Apache 2.2.14 on Ubuntu 10.04. My certificate is a SAN certificate from GoDaddy.

What steps should I take to find out why my server takes so long to respond over SSL? HTTP is snappy, but HTTPS is dead slow.

Edit:

Here is an image that shows the client hello, and then about 10 seconds later, the server hello:

enter image description here

share|improve this question
    
FYI: Apache 2.2.14 is 3 Years Old has quite a few known vulnerabilities. You should strongly consider upgrading to 2.2.23 (or the latest version available from your distro). –  Chris S Dec 18 '12 at 16:54
    
What does cat /proc/sys/kernel/random/entropy_avail report? –  Chris S Dec 18 '12 at 16:55
    
@Chris S -- what information does that provide an administrator? –  mdpc Dec 18 '12 at 19:28
    
entropy_avail is the number of bits of random data available. It should be in the 2000+ range for a normal server. Being under 200 is very near "running out" for a SSL server that commonly requires 64-128 bits of random data per new connection. There's quite a few articles around for gathering more entropy. I'm not sure if Linux uses hardware sources by default, I've seen more than a few articles about daemons necessary (at some point in time) to gather entropy from hardware sources. urandom is the non-blocking entropy souce, but I'm not sure OpenSSL will use it... –  Chris S Dec 19 '12 at 13:50

1 Answer 1

I bumped up the MaxClients in the apache config to 256, reloaded apache, and things improved dramatically. I'm having a hard time believing that was the problem because HTTP was snappy as ever, but HTTPS was slow.

apache2ctl status reports "185 requests currently being processed", and the MaxClients setting was 150 before I made the change. So it kind of makes sense, but again, why would HTTP be fast?

cat /proc/sys/kernel/random/entropy_avail reports 190.

Apache 2.2.14 is the latest version of apache available for Ubuntu 10.04.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.