GlassFish 5 SSL证书有效但HTTPS请求缓慢，出现写入超时错误

Let’s dive into your GlassFish SSL issue—you’ve got a slow HTTPS endpoint even though HTTP works fine, plus those write timeout errors. Here’s how to validate your SSL setup and fix the performance lag:

To confirm your SSL implementation meets security standards, run through these checks:

• Lock down SSL protocols & cipher suites: Outdated protocols (like TLS 1.0/1.1) or weak ciphers hurt performance and fail compliance. Update your domain.xml configuration for your SSL listener:

  <ssl ssl-protocols="TLSv1.2,TLSv1.3" 
       ciphers="HIGH:!aNULL:!MD5:!3DES" 
       session-cache-size="10000" 
       session-timeout="3600"/>
  

  This enables only modern TLS versions, strong ciphers, and optimizes SSL session reuse to reduce handshake overhead.
• Verify certificate chain integrity: Incomplete chains force clients to fetch missing intermediate certificates, adding latency. Use keytool to check your keystore:

  keytool -list -v -keystore your-keystore-path.jks
  

  Ensure the certificate path shows your server cert, intermediate certs, and root cert. You can also check via browser: click the lock icon in the address bar to inspect the certificate chain.
• Enable OCSP Stapling: This lets your server send certificate revocation status directly to clients, avoiding extra round-trips. Add to your <ssl> config:

  ocsp-stapling-enabled="true"
  

Your error logs point to write timeouts during resource handling (JSF/PrimeFaces resources) and HTTP/2 session issues. Here’s what to fix:

• Test disabling HTTP/2 first: The stack trace mentions Http2Session.sendMessageUpstream—older GlassFish versions have known HTTP/2 bugs that cause slowdowns with SSL. Disable it temporarily by updating your HTTPS network listener in domain.xml:

  <network-listener name="ssl-listener" port="8182" protocol="http/1.1" transport="tcp" ssl-enabled="true"/>
  

  Restart GlassFish and test the HTTPS endpoint. If speed improves, you either need to upgrade GlassFish to a newer version (5.x+ has better HTTP/2 support) or stick with HTTP/1.1 for now.
• Adjust timeout settings: The Write timeout exceeded error suggests your server’s write timeout is too short. Update your network listener’s timeout values:

  <network-listener ... write-timeout="30000" read-timeout="30000"/>
  

  (30 seconds is a reasonable starting point; adjust based on your app’s resource load.)
• Optimize static resource delivery: Your error occurs during resource handling—HTTPS can amplify slow static resource loads. Ensure:
  • Static resources (CSS, JS, images) have proper Cache-Control headers to reduce repeat requests.
  • Gzip compression is enabled for text resources. Add this filter to your app’s web.xml:

    <filter>
        <filter-name>GzipFilter</filter-name>
        <filter-class>org.glassfish.grizzly.servlet.GzipFilter</filter-class>
    </filter>
    <filter-mapping>
        <filter-name>GzipFilter</filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>
    

• Check SSL handshake overhead: If every request triggers a new SSL handshake, latency skyrockets. Use GlassFish’s built-in monitoring (via the admin console or JConsole) to check SSL session reuse rates. If reuse is low, increase session-cache-size in your <ssl> config.

• Run a local SSL compliance scan using tools built into your operating system or GlassFish’s admin console to confirm all security checks pass.
• Compare HTTP vs HTTPS request flows with a network analyzer (like Wireshark) to pinpoint where the delay occurs—whether it’s during the SSL handshake or data transfer.

Start with disabling HTTP/2 as a quick diagnostic, then work through the SSL compliance and timeout tweaks. The write timeout errors are almost certainly a symptom of the underlying performance bottleneck, not the root cause.

内容的提问来源于stack exchange，提问作者David Leonardo Andrade Bolaños