Skip to main content
BlogLinodeNodeBalancer SSL

NodeBalancer SSL

nbssl

NodeBalancers ont toujours pris en charge les protocoles basés sur TCP, y compris SSL, mais nous avons le plaisir d'annoncer que NodeBalancers prend désormais en charge HTTPS en mode natif.

Cela signifie qu'un NodeBalancer peut terminer les connexions SSL pour vous, et avoir la fonctionnalité et le comportement que vous appréciez déjà en mode HTTP - y compris l'établissement correct d'un X-Fowarded-For avec l'adresse IP du demandeur, et des cookies de session pour l'adhérence du nœud dorsal.

Pour ce faire, créez un nouveau profil de configuration en utilisant le port 443 (généralement), définissez le protocole sur HTTPS, puis fournissez le certificat et sa clé privée (sans phrase de passe). Les certificats intermédiaires chaînés sont également pris en charge. Voici une capture d'écran montrant les nouvelles options :

nbssl

Remarque pour les sites SSL à fort trafic : la négociation SSL est une opération coûteuse en termes de calcul, et la capacité d'un NodeBalancer en mode SSL à suivre le rythme peut ne pas être suffisante. Dans ces situations, nous recommandons d'utiliser le mode TCP et de distribuer la charge de terminaison SSL à vos Linodes dorsaux. Alternativement, vous pouvez utiliser plusieurs NodeBalancers en mode SSL et utiliser le DNS round-robin.

Plus d'informations :

Bonne lecture !

Commentaires (10)

  1. Author Photo

    Does Linode use HAProxy to run this service?

  2. Author Photo

    Hi,

    If not good for high traffic, what’s the advantage ?

    Thanks

  3. Christopher Aker

    @Jan: convenience – it’s very easy to get SSL working using the NodeBalancer user interface. This is also a good first step for us supporting native SSL — we gotta start somewhere.

  4. Author Photo

    How computationally expensive is SSL for you guys?

    From Google: “On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead.” (https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html)

  5. Author Photo

    What kind of maximum concurrency are we talking about here for SSL on a nodebalancer?

  6. Author Photo

    What traffic max rate is expected to be handled by these balancers? If a regular balancer handles 10k, what about SSL ones?

  7. Christopher Aker

    NodeBalancers have a 10,000 concurrent connection limit. It’s not a request/sec limit. There is no artificial request/sec limit built into NodeBalancers. A NodeBalancer config in TCP or HTTP mode can accept connections pretty much as fast as packets can be slung to/from the backends. In other words: it’s a lot.

    A NodeBalancer config in HTTPS mode can achieve 10,000 concurrent connections, too – it may just take some time to ramp up to that. While testing very small requests (connections don’t live long) we’ve seen about 150 req/sec via HTTPS mode. Again, it’s a good place to start, and we’ll be working on improving the req/sec throughput of native HTTPS mode.

    Thanks for the comments 🙂

  8. Author Photo

    Hi. I previously asked if Linode uses HAProxy for this service? (And indirectly I guess I was wondering what other software/hardware is being use. My post is still awaiting moderation even though posts made after mine have been approved.

    In the past Linode has been quite open about its architecture, especially about its implementation of Xen. Is there a reason we don’t get much detail about how NodeBalancers work? Is there something offensive or inappropriate about me asking these things?

  9. Author Photo

    Tom, I’d be interested too… Although it’s not out of the realm of possibility that they built their own with something like Golang (esp since 1.1), an accounting proxy would be trivial on such stack.

  10. Author Photo

    Any chance to have TLS renegotiation so we can host more than one domain on HTTPS ?

Laissez un commentaire

Votre adresse électronique ne sera pas publiée. Les champs obligatoires sont marqués d'un *.