SAP Basis Tech Supports

Symptom

In most of the cases the issues are created with Load Runner test. The test with http requests shows significantly better performance than https requests. In the defaultTrace on the dispatcher node the following errors appear:
IOException while handshaking: Read timed out
Sending alert: Alert Fatal: handshake failure
Shutting down SSL layer…
Other terms

SSL https J2EE performance
Reason and Prerequisites

After change in the Connection Manipulator that improves the tuning options for the j2ee engine this performance problem has arisen. The change is valid after SAP J2EE 7.00 SP13.
Solution

The solution is the timeouts of the Connection Manipulator, SSL Provider and Http Provider to be tuned. The values are not static and they are specific for each system and for each test case. The configuration below works in most of the cases but it is not a solution for every case.
Tuning options of the Connections Manipulator:
MaxSoTimeOutConnections = 700
MaxRepeatConnections = 700
For more information about these parameters and also for the Connection Manipulator way of work please check the following link:
http://help.sap.com/saphelp_webas630/helpdata/en/91/e51e3e6217b40be10000000a114084/content.htm

Tuning options of the Http Provider on the dispatcher node
Ports = (Port:50001, AcceptingThreadsCount:50, Type:ssl)
The difference compare to default value is the AcceptingThreadsCount property. By default the SSL Provider has 10 j2ee threads set for ssl request accepting. Above property can set appropriate number accepting threads. Please be aware that these threads will be separated and they will not be used for other j2ee operations. In this case the dispatcher threads have to be increased with the same number of threads.

Tuning options of the SSL Provider on the dispatcher node
HANDSHAKE_SO_TIMEOUT = 300
RUNTIME_SO_TIMEOUT = 150
These properties are the timeout period in milliseconds to wait for a SSL handshake and the timeout period in milliseconds for the SSL runtime. These timeouts have to be tuned according to the separate SSL case. If big count of low time cost requests is expected then the values have to be lower. If small count high time cost request is expected these values have to be greater then the time cost operation. If big count of high time cost https request is expected then the SSL timeout tuning cannot help itself. In this case more threads on the Http Provider have to be separated and also new server nodes can be added. The reason for the time consumption of the requests can be a network trafic or server operations with long duration.

Please also generate thread dumps on the dispatcher and on the server node as per note 710154 during the problem. Then check for available threads and if it is necessary then add more threads. This check can be done easy with the tool provided in note 1020246. Be aware that SAP recommends ~450 concurrent users per server node.