php-fpm mod event is slowly on https with server centos 7, php 7.2

Question

i have server centos 7, installed php7.2, mod ssl, php-fpm run with mpm event. So after config completed, i tested with cmd
ab -k -c 100 -n 2000 http://myweb.com/test.php
And results:
Concurrency Level: 100
Time taken for tests: 0.103 seconds
Complete requests: 2000
Failed requests: 2
(Connect: 0, Receive: 0, Length: 2, Exceptions: 0)
Write errors: 0
Non-2xx responses: 1998
Keep-Alive requests: 1998
Total transferred: 1048596 bytes
HTML transferred: 467752 bytes
Requests per second: 19506.11 [#/sec] (mean)
Time per request: 5.127 [ms] (mean)
Time per request: 0.051 [ms] (mean, across all concurrent requests)
Transfer rate: 9987.32 [Kbytes/sec] received
Percentage of the requests served within a certain time (ms)
50% 4
66% 5
75% 6
80% 7
90% 10
95% 11
98% 14
99% 15
100% 27 (longest request)

it's fast but very slowly when i test it with link https

ab -k -c 100 -n 2000 https://myweb.com/test.php
The results:
Concurrency Level: 100
Time taken for tests: 3.831 seconds
Complete requests: 2000
Failed requests: 0
Write errors: 0
Keep-Alive requests: 0
Total transferred: 460000 bytes
HTML transferred: 58000 bytes
Requests per second: 522.05 [#/sec] (mean)
Time per request: 191.553 [ms] (mean)
Time per request: 1.916 [ms] (mean, across all concurrent requests)
Transfer rate: 117.26 [Kbytes/sec] received
Percentage of the requests served within a certain time (ms)
50% 182
66% 191
75% 199
80% 207
90% 228
95% 247
98% 266
99% 285
100% 328 (longest request)

everything is still ok on my server, i checked error_log but no logs for this issue above, so i dont know the reason and how to fix it,
i add more case test on server ssl with apache hanlder, it's fast and i think server with FPM/FastCGI is faster server apache handler

Concurrency Level: 100
Time taken for tests: 0.612 seconds
Complete requests: 2000
Failed requests: 0
Write errors: 0
Keep-Alive requests: 1987
Total transferred: 573427 bytes
HTML transferred: 60000 bytes
Requests per second: 3270.41 [#/sec] (mean)
Time per request: 30.577 [ms] (mean)
Time per request: 0.306 [ms] (mean, across all concurrent requests)
Transfer rate: 915.69 [Kbytes/sec] received
Percentage of the requests served within a certain time (ms)
50% 2
66% 3
75% 3
80% 4
90% 5
95% 7
98% 12
99% 65
100% 584 (longest request)

pls help me, thanks

Answer 1

@symcbean thanks, exactly my prob, i dont know why http can run keepalive but https not working keepalive although i config KeepAlive On in my httpd.conf and run same cmd for both:

ab -k -c 100 -n 2000 -H "User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36" http://exp.com/test.php
=> above 6000 req per second, 2000 keepalive req

ab -k -c 100 -n 2000 -H "User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36" https://exp.com/test.php
=> about 600 req per second, 0 keepalive req
but when i access real browser with https://example.com, i see response header have: Connection → Keep-Alive and Keep-Alive →timeout=10, max=150
haha, i'm crazy for it

Answer 2

@symcbean and this is my ssl file

Listen 443 https
SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog
SSLSessionCache shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout 300
SSLRandomSeed startup file:/dev/urandom 256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
VirtualHost default:443
ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel warn
SSLEngine on
SSLProtocol all -SSLv2 -SSLv3
SSLCipherSuite HIGH:3DES:!aNULL:!MD5:!SEED:!IDEA
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
SSLOptions +StdEnvVars
SSLOptions +StdEnvVars
BrowserMatch "MSIE [2-5]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0
CustomLog logs/ssl_request_log \ "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"
/VirtualHost

VirtualHost *:443
SSLEngine On
SSLCertificateFile /etc/httpd/ssl/exp.crt
SSLCertificateKeyFile /etc/httpd/ssl/exp.key
SSLCACertificateFile /etc/httpd/ssl/exp.crt
ServerName example.com
DocumentRoot /var/www/html/web/
FilesMatch .(php|phar)$
SetHandler "proxy:fcgi://127.0.0.1:9000"
/FilesMatch
/VirtualHost

Answer 3

@unixmiah is correct. The difference is all about the ssl - although the actual encryption is not the overhead - its the key negotiation and the configuration of the SSL termination causing issues.

You have posted 3 sets of results above - the first two show the command you used - testing on http and https but you've not provided the command you used for the third.

In the first set of results:

 Keep-Alive requests: 1998

In the second set of results:

 Keep-Alive requests: 0

even though you specified -k (enable keep-alive) on the command line!

The most likely reason that there are no keep-alive requests is that your webserver is configured to close the connection when it can't determine if the client supports SSL session renegotiation (i.e. MSIE <=6 ). As a consequence you not only have the overhead of a TCP handshake (2.5 rtts) before each request, but you also have a full ssl negotiation (~3-4 rtts) for each request. The quickest way to get your test rig correctly representing interactions by real browsers is to fudge the user-agent sent by ab:

ab -k -c 100 -n 2000 \
-H "User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36" \
https://myweb.com/test.php

(I've not tested this - I am assuming that the version of ab you have is capable of handling ssl renegotiation or that the test is sufficiently short that this will not be an issue, and that your webserver does not implement HTTP/2).

The title of your question is very misleading. It makes no difference to the performance of PHP whether the request is sent via HTTP or HTTPS to the webserver - it always arrives in PHP the same way. If you had tested with static content served by the webserver you would have seen the same pattern of performance.