RE: Odd SSL performance

2015-06-18 Thread Lukas Tribus
Hi Phil, Hello all: we are rolling out a new system and are testing the SSL performance with some strange results. This is all being performed on a cloud hypervisor instance with the following: You are saying nginx listens on 443 (SSL) and 80, and you connect to those ports directly from

Re: Odd SSL performance

2015-06-18 Thread Baptiste
Phil, First, use '-k' option on ab to keep connections alive on ab side. From a pure benchamrk point of view, using the loopback is useless! Furthermore if all VMs are hosted on the same hypervisor. You won't be able to get any accurate conclusion from your test, because the injector VM is

Re: Odd SSL performance

2015-06-18 Thread Phil Daws
Baptiste, as requested: openssl speed rsa2048 Doing 2048 bit private rsa's for 10s: 1189 2048 bit private RSA's in 10.00s Doing 2048 bit public rsa's for 10s: 50993 2048 bit public RSA's in 10.00s OpenSSL 0.9.8w 23 Apr 2012 built on: Mon Feb 17 16:11:28 PST 2014 options:bn(64,64) md2(int)

Re: Odd SSL performance

2015-06-18 Thread Baptiste
Phil, without -k, HAProxy spends its time to compute TLS keys. Can you run 'openssl speed rsa2048' and report here the number? My guess is that it shouldn't be too far from 400 :) Baptiste On Thu, Jun 18, 2015 at 3:20 PM, Phil Daws ux...@splatnix.net wrote: Hello Baptiste: we were seeing

Re: Odd SSL performance

2015-06-18 Thread Phil Daws
Hello Lukas: Path is as follows: Internet - HAProxy [Frontend:443 - Backend:80] - 6 x NGINX Yeah, unfortunately due to the application behind NGINX our benchmarking has to be without keep-alives :( Thanks, Phil - On 18 Jun, 2015, at 13:38, Lukas Tribus luky...@hotmail.com wrote: Hi

Re: Odd SSL performance

2015-06-18 Thread Phil Daws
Hello Baptiste: we were seeing lower tps from a remote system to the front-end LB hence trying to exclude client side issues by using the LB interface. Yes, when we use '-k', we do see a huge difference but its interesting that we pretty much always get 390 tps for a single core, and when we