title: SSL handshake problems
body: <p>Our server application suffers from extreme slowness at some of the customers. The slowness is solved by server restart, however it returns after a couple of weeks.</p>
  
  <p>Java CPU is always around 100% (out of 200%), all other parameters are fine. Research showed that most of the CPU is consumed by "HandshakeCompletedNotify-Thread" thread. From tcp dump we see that the SSL handshake takes 2-8 seconds, which is very long, sometimes timeout is thrown.</p>
  
  <p>Our SSL provider is BSAFE. Server runs on Linux(CentOS), 640 mb heap, 2 Cores. Hibernate, spring are used, Oracle local db</p>
  
  <p>What could be reasons for such a behavior? What can be done to find them out?</p>
  
  <p>P.S. We can not switch the traffic to HTTP at our customers.</p>
  
  <p>Update: The system is completely freed when outgoing connections of java process are blocked with IP tables. What resource is freed in such a situation?
  We see that SSL Handshake frequently gets stuck at "change Cipher Spec" stage. Client (my java process) tries to reuse SSL session, but the server is completely stateless, it generates new session each time.</p>