For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Ray_Dodier_1102's avatar
Ray_Dodier_1102
Icon for Nimbostratus rankNimbostratus
Sep 03, 2010

SSL connect time diffs between domains (VIPs)

I serve HTTPS content from two different domains and each domain name corresponds to a VIP. What I'm seeing is the SSL connect time from one domain is about twice that of the other domain.     N...
application delivery
design
performance
testing
Ray_Dodier_1102's avatar
Ray_Dodier_1102
Icon for Nimbostratus rankNimbostratus
Sep 27, 2010
So here's the deal. The VIP with the longer SSL time is not doing the SSL handshake correctly at least half the time.

 

 

The Server Hello response from the F5 is coming back with 1 of 2 Session IDs. Every other time there is an SSL handshake to this VIP it has to do a full-handshake because the Session ID sent in the Client Hello request does not match what's coming back from the F5. The Client Hello always uses the same Session ID.

 

 

This means it's having to do a full-hanshake every other time to one VIP. I do not see this behavior with the other VIP.