Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm using Apache 2.2 running on Windows Server 2008 R2 as a WebDAV server for clients to upload large media files (roughly 100-2000MB). I am finding that when I have SSL enabled (openSSL 0.9.8o) and use HTTPS for the uploads the throughput is around 13Mbps but when I disable it and just use HTTP I get around 80Mbps. I can't understand why this is happening as my understanding was that the heavy SSL work was done at the beginning of the connection.

If it helps the client that I am using is command line cURL and here is the command:

curl -k -f -u digital:recorder -T 00320120321101048_ch1.mkv http://mediaserver/webdav/
curl -k -f -u digital:recorder -T 00320120321101048_ch1.mkv https://mediaserver/webdav/

Does anyone have any idea why the performance is so drastically affected by enabling SSL?

Cheers.

UPDATE: The problem does not exist on Windows 7 clients so this only happens on XP. This at least identifies that the issue is at the client end. I am running the exact same command line from both systems but it only affects WinXP. Does anyone know of why that might be? That XP is somehow crippling the SSL upload speed?

I've run tests on Fedora Linux as well. So the issue has now been closer defined to be that the same version of cURL + OpenSSL uploading the same file to the same server is fast on Linux and Windows 7 but very slow on Windows XP.

Can anybody help with this because I've really hit a brick wall!

share|improve this question
2  
Do you have KeepAlive enabled? If your browser is re-negotiating every time that would certainly kill your performance. –  voretaq7 Mar 21 '12 at 18:07
    
A browser is not being used. The environment is an automated distributed system with client systems uploading MKV media files via the cURL library. Also, these are large files rather than web pages or images. Do you think that KeepAlive would be relevant here? I thought it was more for when a lot of smaller files were coming down over a single connection. –  takesides Mar 21 '12 at 20:44
    
Keepalives are performed at the HTTP protocol level. whatever client you are using must support them in order for them to be used. –  voretaq7 Mar 21 '12 at 22:23
    
I've just checked and KeepAlive is enabled in Apache. I did think it was unlikely to help. –  takesides Mar 22 '12 at 8:42
add comment

2 Answers

SSL encryption is a CPU-intensive task. The "heavy SSL work" is not done just after the connection is started, but the encryption must be done for the entire file upload.

Check the CPU consumption of your server with and without enabling SSL and you will see a big difference.

share|improve this answer
    
That thought occurred to me too but these are reasonably high-specced machines and the CPU on both was < 5% with SSL enabled so that can't be the issue. –  takesides Mar 21 '12 at 20:40
1  
SSL is not so CPU-intensive. It's mostly the handshake, see: stackoverflow.com/a/548042/372643 –  Bruno Mar 22 '12 at 0:05
add comment
up vote 1 down vote accepted

Well the answer was that this was an issue with the way that Windows XP handles SSL packets. Strange but true. In the end we modified the cURL library ourselves to avoid the problem.

For anyone else having this problem with Apache as the WebDAV target then I found that another option is to use the SSLCipherSuite directive to change the encryption level to MEDIUM (the default is HIGH). This means that it uses 128-bit RSA rather than 256-bit AES encryption which sped up the throughput to almost non-encrypted speed levels. This may or may not help on IIS servers as I haven'y had a chance to try this yet.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.