We are experiencing problems with users that access a SSL enabled web application through a proxy server. The application is used across several locations and work fine for users that do not have a proxy & IE6. I have read several similar posts on the site but have not found any solutions or ideas. At this point our best option seems to be to pull the SSL functionality out of Domino’s hand and place it on a SSL accelerator. Unfortunately, this is a fairly costly solution and I cannot be sure it will be successful.
I know there are a few software based compression\SSL solutions, but these are expensive too. Does anyone have any ideas, suggestions, similar issues, etc?
When you say problems are they strictly poor performance initially getting into the application (e.g. SSL handshake) or is performance poor throughout. We have an issue where performance is poor for some users (e.g. slow page loads. some pages never load) and not others and have not been able to nail down any specifics even with Lotus Support involved.
We are planning to move to external SSL excelerator as quickly as possible.
Yes, that sounds like the same issue we are seeing. The pages are slow and sometimes do not load.
Our server only has an average of 20 simultaneous users. In addition it is a fairly beefy machine that should not be having these types of performance issues. My assumption is that Domino is not correctly handling SSL and therefore I need an accelerator that will hopefully do a better job.
On our pages that are not loading to full completion even after 2-3 minutes if I hit stop in the browser and then either refresh the browser or click the link in the application again the pages then loads to completion (adn quickly). Is this also similar?
Recently we upgraded our application design and now going back to Domino 5 is longer an option but prior to the design upgrade we could simply revert back to Domino 5.0.11 and the issue would disappear completely.
Could you also direct me to other threads here on the forum that talk about this issue? I would like to reference them with my open PMR with Lotus Support.
Anyone have any good whitepapers on the SSL handshake process? and possibly on the difference between a SSL retry and a rekey? These are terms I see mentioned in various resources but I am not familar with the terms.
Yes, the users are having pages not load to completion, but often refresh with no problems. The items that hang seem random (images, .js files, or the html page itself).
I am finding several thread topics that seem to be similar\related. These include the SSL handshake problem with IE6 and the images not loading in IE6 (I’m look at the problem right now on notes.net). I have experienced both of these issues too at the same time as users are experiencing problems. Also, I am remote consoled into the servers which depict no sizable activity with disk, memory, or processor.
I have used several packet-sniffing utilities to try to figure out the problem with little success. Someone with a better knowledge of networking may have better luck. They are IBM Page Detailer, TracePlus, and HTTPWatch. Very interesting tools to play with in any case.
Our network team put out forth a theory that I forwarded to Lotus Support yesterday. The theory was that Domino either could not handle the number of active key pairs or that it was losing the handle of some of the keys. IE then performs a “retry” looking for the other key and continues to retry. Whereas a stop and refresh or clicking another link would force a new key/pair to be generated and then the page displayed. Perhaps this retry/rekey process in IE is different between IE 5 and IE6.
I asked Lotus Support if there was any guidelines for the number of active SSL keys that a Domino server could maintain either a basic recommendation or some sort of a calculation based on the size of the server/processor/memory. I am waiting for a reply to this inquiry.
Our server seems to really die when it is transferring several files (PDF’s, etc) and then several SSL Initial State threads are open at the same time (viewable through Tell Http Show Thread State).
Subject: Problems with SSL via proxy with IE6 - Solved
I finally got a chance to duplicate the environment of the troubled users. Indeed, IE 6 going through a proxy has difficulty working with my SSL enabled web application. However, I was able to figure-out the problem. IE 6 needs to have the advanced setting ‘Use HTTP 1.1 through proxy connection’ enabled, which is not enabled by default. Once I check this the site has been running fine for these individuals. Hopefully it will stay that way.
I was able to find some great deals (~$1,000) on Sonicwall SSL Accelerators on eBay if anyone is interested. I would be interested to hear if anyone has any experience with them and how much of a performance enhancement they make.
The Domino server will cache up to 50 sessions for resumption by default for each protocol; if you think that your server requires more than that, try increasing SSL_RESUMABLE_SESSIONS in your notes.ini until the number of cached sessions equals the load on your server.