1474206 - I'm experiencing very long delays "Performing a TLS Handshake". Please advise.

Status: RESOLVED WORKSFORME

(Core :: Security: PSM, defect)

Description

[Gary]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:61.0) Gecko/20100101 Firefox/61.0
Build ID: 20180704003137

Steps to reproduce:

Just surfing my regular sites


Actual results:

There is a very long delay between me entering a site showing "Performing a TSL Handshake. Sometimes the delay can be up to 30 seconds. This even happens on all websites. I am on a very fast connection that is hard wired.


Expected results:

In the past the website would open in the browser almost immediately with no delay.

Comment 1

[Marcia Knous [:marcia]]

Moving hopefully to a better component.

Comment 2

[Liz Henry (:lizzard) (relman/hg->git project)]

Hi Gary, do you have antivirus software installed? I'm wondering if that could be affecting this issue.

Comment 3

[Liz Henry (:lizzard) (relman/hg->git project)]

If you don't mind, can you also check about:config, search for TLS in the big list of preference, and let me know the values that are in these two preferences: 

- security.tls.version.fallback-limit 
- security.tls.version.max 

Thanks very much!

Comment 4

[Gary]

Yes I use ESET antivirus.
The fall back limit is 3
Max is 4

Comment 5

[Gary]

I disabled ESET antivirus and it made no difference

Comment 6

[Honza Bambas (:mayhemer)]

I've seen this lately too on a profile I run logs regularly, but didn't inspect them.  When it happens, I will look into the logs, but I don't expect to find more than more questions there...

Comment 7

[Gary]

Yes it's an ongoing issue with Firefox only and I'm bummed out because I love the Firefox browser. I downloaded puffin Browser and experienced zero download lag? Not nearly as much lag with IE but I don't like or trust it.

Comment 8

[Valentin Gosu [:valentin] (he/him)]

This seems very similar to bug 1468892
Can you try one thing for me? Set security.tls.version.max to 3, restart Firefox, and try if it's still slow.

Thanks

Comment 9

[Gary]

I set security.tls.version.max to 4 and the browser slowed way down and changed nothing with regard to the TLS lag.

Comment 10

[Gary]

I reset the proxy to auto-detect and then under certificates I chose select One automatically and unchecked query ocsp responder... Problem solved, no more lag.

Comment 11

[Gary]

I forgot to mention I had to restart Firefox for changes to take effect.

Comment 12

[Valentin Gosu [:valentin] (he/him)]

So, it's not clear from your previous comments - does setting security.tls.version.max to 3 do anything to improve the delays?
Also, were you using a proxy before?

Comment 13

[Gary]

Sorry I meant to say setting it to 3 did nothing except slow down the browser even more and no I'm not on a proxy.

Comment 14

[Dragana Damjanovic [:dragana]]

I will need-info Keeler: You may be interested in this problem.

Comment 15

[Dana Keeler (she/her) [:keeler]]

(In reply to Gary from comment #10)
> I reset the proxy to auto-detect and then under certificates I chose select
> One automatically and unchecked query ocsp responder... Problem solved, no
> more lag.

In about:config, what are the values of the preferences "security.OCSP.require" and "security.OCSP.timeoutMilliseconds.hard"? Can you run wireshark and capture some web traffic (port 80 and port 443) and attach the results here? Thanks!

Comment 16

[Daniel Stenberg [:bagder]]

Lack of response.

Comment 17

[Gary]

The problem continues with the fix being a complete browser reset. I've wasted so much time attempting 2 problem solve this issue I'd prefer to use a different browser. All suggested fixes are temporary at best.

Comment 19

[Neha Kochar [:neha]]

I'm seeing similar issue with https://ceac.state.gov/genniv/ which shows flickering message of "Performing TLS handshake" at the bottom of the page. When it finally loads, the page is unstyled. I'll add a screenshot showing that.

Comment 20

[Neha Kochar [:neha]]

Attachment: unstyled-page.png

Comment 21

[Kershaw Chang [:kershaw]]

(In reply to Neha Kochar [:neha] from comment #19)

I'm seeing similar issue with https://ceac.state.gov/genniv/ which shows flickering message of "Performing TLS handshake" at the bottom of the page. When it finally loads, the page is unstyled. I'll add a screenshot showing that.

:keeler, could you take a look at this? Thanks.

Comment 22

[Dana Keeler (she/her) [:keeler]]

Seems to work for me now - maybe there was an outage?

Comment 23

[Kershaw Chang [:kershaw]]

(In reply to Dana Keeler (she/her) (use needinfo) (:keeler for reviews) from comment #22)

Seems to work for me now - maybe there was an outage?

I can reproduce this with Firefox 65.0.1, but can't reproduce with nightly 68.0a1.
Do you think it's worth to take a look?
If yes, I can try to find the culprit by mozregression.

Comment 24

[Dana Keeler (she/her) [:keeler]]

Sure - if you can find what fixed this I'd be interested to know.

Comment 25

[Kershaw Chang [:kershaw]]

It turns out that this has something to do with the profile. Last time I was able to reproduce this with my personal profile, but not on a clean profile.

Anyway, this looks like a PSM bug to me.

Comment 26

[Dana Keeler (she/her) [:keeler]]

(In reply to Neha Kochar [:neha] from comment #19)

I'm seeing similar issue with https://ceac.state.gov/genniv/ which shows flickering message of "Performing TLS handshake" at the bottom of the page. When it finally loads, the page is unstyled. I'll add a screenshot showing that.

Can you still reproduce this?

Comment 27

[Neha Kochar [:neha]]

I still see the TLS connection message repeating a couple of times but the page finally loads correctly styled. It takes a couple of secs but nothing like the time it was taking before. I should also mention when I reported this issue in comment 19, the website had no issues in Chrome.
Also, now, I see the issue of "session timed out" every time when I try to retrieve my application with my existing application ID, which is not happening in Chrome.

Comment 28

[Dana Keeler (she/her) [:keeler]]

Try clearing the cache?

Comment 29

[Neha Kochar [:neha]]

I re-tried again today and was able to reproduce on release 65.0.1 but not on release 66.0.1. I had originally reproduced on nightly 68 in comment 19.

Comment 30

[Neha Kochar [:neha]]

Sorry, should've clarified I'm not able to reproduce the issue in comment 19 but I am reliably able to reproduce the session timed out issue in comment 27 but it can probably be tracked in a separate bug as it is different than the original report.

Comment 31

[Dana Keeler (she/her) [:keeler]]

Ok - thanks.

Comment 32

[Andrew Overholt [:overholt]]

I tried reproducing this and could the first time I tried. However, (even with a clean profile) I cannot reproduce after that first time. Since this isn't reliably reproducible and isn't happening in Chrome (at least with https://ceac.state.gov/genniv/), is there a chance this is a server-side issue?

I tried with varying levels of tracking protection enabled, too, and that didn't seem to make a difference.