I'm setting up a TLS 1.2 endpoint with client authentication using HAProxy 1.8.17 (with openssl 1.1.1) from Debian testing.

With wireshark I observe a retransmission of the TCP packet that contains these TLS messages: "Certificate", "Server Key Exchange", "Certificate Request", "Server Hello Done". The retransmission occurs after round about 15 milliseconds. One millisecond later the ACK of the client arrives. This occurs during every TLS handshake with low deviation in the timings.

It is reasonable that the answer of the client takes times because it's a slow embedded device. Using a software client the answer is received in less than one millisecond and no retransmission occurs.

So my question is: is there a setting either in haproxy, openssl or Debian that I can use to prevent the server from sending these retransmissions?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.