title: haproxy queue time (qtime) during SSL SNI expection
body: <p>We are using <strong>haproxy 1.5.14</strong> as a load-balancer for HTTP as well as HTTPS endpoints for multiple domain hostnames. For the HTTPS endpoints we are using SSL NI headers inspection to find out proper backend node.</p>
  
  <p>In my current installation where multiple https endpoints exist, I've noticed that backend <strong>qtime</strong> stat vaue is pretty high (200-300ms), which disturbs me a lot. <strong>qcur</strong> (current queue lengh) is zero at the same time.
  Are we basically slowing down all our requests by 200ms-300ms at haproxy side? (not sure if I understood this value of qtime properly) If yes - I am definitely searching the way to optimize it.</p>
  
  <p>This behavior is only observed on the HTTPS backends and not on HTTP backends. I am wondering if this is result of the frontend SNI headers inspection which are used to determine proper backend nodes. Will request stay in the queue during SSL SNI inspection?</p>
  
  <p>Our current config(for HTTPS endpoints only):</p>
  
  <pre><code>global
        log         127.0.0.1 local2
        chroot      /var/lib/haproxy
        pidfile     /var/run/haproxy.pid
        maxconn     40000
        ulimit-n    100000
        user        haproxy
        group       haproxy
        daemon
        stats socket /var/lib/haproxy/stats
  
  defaults
        mode                    http
        log                     global
        option                  httplog
        option                  dontlognull
        option http-server-close
        retries                 3
        timeout http-request    1s
        timeout queue           1m
        timeout connect         3s
        timeout client          1m
        timeout server          30s
        timeout http-keep-alive 2s
        timeout check           3s
        maxconn                 40000
  
  frontend https-in *:443
      mode tcp
              option tcplog
              option socket-stats
  
              tcp-request inspect-delay 5s
              tcp-request content accept if { req_ssl_hello_type 1 }
  
              use_backend foo-ssl if { req_ssl_sni -m beg foo }
              use_backend bar-ssl if { req_ssl_sni -m beg bar }
  
  backend foo-ssl *:443
      balance leastconn
      mode tcp
              option ssl-hello-chk
  
              server foo1 x.x.x.x:443 maxconn 10000 check
              server foo2 x.x.x.x:443 maxconn 10000 check
  
  backend bar-ssl *:443
      balance leastconn
      mode tcp
              option ssl-hello-chk
  
              server bar1 x.x.x.x:443 maxconn 10000 check
              server bar2 x.x.x.x:443 maxconn 10000 check
  </code></pre>