One issue we've had greatly delaying SSL is a bug in which when we reach a max socket allocation on the kernel for our load balancers from a single source. In retrospect it's a simple problem, just was a very convoluted one to find.
Why does this matter? Because many workplace or just plain bad proxies don't handle websockets correctly. They stick their nose in, don't understand what's happening and just break things. With SSL websockets they can't do that, they have to just forward the traffic along without interfering - which is what appears to be happening in your case and is the primary reason we're so adamant about deploying SSL for websockets.
Detailed answer:
First a preface: there is still a separate case of a proxy purposefully sitting in the way with either a local trusted or just bad certificate...you're out of luck in that case, there's nothing we can do if it's behaving badly.
So on our side, your SSL connection does this:
You --> SSL terminator --> HTTP front-end --> Webserver
It's more fun than that with the details, but that's generally what happens. Now what we're doing is replacing that nginx SSL terminator with native HAProxy (and enabling SSL for many more things at the same time). When doing so we have inter-process termination and proxy forwards from a few processes running SSL termination to the HTTP front-end's process, all happening on localhost. What was happening is when we reached a huge load of concurrent connections (yay websockets!) you exhaust the ephemeral points available for that local to local connection. If you want a more detailed explanation, Alecco Locco has an excellent one here.
This isn't a problem on Stack Overflow even, where we have ~about 1k simultaneous connections (we render really fast, so connections are brief). However, websockets stay around and we have 130k simultaneous connections as I write this.
So, how do we solve that? Well the answer's pretty simple, we expand that Terminator --> Front-end
binding to be across more IPs/ports in HAProxy via round-robin, each binding can handle about 25k concurrent connections with default ephemeral limits, so we spread the load across n
bindings.
Yesterday we ran a long-term test of this fix, and turn it off last night to patch our load balancers to the latest...well, everything. Tom is going to start porting our HAProxy module to Hiera and getting the latest configs sorted out. Hopefully soon after our New York meetup (starting in 9 days) we will be rolling out SSL websockets permanently.