[SR-Users] load_crl takes 90 seconds to complete it execution with crl file size of 4MB !!!

[mahesh b]

Hi All,
        Am using Kamailio 5.1.9 version, In my tls.cfg i have one client
and server profile,
along with default client and server profile.

I have crl enabled for the non default client and server profile , the crl
file size is 4 MB in my case.

I have 22 child tcp process.

With this what i observe is load_crl is taking close to 90 seconds to
finish its execution and return.

It is very clear from the code, its because of this for loop.

 procs_no=get_max_procs();
for(i = 0; i < procs_no; i++) {
if (SSL_CTX_load_verify_locations(d->ctx[i], d->crl_file.s, 0) != 1) {
ERR("%s: Unable to load certificate revocation list '%s'\n",
tls_domain_str(d), d->crl_file.s);
TLS_ERR("load_crl:");
return -1;
}
store = SSL_CTX_get_cert_store(d->ctx[i]);
X509_STORE_set_flags(store,
X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
}


Is there a way this can be enhanced or as per the current kamailio design
this is a must to do for each and every profile and the child process array
list.

Please suggest, is it justifiable for load_crl to take 90 seconds , to
complete its execution, with one client and server profile and 22 child tcp
process and crl file size of 4MB.



More info of my setup:
-----------------------------

Kamailio 5.1.9 version is running on the below



Linux Kernel version :  3.10.0-693.el7.x86_64


Centos version : CentOS Linux release 7.4.1708 (Core)


CPU : 2 cores with model name      : Intel(R) Core(TM) i7-6700 CPU @ 3.40GHz


[root at miv5000 ~]# cat /proc/meminfo
MemTotal:        3882076 kB
MemFree:          811244 kB
MemAvailable:    2320356 kB



Openssl verison : OpenSSL 1.0.2k-fips  26 Jan 2017


Regards,

Mahesh.B
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.kamailio.org/pipermail/sr-users/attachments/20200503/06f771c6/attachment.html>