up vote 0 down vote favorite
share [g+] share [fb]

We recently went through some system load testing and were told that there where many SSL negotiation issues and timeouts. I couldn't find anything in the iis logs about this (all requests where 200). Is there somewhere else where Windows 2003/IIS may log this information?

UPDATE: Seeing that the SSL cert is configured with IIS, isn't IIS responsible for making the connection to the client via SSL? Or is SSL negotiated separate from IIS and IIS just handles the HTML over SSL part? It is IIS that responds to to port 443 (assuming 443 configured for HTML of SSL), so I am a bit confused why it wouldn't log about these connections?

I used the SSL Diagnostics application, it is quite easy to setup and use. I didn't find any issue with the actual negotiation of the SSL channel, it is just taking a long time for the handshaking complete. So my next step is to determine what we need to do to improve our SSL handshaking time. First thought is to have SSL handshaking to occur at the load balancer, not the servers themselves.

link|improve this question
67% accept rate
feedback

2 Answers

up vote 1 down vote accepted

SSL negotiation happens before any HTTP headers are processed so you won't see this in the IIS logs. Have you looked through your event logs to see if there is anything there?

EDIT:
You can also have a go with SSL Diagnostics from Microsoft, specifically SSLMon. Looks like it might have something that will be of benefit to you, although I admittedly have not played with it yet.

link|improve this answer
Good point, though I don't think this would be in an event log either, agreed? – Brettski Sep 14 '09 at 19:29
I thought I'd remembered seeing something but going back it was Kerberos related and not SSL related... I edited my post with a link to a MS tool that might help. – squillman Sep 14 '09 at 19:48
Thank you squillman, I will take a look at SSL Diagnostics – Brettski Sep 14 '09 at 21:57
feedback
up vote 0 down vote

I would think this would show up in a network trace and not in the IIS logs unless it was outright failing. You could try logging status, substatus, and win32status to see if there are any details about what's happening.

Who told you that these issues existed and how did they determine it?

link|improve this answer
The person conducting the test determined this based on what Loadrunner told them. I am looking for proof of this on our side of the network. – Brettski Sep 14 '09 at 19:28
Are you paying them for the testing? If so, I would think they would want to share all of their test results and methods with you, including any log files, network traces, etc. If you're not paying them, why are they performing the tests? Can you get them to be more specific with their findings? – joeqwerty Sep 14 '09 at 19:40
Thank you Joe, I will deal with that when I can. I want to know how to monitor SSL Negotiation with IIS. Post updated. – Brettski Sep 14 '09 at 21:56
I think you'll need to use some type of SSL sniffer for that. If you install Microsoft Network monitor 3.3 you can see the SSL traffic in a capture, but I don't know if it will tell you what you need. – joeqwerty Sep 15 '09 at 1:41
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.