> Dnia czwartek, 17 maja 2012 07:07:23 Roberto De Ioris pisze: >> > Yes, and this is how people deploy https load balancing using haproxy, >> > they >> > use tcp mode and source balancing. >> > There is patch for nginx that add support for storing SSL sessions in >> > memcached, so with session reuse enabled client can send requests to >> any >> > backend server. >> > >> > [1] >> http://hezmatt.org/~mpalmer/blog/2011/06/28/ssl-session-caching-in- >> > nginx.html >> > [2] >> http://hezmatt.org/~mpalmer/blog/2011/07/24/followup-to-ssl-session- >> > caching-with-nginx.html >> > [3] http://wiki.nginx.org/3rdPartyModules#Third_party_patches >> >> The first 2 links have been illuminating for me, thanks. >> >> I am not an ssl expert, so i will need to invest a bit of time on it if >> we >> want to make something kick-ass. > > Some bonus links from my bookmarks with some SSL benchmarks and other SSL > related stuff, could be a pointer: > > http://vincent.bernat.im/en/blog/#tag-ssl > > http://matt.io/technobabble/hivemind_devops_alert:_nginx_sucks_at_ssl/uq > http://matt.io/technobabble/hivemind_devops_alert:_nginx_does_not_suck_at_ssl/ur > > Łukasz Mierzwa >
Ok, i have managed to fix all of the performance/security points not-related to session resuming. Current implementation greatly passes the ssl test here: https://www.ssllabs.com/ssltest/ --https takes a fourth optional argument for specifying the ciphers suite. For example on a libssl 0.9.8 you can avoid BEAST attack with: --https 81.174.68.62:443,foobar.crt,foobar.key,RC4-SHA:HIGH:!ADH Now the only piece missing is session resuming (and i mean shared-session-resuming, as we want true horizontal scalability). The only thing scaring me is in the huge number of file descriptors (and ephemeral inet ports) we will need for each connection. For a memached/redis approach we will need: 1 socket for https -> 1 socket for memcached/redis -> 1 socket for uwsgi instance. So, three port for connection. We can sacrifice a bit of performance closing the connection to memcached/redis as soon as we get the value. This is faster that not having session cache at all. Regarding SNI it would be amazing having the subscription system direcly passing the certificate to proxies. But it will be something for 1.4... As soon as i will close bug #128 and the python-tracebacker is complete i will start releasing snapshots for 1.3 -- Roberto De Ioris http://unbit.it _______________________________________________ uWSGI mailing list [email protected] http://lists.unbit.it/cgi-bin/mailman/listinfo/uwsgi
