CertificateFetchFailed during concurrent request spikes in CertificateManager

Question

Concurrent Certificate Fetching Latency
In high-throughput environments using threedsmax, the CertificateManager performs synchronous HTTP GET requests to retrieve 3DS certificates. When multiple threads trigger this process simultaneously, the lack of synchronization in the certificate retrieval logic leads to significant latency spikes and duplicate cache entries.
Under heavy load, this behavior can trigger a CertificateFetchFailed error when the HTTPS call exceeds the timeout threshold. Because the current implementation lacks internal retry logic or a synchronized caching mechanism for these calls, concurrent requests often fail rather than waiting for a single shared fetch operation to complete.
Given the current design of the fetchAndCacheCertificate() method, what is the recommended strategy to prevent race conditions during certificate retrieval? Should the library be configured with a specific TTL to avoid per-request fetching, or is there a mechanism to synchronize concurrent fetch attempts?

Siddharth · Answer

The CertificateFetchFailed errors during concurrent request spikes stem from uncoordinated synchronous HTTP calls in CertificateManager. The root issue is the lack of synchronization during certificate retrieval, leading to duplicate requests, cache contention, and eventual timeouts.
Recommended Solution
Implement a synchronized cache layer with these steps:

Add a lock mechanism around the fetchAndCacheCertificate() method to ensure only one thread retrieves a certificate per domain at a time. Use a ConcurrentHashMap to track in-progress fetches.
  Introduce a TTL-based cache (e.g., 24 hours) to avoid per-request fetching. This reduces CA load and improves latency. Example configuration:
  CertificateManager.setCacheTTL(86400); // 24 hours in seconds
  
  Implement exponential backoff for retries when the CA responds with HTTP 429 (Too Many Requests). This prevents overwhelming the CA during throttling periods.

Verification Steps
To confirm the fix:

Deploy the changes in a staging environment.
  Simulate concurrent load (e.g., 100+ threads) using a tool like JMeter.
  Monitor for:
    
      Reduced CertificateFetchFailed errors in logs.
      Lower average response time for certificate retrieval.
      No duplicate cache entries for the same domain.

Missing Diagnostic: What is the current retry policy (if any) in CertificateManager? This determines whether backoff needs to be added or configured.

CertificateFetchFailed during concurrent request spikes in CertificateManager

Concurrent Certificate Fetching Latency

1 answer

Recommended Solution

Verification Steps

Your perspective belongs here.

0 question comments