Ubuntu 22.04 Low Entropy Causes Slow TLS Handshakes

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

TLS operations are slow during startup or key generation, impacting API response times and service readiness.

Environment & Reproduction

Ubuntu 22.04 minimal VMs or headless instances with low entropy generation under burst cryptographic load.

Root Cause Analysis

Insufficient entropy pool availability delays random number generation required for secure key material operations.

Quick Triage

Check entropy_avail in /proc/sys/kernel/random/entropy_avail and measure handshake timing with openssl s_time or curl timing.

Step-by-Step Diagnosis

Correlate low entropy periods with service startup peaks, review rng daemon status, and inspect virtualization entropy device exposure.

Solution – Primary Fix

Enable hardware RNG/virtio-rng where available, configure rng-tools service, and stagger crypto-heavy service initialization.

Solution – Alternative Approaches

Use haveged where policy permits, pre-generate keys in secure maintenance windows, or offload TLS termination.

Verification & Acceptance Criteria

Entropy remains above operational threshold and TLS handshake latency stays within SLO targets.

Rollback Plan

Disable newly introduced entropy daemon if instability occurs and revert to previous crypto startup behavior.

Prevention & Hardening

Include entropy checks in baseline monitoring and ensure virtual platform exposes reliable RNG devices by default.

Related Errors & Cross-Refs

Related Ubuntu 22.04 problems include slow SSH key generation and delayed PKI bootstrap in fresh instances.

Related tutorial: View the step-by-step tutorial for Ubuntu 22.04 LTS.

View all Ubuntu 22.04 LTS tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Linux random subsystem docs, Ubuntu rng-tools package documentation, and OpenSSL performance tuning references.