Forum extremely slow to load(??)

[Trump]

There is definitely an issue; I have an Optus mobile (4G at full strength that speedtests at 65Mbps download on a crap day), missus has a Telstra phone (faster again), the house has FTTN NBN (41Mbps) and multiple computers. The forum is slow across all of the computers and across all ISP's. I'm thinking it's an issue with the SSL implementation as it stalls when a TLS handshake is being performed. As an indication of how slow it is, this post took 25 seconds to come through.

[GO FURTHER]

Originally Posted by Trump

There is definitely an issue; I have an Optus mobile (4G at full strength that speedtests at 65Mbps download on a crap day), missus has a Telstra phone (faster again), the house has FTTN NBN (41Mbps) and multiple computers. The forum is slow across all of the computers and across all ISP's. I'm thinking it's an issue with the SSL implementation as it stalls when a TLS handshake is being performed. As an indication of how slow it is, this post took 25 seconds to come through.

On my seven year old iMac... It took 2 seconds to load this thread (uncached)

[russellw]

You are on the right track Vas but it's not a forum based issue as it runs perfectly fine with some browsers - we have been doing a lot of testing to check why it is slow in some.

The issue is with how some browsers handle the TLS implementation. Firefox (from 55.x on, later versions of Chrome and Opera seem to have no issue with TLS 1.2 (the current and more secure version) but IE seems to along with older versions of the above.

Some AV programs also have an impact (Avast for example) because they intercept TLS requests for reasons known only to their developers.

Of course, we can always go back to no SSL implementation but that's hardly preferable. We don't use self signed certs so there should be no caching issues but it might pay to try the following steps:

Firefox
Check for cached certs.
Browse to about:support and then click the Open Folder button for the Profile Folder. Locate cert8.db in your file explorer and rename the file (e.g. “cert8.db.bak”) so that Firefox replaces it. Restart the browser and try visiting an affected site again. If the page loads normally, you have confirmed the issue is related to the local certificate database storing too many certificates with the same name.


Cheers
Russ

[GO FURTHER]

No problems running Safari browser.

[Tickford.]

5 months since starting this thread, still no change. Still slow to load pages. 20-25 seconds to load a page and only on this website. Nothing else on the net is slow. Just ff.com.au.

There is something not right with this website.

[solarite_guy]

No problems with Firefox 52.4.0 or Yandex 17.4.1.1026 on 10 yr old Dell 1720. So far.

[MRFGXR6]

Yep running slow here as well. I have a mad gaming system and running NBN, and its the same on my Samsung S7 edge. Every thing else runs fast except this forum.

[Trump]

A fresh install of Chrome (62.0.3202), latest version of Firefox (56.0 64-bit) and IE 11.0.xxxx all run the forum slow. The certificate database in Firefox was recreated by Firefox and the slovenly pace persists.

[aussiblue]

No problem here with Chrome, IE11 or Edge.

[Fed]

Just to add to the confusion I've found the internet in general to be a bit flaky for the last few days. I'm blaming the fat controller for letting off bombs.

[FTe342]

I am with Telstra and was before the recent house move. All other sites are fast. Problem is unique to AFF site. Takes ages to open a page. Only time its quick is when you hit the back arrow

[Lunch]

Took me 4 seconds to load this thread, Telstra 3G, 5 year old iPad, out of date iOS, safari, takes a little longer to bring up the reply screen

[GO FURTHER]

Thousands of internet forums like AFF use vBulletin as the software that runs it.
Maybe AFF needs to update to the latest version, since it is only running an older Version 3.8.5 ?

[russellw]

OK. Let's get some science behind this. Let me make it clear that this is not an issue at our server end otherwise it would be consistent across users.

There are a number of things server side that can cause slow TLS negotiation and these are looked at below.

1. Certificate Chain length. Cheaper SSL certs are often 3 or 4 deep in the chain but we chose Comodo as it is a first level certificate provider. To verify this, most desktop web browsers allow you to view a site’s certificate, including certificate chain length. For example, in Chrome, simply click on the padlock/HTTPS area of the address bar, click the “Connection” tab, and click “Certificate Information”.
Note:You might find that your antivirus software is actually listed as the issuer of the certificate (Bit Defender does this) as per the example below.



A chain configuration check for AFF returns the following:




2. Data Encryption. A decade ago, TLS data encryption added significant overhead to page loads however support for certain ciphers in CPUs has eliminated this issue provided the right cipher is used by the server. The consensus from both security engineers and administrators that run large TLS websites is to use AES 128 bit encryption keys. This is what we use for AFF.

3. TLS Handshake. The TLS handshake is the process that the browser and server follow to decide how to communicate and create the secured connection and this is the area where most performance issues are caused. A full TLS handshake involves 2 round trips between your browser and the AFF server and a faster internet connection doesn't make those round trips any faster. This handshake will typically take between 250 milliseconds and half a second, but it can take longer.

