-2

I made a website with Nginx and Meteor. The website runs on Debian 8. I found the initial connection time is very long.

How can I improve the connection time?

john@vm-170302014546:~$ sudo cat /proc/net/sockstat
sockets: used 237
TCP: inuse 101 orphan 2 tw 48 alloc 107 mem 1023
UDP: inuse 12 mem 6
UDPLITE: inuse 0
RAW: inuse 0
FRAG: inuse 0 memory 0

enter image description here

nginx ssl config parameters:

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
# Disable preloading HSTS for now.  You can use the commented out header line that includes
# the "preload" directive if you understand the implications.
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;

ssl_dhparam /etc/ssl/certs/dhparam.pem;
  • 2
    A cause I often find in cases like this is a failing DNS lookup on the server side. Check if your server tries to resolve the connecting IP address and if this fails. – Gerald Schneider Mar 8 '17 at 9:23
  • 1
    You can also check if connection without SSL take similar time. However, as stated before, it looks like DNS issue. Check your hosts file as well as resolv.conf. It also may happen if one resolver fails, but it usually takes more time. – adoado0 Mar 8 '17 at 10:56
  • 1
    Try setting resolver_timeout 1s. If this reduces the time you know it is the cause and we can focus on that. If it doesn't we have to look somewhere else. – Gerald Schneider Mar 8 '17 at 13:35
0

According to your image , there is no problem with DNS lookup .

You can see that the Initial time contains SSL time which is nearly most of the time.

So I'm confident to say that SSL Negotiation is the cause.

To confirm the cause, you can disable HTTPS and use HTTP in Nginx .

To fix it, we have to optimize the SSL performance .

For clearance , please post your SSL configuration block in Nginx configuration file.

I suggest the following configuration :

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';

Hope it can help you.

  • 1
    The image only shows that there is no DNS issue on the client. – Gerald Schneider Mar 8 '17 at 10:59
  • Right , I mean that in my post . @GeraldSchneider – Summer Nguyen Mar 8 '17 at 11:00
  • @GeraldSchneider: it also shows that " the Initial time contains SSL time which is nearly most of the time" . – Summer Nguyen Mar 8 '17 at 11:04
  • Hi, Could you please use my ssl_ciphers list ? It supports more ciphers . Btw, with your new configuration , I wonder how do you config your upstream ? Using Domain or using IP address ? – Summer Nguyen Mar 9 '17 at 2:52
0

Could you qualify "very long"?

If you server has little traffic (and/or, if your app is configured in such a way as to inhibit nginx's caching some assets), then it may be this is the 'raw' backend performance, in essence.

In order to fill its cache, nginx will generally make a request to the upstream, pull down the full response, and only then will it send the response data to the requesting client. If your app is moving a large amount of data on first connect, that could explain the delay.

0

Use dig command to check you domain name resolution process. if return multi answer section, check these ips is valid.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.