DeleGate SSL Performance Refinement

The overhead of SSL by DeleGate has become ten times lighter in DeleGate/9.0.1. Here is a demonstration of the performance comparison by a real HTTPS/SSL server at www.delegate.org. The DEMO pages for the benchmark includes fifty eight small in-line images built into DeleGate.

DEMO DeleGate/9.0.1 or later [version]
It takes about one or two seconds (reasonable).
- with HTTP Keep-Alive enabled for HTTPS/SSL
- with dynamic linking for SSL library
- with SSL context and session caches
DEMO DeleGate/8.11.X or former [version]
It takes about half a minute !! (too slow ;-)

Performance Measurement

I did simple performance measurement of SSL DeleGate to see roughly how the overhead is reduced with what device. Basically, DeleGate is executed as follows under the "time" command in csh.

    delegated -P9999 -f SERVER=https STLS=fcl

and accessed with URL "https://localhost:9999/-/builtin/icons/" reloading five times, generating 300 HTTP requests. The result of the measurement is shown below and it can be summarized as follows:

A) shows that the fundamental HTTP performance is not changed from 8.11.3 to 9.0.1.
B) shows that the overhead of SSL gateway is reduced to less than one-tenth in 9.0.1, and the overhead in HTTPS has become less than twice of that in HTTP.
C) shows that the combination of dynamic-link and SSL-cache (C-4), which is applicable to any application protocols, reduces the overhead to a half. And the most effective device in HTTPS protocol is keep-alive (C-5), obviously because it significantly reduces the number of TCP connections with SSL handshakes.

    __________________________________________________________________

    A measurement of CPU usage by SSL DeleGate

      Platform: MacOS X 10.3 on PPC 1GHz (iMac)
      Browser: Firefox 1.0.1 on PPC
      Load: reloading "https://localhost:9999/-/builtin/icons/" five times.

     A) http://localhost:9999/-/builtin/icons/  (HTTP)
       1) DeleGate/8.11.3           ... 0.7 seconds (.3u + .4s)
       2) DeleGate/9.0.1            ... 0.7 seconds (.3u + .4s)

     B) https://localhost:9999/-/builtin/icons/ (HTTPS/SSL)
       1) DeleGate/8.11.3           ... 18. seconds (9.u + 9.s)
       2) DeleGate/9.0.1            ... 1.3 seconds (.6u + .7s)

     C) https://localhost:9999/-/builtin/icons/ (HTTPS/SSL) with DeleGate/9.0.1
       1) no devices                ... 18. seconds (9.u + 9.s)   1     1
       2) dynamic-link alone        ... 14. seconds (6.u + 8.s)   1.3   0.77
       3) SSL-cache alone           ... 13. seconds (4.u + 9.s)   1.4   0.72
       4) dynamic-link + SSL-cache  ... 9.0 seconds (2.u + 7.s)   2.0   0.5
       5) HTTP keep-alive alone     ... 1.7 seconds (.9u + .8s)  10.6   0.09
       6) keep-alive + SSL-cache    ... 1.5 seconds (.7u + .8s)  12.0   0.08
       7) keep-alive + dynamic-link ... 1.5 seconds (.8u + .7s)  12.0   0.08
       8) all devices               ... 1.3 seconds (.6u + .7s)  13.8   0.07

     
       A)   delegated -P9999 -f SERVER=http
       B-1) delegated -P9999 -f SERVER=https FCL=sslway
       B-2) delegated -P9999 -f SERVER=https STLS=fcl
       C) delegated -P9999 -f SERVER=https and following options
       C-1) STLS="fcl,sslway -nocache" DYLIB= HTTPCONF=bugs:no-keepalive
       C-2) STLS="fcl,sslway -nocache"        HTTPCONF=bugs:no-keepalive
       C-3) STLS="fcl"                 DYLIB= HTTPCONF=bugs:no-keepalive
       C-4) STLS="fcl"                        HTTPCONF=bugs:no-keepalive
       C-5) STLS="fcl,sslway -nocache" DYLIB=
       C-6)                            DYLIB=
       C-7) STLS="fcl,sslway -nocache"
       C-8) STLS="fcl"
     
    __________________________________________________________________

[RETURN]

Yutaka Sato, May 3, 2005