Slow server hello when setting up SSL handshake azure apim

Question

Slow server hello when setting up SSL handshake azure apim

Corne Hendrickx 0

We have several customers that complain about a slow server response when setting up a SSL handshake.

What we see is this:

Client send SSL HELLO.

Server SSL Hello response takes 10 or more seconds.

We can not figure out what this is causing.

In the wire shark trace we see that the server response takes this long.

Siddhesh Desai 655 Reputation points Microsoft External Staff Moderator

2025-11-27T16:44:05.57+00:00

Hi Corne Hendrickx,

Thank you for reaching out to Microsoft Q&A

In your APIM Instance > Can you visit > Diagnose & solve problems > Availability & Performance > And see if you can get an insight on why the API response is slow.

Refer: https://dori-uw-1.kuma-moon.com/en-us/azure/api-management/diagnose-solve-problems#availability-and-performance

APIM’s SSL Hello timing is primarily influenced by the client’s path to your gateway hostname and the certificate chain it receives. Backend API slowness shows after the handshake, and APIM guidance recommends Inspector traces to confirm where time is spent. https://dori-uw-1.kuma-moon.com/en-us/troubleshoot/azure/api-mgmt/availability/performance-hit-api-calls
Rakesh Mishra 3,955 Reputation points Microsoft External Staff Moderator

2025-12-01T09:36:01.64+00:00

Hi @Corne Hendrickx , following up to see if you had a chance to check my previous response and if it was helpful. Please do let me know if you're still facing the issue and need any further assistance on this.
Corne Hendrickx 0 Reputation points

2025-12-01T10:33:18.1633333+00:00

Hi Siddhesh Desai,

It does not solve my problem. I do not have any over load on components. Back-end is fast. Certificate for verification is loaded on azure APIM itself.

Still we see the slow handshake at our customers. My next step will be, creating a Vnet in front of azure APIM, to capture the network traffic of this customer and see if the delay starts in azure or if it is a result of his connection.

If you have any suggestions to check additionally, please let me know.
Praveen Kumar Gudipudi 1,495 Reputation points Microsoft External Staff Moderator

2025-12-08T04:28:28.6566667+00:00
Hello Corne Hendrickx,

Please check below steps:

Ensure APIM has unrestricted outbound access to:

*.digicert.com

*.entrust.net

*.globalsign.com

Any issuer of intermediates in your cert chain

Enable diagnostic logs (GatewayLogs) and look for:

CertificateValidationFailed

OCSPCheckTimeout

Use SSL Labs test on your backend domain and check “OCSP” and “Chain issues”

If the backend API supports only outdated TLS or cipher suites, APIM will attempt multiple negotiation rounds before responding.

TLS 1.2 or 1.3

Modern ciphers:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Please Turn on APIM Gateway logs for finding the root cause.
Praveen Kumar Gudipudi 1,495 Reputation points Microsoft External Staff Moderator

2025-12-11T05:25:48.89+00:00

Hello Corne Hendrickx,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Corne Hendrickx 0 Reputation points

2025-12-11T09:48:59.4+00:00

hi all, with a support ticket we found out that we have an issue with an incorrect ocsp end-point. This was not accessible.We use this command

openssl ocsp -issuer issuer.crt -cert user_cert.crt -url http://[fqdn]/ca/ocsp

When this was working correct. The slow responses are resolved.

1 answer

Your answer

Siddhesh Desai 655 Reputation points Microsoft External Staff Moderator

2025-11-27T16:44:05.57+00:00

Hi Corne Hendrickx,

Thank you for reaching out to Microsoft Q&A

In your APIM Instance > Can you visit > Diagnose & solve problems > Availability & Performance > And see if you can get an insight on why the API response is slow.

Refer: https://dori-uw-1.kuma-moon.com/en-us/azure/api-management/diagnose-solve-problems#availability-and-performance

APIM’s SSL Hello timing is primarily influenced by the client’s path to your gateway hostname and the certificate chain it receives. Backend API slowness shows after the handshake, and APIM guidance recommends Inspector traces to confirm where time is spent. https://dori-uw-1.kuma-moon.com/en-us/troubleshoot/azure/api-mgmt/availability/performance-hit-api-calls
Rakesh Mishra 3,955 Reputation points Microsoft External Staff Moderator

2025-12-01T09:36:01.64+00:00

Hi @Corne Hendrickx , following up to see if you had a chance to check my previous response and if it was helpful. Please do let me know if you're still facing the issue and need any further assistance on this.
Corne Hendrickx 0 Reputation points

2025-12-01T10:33:18.1633333+00:00

Hi Siddhesh Desai,

It does not solve my problem. I do not have any over load on components. Back-end is fast. Certificate for verification is loaded on azure APIM itself.

Still we see the slow handshake at our customers. My next step will be, creating a Vnet in front of azure APIM, to capture the network traffic of this customer and see if the delay starts in azure or if it is a result of his connection.

If you have any suggestions to check additionally, please let me know.
Praveen Kumar Gudipudi 1,495 Reputation points Microsoft External Staff Moderator

2025-12-08T04:28:28.6566667+00:00

Hello Corne Hendrickx,

Please check below steps:

Ensure APIM has unrestricted outbound access to:

*.digicert.com

*.entrust.net

*.globalsign.com

Any issuer of intermediates in your cert chain

Enable diagnostic logs (GatewayLogs) and look for:

CertificateValidationFailed

OCSPCheckTimeout

Use SSL Labs test on your backend domain and check “OCSP” and “Chain issues”

If the backend API supports only outdated TLS or cipher suites, APIM will attempt multiple negotiation rounds before responding.

TLS 1.2 or 1.3

Modern ciphers:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Please Turn on APIM Gateway logs for finding the root cause.
Praveen Kumar Gudipudi 1,495 Reputation points Microsoft External Staff Moderator

2025-12-11T05:25:48.89+00:00

Hello Corne Hendrickx,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
Corne Hendrickx 0 Reputation points

2025-12-11T09:48:59.4+00:00

hi all, with a support ticket we found out that we have an issue with an incorrect ocsp end-point. This was not accessible.We use this command

openssl ocsp -issuer issuer.crt -cert user_cert.crt -url http://[fqdn]/ca/ocsp

When this was working correct. The slow responses are resolved.

Answer 1

Hello Corne Hendrickx,

Thanks for sharing the details:

Issue: Slow server hello when setting up SSL handshake azure apim.

Resolution: we found out that we have an issue with an incorrect ocsp end-point. This was not accessible.We use this command

openssl ocsp -issuer issuer.crt -cert user_cert.crt -url http://[fqdn]/ca/ocsp

When this was working correct. The slow responses are resolved.

If this answer was helpful, please click "Accept the answer" and mark Yes, as this can help other community members.

User's image

If you have any other questions or are still experiencing issues, feel free to ask in the "comments" section, and I'd be happy to help.

Share via

Slow server hello when setting up SSL handshake azure apim

1 answer

Your answer