SSL slow. Establishing secure connection taking too long

ssl httpresponse mod-security
temo picture temo · Jun 11, 2018 · Viewed 7.5k times · Source

I have a dedicated server with 256GB RAM 6 CPUs (12 Threads) on Hetzner, and it is located in Germany. I have CENTOS 7.5. EA4.

My problem is with SSL. Every day for about 2 hours, we have 40 requests in one second and finishing requests takes about 20 seconds. Non-SSL takes 0.5 or less. Here is an example.

From 13:00 to 15:30 (UTC+4), SSL requests take the most time. The problem is evident when you open this link with SSL and without.

I have WHM available. I've noticed ModSecurity and wonder if it might be the problem. I've applied most of the settings provided here, but there is not much regarding SSL.

enter image description here

In case certificates are the reason for all of this:

enter image description here

Answer

Bursuc Sergiu picture Bursuc Sergiu · Jun 10, 2020

I had the same issue and after a lot of digging I found that the problem was caused by the fact that I had mod_unique_id installed.

Further checking shows that the module is a requirement for mod_security. I did remove mod_security at first which did not make any change and only after removing the mod_unique_id module as well things started to fly.

Hope this helps.

Related questions

What is the proper HTTP response to send for requests that require SSL/TLS

I'm designing an RESTful API where some calls are public over HTTP, and some require an API key and encryption over HTTPS. I'm deliberating on what response code should be sent if an HTTP request is sent to one of …

Read More
How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More