up vote 1 down vote favorite
2
share [g+] share [fb]

We are experiencing various reliability problems with a setup that includes Jetty on CentOS 5 running predominantly SSL. There are unexplained disconnects and time-outs and occational looping, especially on long connections. This happens with different versions of the OS and Java.

Before we start swapping stuff component by component I would like to hear feedback from people running similar setup in production. Have you experienced any problems and if yes, what solutions did work for you? Is Java SSL implementation production-worthy at all?

UPDATE we solved the problem by avoiding use of Java SSL and using proxy server (nginx) to do SSL. The solution works without a glitch all these years.

link|improve this question
feedback

1 Answer

up vote 0 down vote

Java+SSL it is used for production. Your question is not very clear. May be you just need: -Djava.security.egd=file:/dev/./urandom

If this solve your performance problem, then, for production, you might need a hardware entropy generator. This requirement depends on the security policy for your production environment.

Do some performance debugging. Try without SSL, do network dumps, Java thread dumps, monitor your JVM with VisualVM or JConsole. Do load testing with JProfile.

link|improve this answer
Mircea, we did a lot of testing and debugging before posting this question 2 years ago. I discovered many other people having similar problems. Since then, I try to avoid Java SSL, at least in high-performance situations and advise other people to do so. – Sasha O Dec 15 '11 at 4:01
There are some SSL hardware accelerators that you can use with Java. This will offload the SSL part from Java to a hardware device. See: coresecuritypatterns.com/blogs/?p=1918 The JVM version is important too. – Mircea Vutcovici Dec 15 '11 at 14:35
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.