You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Jeremy Conner <jc...@uplogix.com> on 2004/06/14 21:56:05 UTC
How to optimize Tomcat SSL
Is there any way to optimize Tomcat's SSL implementation?
Can I change the protocol to only use 40 bit encryption?
Can I change the default keep alive time for the SSL session?
Are there any other values for 'protocol' other than TLS?
I am running a web app that is using Axis for web service communication
to alot of client apps. These apps communicate to the server every 30
seconds. I would like a way to cache the SSL session so that
handshaking is not happening every time.
It looks like the typical answer to optimizing SSL is to not use Tomcat
for SSL and use Apache. Is that really the recommended solution?
Here is my current config:
<Connector
className="org.apache.catalina.connector.http.HttpConnector"
port="8443"
minProcessors="5"
maxProcessors="100"
connectionTimeout="60000"
enableLookups="true"
acceptCount="10"
debug="0"
scheme="https"
secure="true">
<Factory
className="org.apache.catalina.net.SSLServerSocketFactory"
clientAuth="true"
protocol="TLS"
keystoreFile="/serverKeys"
keystorePass="password"/>
</Connector>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: How to optimize Tomcat SSL
Posted by Alex Burton <al...@e-plus.com.au>.
We use Apache HTTP on the front for SSL. Makes a world of difference.
Cheers,
Alex.
Jeremy Conner wrote:
> Is there any way to optimize Tomcat's SSL implementation?
>
> Can I change the protocol to only use 40 bit encryption?
> Can I change the default keep alive time for the SSL session?
> Are there any other values for 'protocol' other than TLS?
>
> I am running a web app that is using Axis for web service
> communication to alot of client apps. These apps communicate to the
> server every 30 seconds. I would like a way to cache the SSL session
> so that handshaking is not happening every time.
>
> It looks like the typical answer to optimizing SSL is to not use
> Tomcat for SSL and use Apache. Is that really the recommended solution?
>
> Here is my current config:
>
> <Connector
> className="org.apache.catalina.connector.http.HttpConnector"
> port="8443"
> minProcessors="5"
> maxProcessors="100"
> connectionTimeout="60000"
> enableLookups="true"
> acceptCount="10"
> debug="0"
> scheme="https"
> secure="true">
> <Factory
> className="org.apache.catalina.net.SSLServerSocketFactory"
> clientAuth="true"
> protocol="TLS"
> keystoreFile="/serverKeys"
> keystorePass="password"/>
> </Connector>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
RE: How to optimize Tomcat SSL
Posted by Peter Lin <tc...@yahoo.com>.
yup, you sure can if you're willing to subject the users to the annoying message. What some people do is get a dedicated image server and setup https on it. that way, you don't get the annoying warning and you don't impact the webserver doing the real work.
peter
Gabi <ga...@idieikon.com> wrote:
I write only to comment that you can support more connections if you serve
pages through https BUT images from http.
(You'll remember many https pages where the browser warms you something like
"this page contains insecure elements or something similar...
>from the old benchmarks Remy and I ran, 20 concurrent connections is the
limit for SSL. fewer
>if you have lots of graphics. Even though a 2ghz CPU webserver can handle
10 concurrent SSL
> ...
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
---------------------------------
Do you Yahoo!?
New and Improved Yahoo! Mail - Send 10MB messages!
RE: How to optimize Tomcat SSL
Posted by Gabi <ga...@idieikon.com>.
I write only to comment that you can support more connections if you serve
pages through https BUT images from http.
(You'll remember many https pages where the browser warms you something like
"this page contains insecure elements or something similar...
>from the old benchmarks Remy and I ran, 20 concurrent connections is the
limit for SSL. fewer
>if you have lots of graphics. Even though a 2ghz CPU webserver can handle
10 concurrent SSL
> ...
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
Re: How to optimize Tomcat SSL
Posted by Peter Lin <tc...@yahoo.com>.
the good news is there's nothing much you can do to optimize tomcat's SSL. The bad news is SSL is CPU intensive. the most reliable way to improve SSL performance is to get a hardware accelerator. People tend to disagree on this, but I am biased in favor of using hardware acceleration.
from the old benchmarks Remy and I ran, 20 concurrent connections is the limit for SSL. fewer if you have lots of graphics. Even though a 2ghz CPU webserver can handle 10 concurrent SSL connection and stay around 50% CPU usage, I personally wouldn't want to do that. On a 400-500mhz CPU 5-8 is the limit. I hope that helps.
peter
Jeremy Conner <jc...@uplogix.com> wrote:
Is there any way to optimize Tomcat's SSL implementation?
Can I change the protocol to only use 40 bit encryption?
Can I change the default keep alive time for the SSL session?
Are there any other values for 'protocol' other than TLS?
I am running a web app that is using Axis for web service communication
to alot of client apps. These apps communicate to the server every 30
seconds. I would like a way to cache the SSL session so that
handshaking is not happening every time.
It looks like the typical answer to optimizing SSL is to not use Tomcat
for SSL and use Apache. Is that really the recommended solution?
Here is my current config:
className="org.apache.catalina.connector.http.HttpConnector"
port="8443"
minProcessors="5"
maxProcessors="100"
connectionTimeout="60000"
enableLookups="true"
acceptCount="10"
debug="0"
scheme="https"
secure="true">
className="org.apache.catalina.net.SSLServerSocketFactory"
clientAuth="true"
protocol="TLS"
keystoreFile="/serverKeys"
keystorePass="password"/>
---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-user-help@jakarta.apache.org
---------------------------------
Do you Yahoo!?
Friends. Fun. Try the all-new Yahoo! Messenger