Half second might not sound like a lot of time but the main problem with the TLS handshake is not how long it takes, it is when the handshake happens because they happen before any data can be exchanged.

This can be fixed for browsers that don't hold state if we enable TLS resumption on our end. Basically, TLS session resumption allows a client to say, "Hey server, we communicated a little while ago and did so using the following TLS options… Is it OK to start talking again using those same options?"

I'll see if I can work out how to enable it.

Cheers
Russ

[russellw]

I'm going to enable persistent connections in the DB as this should assist those having issues (under some scenarios) but I won't implement the change until 05:00 tomorrow morning as it requires a restart.

Regards
Russ

[MAGPIE]

Originally Posted by FTe342

I am with Telstra and was before the recent house move. All other sites are fast. Problem is unique to AFF site. Takes ages to open a page. Only time its quick is when you hit the back arrow

Agreed.

22 sec for AFF pages to load.

Instantaneous for another AUS based motoring forum I use.

[Tickford.]

Originally Posted by FTe342

Problem is unique to AFF site. Takes ages to open a page. Only time its quick is when you hit the back arrow

Same here.

Working fine for me across Firefox / chrome browsers on 4mbit adsl, optus 3G and telstra 4G

[Fed]

Originally Posted by Fed

Just to add to the confusion I've found the internet in general to be a bit flaky for the last few days. I'm blaming the fat controller for letting off bombs.

That's a first, never quoted myself before.
OK my phone line blew up today, lots of crackling and eventually no dial tone at all and very flaky adsl. I called the man & he confirmed a fault on the line so my problems had nothing to do with FF. Prior to this external hiccup I've found FF to be very fast & stable.

[Tickford.]

No change. Still 20-25 seconds to load pages.

[russellw]

OK - there will be a number of apache restarts this morning while I make some more changes but they are more tidy up than likely to address the issues being experienced.


I'm going to disable TLSv1 and RC4 because they really shouldn't be supported any more and are only used by very old browsers. Likewise, we really should disable SSL3 as it is vulnerable to attack but (unfortunately) still used by Windows XP users and we still have quite a few of those.

Those having extreme latencies need to give me some data to work with as telling me that it takes 20-25 seconds to load a page is useless without knowing what your browser is doing in that time.

There are two servers involved in the TLS handshake - ours plus the Comodo one for verification.

As a starting point can you run the following two commands from a Command prompt and email the results to admin@fordforums.com.au

tracert 66.226.77.74 > aff.txt
tracert 91.199.212.151 > comodo.txt

You can also go to THIS SITE and perform a detailed speed test which will give you (and therefore us) a very detailed breakdown. Only run the test for Brisbane as it takes forever to run the whole lot and you'll get a lot of extraneous data as it can only mimic an unregistered user and will thus load a lot of Google ad elements.

When the test completes, you'll see two tabs. One for first visit and one for Repeat visit. Click on the repeat visit tab and then click on the 'view waterfall2' button. Then click on the performance tab and look at the 10% of slowest elements and copy / paste those into an email top the same address mentioned above.

Cheers
Russ

[russellw]

I've probably broken SSL for those people using really old Operating Sytems in disabling TLSv1 so we are damned if we do and damned if we don't. I'll see how many people report it before backtracking.

Cheers
Russ

[Maka]

Hi guys, all good now but was getting this earlier today for a little while -

This site can’t provide a secure connection

www.fordforums.com.au uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Hope alls sorted now!

cheers, Maka

[DJR-351]

Originally Posted by Maka

Hi guys, all good now but was getting this earlier today for a little while -

This site can’t provide a secure connection

www.fordforums.com.au uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Hope alls sorted now!

cheers, Maka

Yep i had the same using latest Chrome and Edge....

[russellw]

Originally Posted by DJR-351

Yep i had the same using latest Chrome and Edge....

Originally Posted by Maka

Hi guys, all good now but was getting this earlier today for a little while -

This site can’t provide a secure connection

www.fordforums.com.au uses an unsupported protocol.
ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Hope alls sorted now!

cheers, Maka

You got that error message because I disabled support for TLSv1 earlier today and then re-enabled it again as a temporary fix.

Please read THIS thread as it explains the steps that will be necessary to ensure that when we turn off TLSv1 for good, your access isn't broken.

Cheers
Russ

[MRFGXR6]

Hi Russ, Seems what ever you have done has worked a treat. Pages are loading much faster now. Your certainly a credit to this forum.

regads,

Keith

[FTe342]

Mine is working much faster now but I'm no tech head and I need to sleep now so will give your requests some time when I can Russ

[MAGPIE]

Big difference now, loading within 2 seconds.

Thanks

[Tickford.]

No difference for me.

Strange how nothing else on the net is slow except for this forum. Nothing changed on my side. The forum just all of a sudden was waaay slow to load pages.

[Tickford.]

MRFGXR6, Fte342, MAGPIE, how's have the load speeds been in the last couple of weeks?