php-fpm + https and 504 gateway timeout

[gennolo]

On a centos 7 x64 box I recently activated an ssl certificate in a website that was already configured in php-fpm (5.6.16) + apache / nginx as reverse proxy (default setting).
The domain was running fine before activating ssl.

In a couple of hours we noticed a huge performance drop resulting in dynamic webpages of the site not loading - returning "504 gateway timeout" error after 30/45 seconds of waiting time. the only way to temporary fix the problem was to manually restart php-fpm via cli.

Unfortunately I had no useful information in server logs except the timeouts.

I temporary solved the issue by switching the domain to php-cgi - but this increased the machine load average and I would like to revert back to fpm.

Is there something I missing on configuring php-fpm in conjuction with ssl ?

Thank you in advance.

 

[Roderic]

I al ready replied in another topic as well. But I also get 504 gateway timeouts (Nginx), and sluggish websites. Not all the time. But 3 out of 5 clicks gives a long loading time on dynamic pages.
This all started after I updated Plesk yesterday. I use Fast-cgi btw. Not php-fpm. But it seems to happen with all settings.

Hopefully we can get a reply from Odin soon. I've got no idea anymore where to look.

 

[IgorG]

Have you checked these KB articles at least?

https://kb.odin.com/en/127279
https://kb.odin.com/en/120210

 

[gennolo]

Yes I did. KB article 127279 pointed me to look at php-fpm service.
This is why I wrote in my first post :

the only way to temporary fix the problem was to manually restart php-fpm via cli.

But I am unable to figure out why php-fpm hangs reguarly with this standard template configuration / default settings.

 

[Roderic]

Gennolo, is everything working smoothly without php-fpm? Or are you also expierincing slowly loading websites and sometimes 504 with Fast-cgi, like me?

 

[gennolo]

Everything is running fine by switching websites to php-cgi (except an higher CPU usage..).

This issue only happened on a machine php-fpm , when I activated a certificate on a domain and therefore I restarted nginx/apache.
But I also have other VMs with Plesk 12.5 (last microupdate) with several domains and php-fpm works fine there.

 

[trialotto]

@gennolo and @Roderic,

Following

a) the steps in my post: http://talk.plesk.com/threads/nginx-502-error.335745/page-2#post-791020, AND/OR

b) the steps in KB article https://kb.odin.com/en/120210

should do the trick.

However, you are having issues related to SSL and you must be aware that

- OpenSSL related issues can be present on CentOS systems (note: not very likely to be present in the case of @gennolo)
- "huge" certificates really are associated with a performance penalty, as you already have noticed (note: use a 2048 bit certificate, if you have something else)
- bad SSL/TLS configuration can cause Nginx to choke itself (note: have a thorough look at your Nginx setup and primarily the customizations you implemented)

and so on.

Hope this helps.

Regards....