Re: Haproxy / stunnel performance

From: XANi <>
Date: Wed, 12 May 2010 21:46:19 +0200

Dnia 2010-05-12, śro o godzinie 17:15 +0200, Michael Rennt pisze:

> Hello!
> This might be a bit off-topic (but just a little bit), as my question is related to the performance
> of stunnel when used with haproxy.
> First of all: Is haproxy + stunnel the most common technique for terminating ssl with haproxy? Is
> there a solution that's more common or even uncommon but performing better on a 99% ssl traffic
> loadbalancer?
> We are currently terminating ssl via stunnel (4.27, ulimit -n 50000), handing the decrypted traffic
> over to haproxy 1.3.23 via Haproxy is proxying the request to 2 other systems.
> The loadbalancer is an Intel XeonDual Core E3110 with 4 GB RAM, so plenty of ressources for a system
> doing nothing else besides ssl termination / load balancing.
> We are experiencing a limit of about 100 requests per second on the ssl path. Unencrypted direct
> connections to haproxy perform much better, of course, so I'm pretty sure haproxy is not a bottleneck.
> Basically I'm interessted in getting feedback on how other people implement ssl termination on a
> haproxy system and if you're reaching a request rate higher than 100 req/s? This is why I didn't
> supply any configuration settings in this mail.
> The stunnel config is very basic. We played around with the timeout values and ulimit values a bit,
> without any noticeable performance boost while the system was loaded.
> The system load "idles" at around 0.11 most of the time.
> Thanks in advance.
> Best,
> Michael

IM not familiar with stunnel, can stunnel utilize more than one core ? If not u might try to use some light http server like lighttpd or nginx as ssl proxy.

Mariusz Gronczewski (XANi) <>
GnuPG: 0xEA8ACE64

Received on 2010/05/12 21:46

This archive was generated by hypermail 2.2.0 : 2010/05/12 22:00 CEST