MultiPHP Timeout when changing configuration or Php version

[dantahoua]

I finally wrote here after hours of testing and research...

When I change the Php Version for a domain in MultiPhp (Whm), it takes ages (sometimes up to 2min) before the website is not timed-out!
Same thing if I change the configuration of Php-FPM for a domain or just enabling/disabling Php-FPM for a domain.
After a while the website is up but sometimes, randomly, the website takes 5sec to 10sec to start to load.
Where can I start looking, which log?

I have 66 websites on the server, but not that much traffic on those website. Every website has is made with Wordpress, I use cache. Every website load very fast 9 times out of 10!
I'm sure it's a little bug or misconfiguration hidden somewhere, the BIG timeout when changing PHP tell me there is something odd...

MultiPHP: PHP 7.2 / PHP 7.3
Apache 2.4
EasyApache 4

/etc/redhat-release:CentOS release 6.10 (Final)
/usr/local/cpanel/version:11.82.0.9
/var/cpanel/envtype:standard
CPANEL=release

 

[dantahoua]

After further research, seems the problem is around the AutoSSL certificate. With PingDom, SSL is 19s for loading! But not always...

 

[cPanelLauren]

What if anything is noted in the Apache error log? You can find it at /etc/apache2/logs/error_log you may also want to check the PHP-FPM error log [I]/opt/cpanel/ea-php$$/root/usr/var/log/php-fpm/error.log[/I]

 

[dantahoua]

Hello, thanks. There is nothing in the two logs. I just made another test, in the cascading view of the browser (and same with WebPageTest - Website Performance and Optimization Test) it took 18s (18149ms) to load the SSL the first time.
DNS lookup: 124ms
Initial connection: 53ms
SSL Negotiation: 18149ms
Time to first byte: 89ms

So it's clear there is a problem with the AutoSSL. In Cpanel it says "powered by Sectigo". The AutoSSL logs just show the validity of each domain autoSSL certificate.

Any idea where to look now for this problem?

 

[cPanelLauren]

Hello,

I doubt that the issue is specifically the SSL itself. I'm actually curious if SSL stapling is the culprit here. The following resource may be useful: Tutorial - How to address OCSP responder errors

 

[dantahoua]

I disabled SSL stapling with "SSLUseStapling off" but it did not change anything. I juste discovered something also.
It seems the website with this problem are the one with the DNS hosted on the same server.
https://example.ca is hosted on my server but his DNS is from another provider. The problem never occur.
https://exampleprob.ca is hosted on my server AND his DNS. Problem occur.

I'll check your OCSP tutorial.

 

[cPanelLauren]

Actually, disabling SSL stapling in the way that you were was what I was getting at initially. What are your DNS resolvers set to in /etc/resolv.conf?

 

[dantahoua]

I have 3 line in /etc/resolv.conf

search ovh.net
nameserver 127.0.0.1
nameserver ip of my server provider's DNS

 

[cPanelLauren]

You might try modifying them to something else temporarily to see if that makes a difference in the connection time. I've found CloudFlare's resolvers to be pretty quick. You can read about them here: Introducing DNS Resolver, 1.1.1.1 (not a joke)

The DNS resolver IP's are :

1.1.1.1
1.0.0.1

 

[dantahoua]

So... After waiting 12h and testing, I thought the problem was gone by changing the resolvers but finally this morning took again 20sec for the SSL Handshake... Really I don't understand.
Maybe something special: I noticed all my website with DNS hosted on the same server took very long or time-out after restarting Apache. Website hosted on my server but with external DNS load without problem. Is it normal to have website time-out just after Apache restarting (or changing Php version, could take 2min before a website is up after changing from Php 7.2 to 7.3 or 7.3 to 7.2)... Seems there is something odd with this server...

 

[cPanelLauren]

Hi @dantahoua

I'm sorry to hear that, the timeouts and amount of time to connect aren't standard. At this point can you please open a ticket using the link in my signature? Once open please reply with the Ticket ID here so that we can update this thread with the resolution once the ticket is resolved.


Thanks!

 

[dantahoua]

Hello, the problem seems to be resolved!
Ticket number: 13184641
I've added "SSLUseStapling Off" to the pre_virtualhost_global.conf via WHM »Service Configuration »Apache Configuration »Include Editor. This will ensure that it is off when the configuration is rebuilt.

Even restarting the Apache service is fast now as changing PHP Version or enable/disable Php-FPM. (took 2 to 3 min before, now it's almost instantaneous).
Thanks.

 

[cPanelLauren]

I disabled SSL stapling with "SSLUseStapling off" but it did not change anything. I juste discovered something also.
It seems the website with this problem are the one with the DNS hosted on the same server.
https://example.ca is hosted on my server but his DNS is from another provider. The problem never occur.
https://exampleprob.ca is hosted on my server AND his DNS. Problem occur.

I'll check your OCSP tutorial.

Ahh based on this response I was under the impression that you'd already done this and it wasn't a solution. I'm glad to hear that you were able to get the issue resolved.

 

[dantahoua]

Yes I did it, but I must have made a mistake as it do not worked the first time... Don't know why....

 

[cPanelLauren]

Either way, I'm happy the issue is not persisting!