ARR adding 1 second delay to requests as SSL-offloading reverse proxy

Hi,

I asked this question on StackOverflow, but have not received a response yet and am getting desperate...

Use Case and Problem

We have a Delphi SOAP service which needs to be SSL-enabled. I opted to use an IIS ARR reverse proxy to do SSL offloading for ease of configuration (compared to OpenSSL and manual certificate + passphrase management). ARR works, but it adds an insane amount of overhead... Response time went from under 2 seconds to 19 seconds for 18 service requests (about 60Kb compressed total).

I tried tweaking and disabling most settings, including caching, buffers, application pool lifetimes, etc. I tried different hosts with clean IIS setups, including a monster production Windows Server 2012.  SSL itself is not the overhead, just having an ARR HTTP (non-SSL) reverse proxy causes the same delay.

Logging Results so Far

I added timestamp logging to client & server for when messages are both sent and received. It shows about 1 second added to each request routing through ARR between sending from the client and receipt by the service. The response is routed back very quickly, only the request routing via ARR is slow (see image below).

IIS Failed Request Tracing logs show the 1 second delay happening on ApplicationRequestRouting EXECUTE_REQUEST_HANDLER, but I do not know how to dig deeper from here...

Question

How can I trace the source of overhead? Is ARR not suited to this use case?

Request & response samples from Fiddler:

• Raw HTTP Request
• Raw HTTP Response

Thanks!

Carl