4

A lot of the expensive 12-25k solutions seem limited to 4k SSL connections simultaneously. Loadbalancer.org has a reasonably priced solution for many HTTP requests, but is limited to 2k SSL connections.

For a site as active as mine, will that be enough? Is there a better way to do it than to rely on the load balancer which may or may not have an ASIC SSL off loader co-processor where I can get more than the 4k ceiling for sub 17k machines?

Do they make ASIC SSL cards that can go into a pci-x/express port? (I have not been able to find much even at google). Is there a guideline/recommendation spec for a build your own solution that can be dedicated just to process the SSL encryption/decryption?

We'd be looking for high availability/loadbalancing type solutions. Even if that means we use separate load balancers (in tandem) with reverse proxy boxes cruncing SSL conenctions.

PCI compliance is also a concern, so any suggestions should fall within those guidelines as well.

6 Answers 6

4

Scale out, not up. Use a TCP-level load balancer (Linux HA is free and outscales and outperforms every proprietary solution I've ever used), and forward the SSL connections to the machines behind it and let them do the SSL stuff. No need to worry about whether an individual "SSL accelerator" can handle the connection rate because if you need more, you just bung another backend box in.

2

Open Source SSL Acceleration has a DIY Linux SSL accelerator example - see also the F5 rebuttal.

1

On the appliance side Brocade (formerly Foundry Networks) have the ServerIron line.

Their SSL modules can do this, although the new versions they've just introduced won't have SSL for another few months.

They certainly aren't cheap (a pair of the entry level (albeit 16M sessions) non-SSL models is ~US$30k) but they're easily the most reliable equipment we've ever used, ~10 years in production and we've never even lost a power supply or port from ~20 in production. However we don't currently use SSL as our endpoints don't support it.

Most of the SSL accelerator cards seem to have fairly lacluster driver support. Test one before deploying, many of them saturate well below host capacity.

1

I'm a big fan of the relatively inexpensive KEMP LoadMaster series. They are full-featured load balancers with ASIC SSL offloading. They are non-OSS linux-based appliances. Support is outstanding and the feature set keeps improving, frequently in direct response to user requests.

0

Sun have a crypto accelerator which has drivers for Solaris, RHEL and SUSE, a quick google shows IBM and Discretix have cards as well.

1
  • whistles... $1350+ for the Sun crypto accelerator buys a lot of extra general-purpose hardware.
    – womble
    Jul 22, 2009 at 9:46
0

Err... I think you have your numbers wrong, "seem limited to 4k SSL connections simultaneously." The limitation is TPS terminations per second... Which even on a Loadbalancer.org appliance could mean millions of concurrent users. Also as the first guy said, scale out not up, the TPS restriction is only for SSL terminated locally on the load balancer if you pass the SSL through to the backend cluster you get almost unlimited scalability.