2

I've been struggling recently with try to identify where the performance on our environment is bottlenecking.

Environment (each server is Linux VM, 8 Cores, 32 GB RAM):

Load Balance: 50

Web Servers (rsync): 51, 52, 54

DB (MySQL 5.6 master master): 56, 58

I set up a load-balanced environment with HAProxy for load balancing and Nginx for SSL termination on ...50. HAProxy listens on port 80 and directs traffic to ...51, 52, or 54. It also listens on port 3306 and directs traffic between .._.56, and 58 for database load balancing. Nginx listens on port 443 and handles the SSL handshake while forwarding the actual traffic to port 80 on the same machine, where it is handled by HAProxy.

That setup handles non-SSL connections at ~1000/sec, but SSL connections are handled at ~300/sec.

I recently altered the environment by upgrading our version of HAProxy to one that could handle SSL termination. HAProxy now listens on port 80 and port 443, handling the SSL handshake in the case of the latter, and forwarding the traffic to the webservers: 51, 52, and 54. The performance stayed roughly the same, but the configuration was much simpler.

I've watched top on the load balancer, and there doesn't appear to be hardly any load on the server in either case; port 80 or 443 traffic. The web servers get hammered during my port 80 tests, as expected, but they show very little load during my 443 tests.

Is there anything that you are aware of that can be done to increase the response time of our SSL connections?

Any and all tips or suggestions are welcome, I'd like to get as much performance as I can.

Thanks All!

3
  • Did you optimize used SSL ciphers in any way? For sexample with "prefer-server-ciphers" or something like "ciphers RC4-SHA:AES128-SHA:AES256-SHA"?
    – marcoc
    Feb 5, 2014 at 14:35
  • BTW check if having so many CPUs in each VM is really necessary: sometimes having many CPU leads to worst performances.
    – marcoc
    Feb 5, 2014 at 16:54
  • Take a look at insouciant.org/tech/ssl-performance-case-study
    – sciurus
    Feb 5, 2014 at 18:54

1 Answer 1

2

Put faster SSL ciphers on top of the list (of course those that match your security requirements)

Example for haproxy

bind *:443 ssl crt /etc/ssl/... ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS:!AES256 prefer-server-ciphers ... 

My settings on an nginx instance are the following

ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:ECDH+3DES:DH+3DES:RSA+AESGCM:RSA+AES:RSA+3DES:!aNULL:!MD5:!DSS:!AES256;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;

You can test the speed of the SSL ciphers available on your balancer, for example with

$ openssl speed

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .