Salesforce

Low performance to connect to WebSpeed when enabling SSL.

« Go Back

Information

 
TitleLow performance to connect to WebSpeed when enabling SSL.
URL NameLow-performance-to-connect-to-WebSpeed-when-enabling-SSL
Article Number000187244
EnvironmentProduct: OpenEdge
Version: 11.x
OS: Linux, UNIX
Other: Security, SSL
Question/Problem Description
Low performance to connect to WebSpeed when enabling SSL.

The WebSpeed messenger is over 40 times slower  to connect than a messenger without SSL.

It takes a long time to start the SSL enabled WebSpeed Broker.

A direct connection without SSL to the same WebSpeed broker AppServer is immediate.
 
Steps to Reproduce
Clarifying Information
SSL is enabled for the WebSpeed Messenger and Broker.
Error Message
Defect Number
Enhancement Number
Cause
SSL uses the operating system random generator for internal cryptography. By default this is /dev/random which has a performance overhead due to it generating very high quality randomness and requiring a populated entropy pool. Components using SSL can encounter a performance drop as a result.
Resolution
Change the Operating System random generator to /dev/urandom which will return quicker but is theoretically less secure. This can be done in a number of places:

1.  At the Operating System level

Please consult with the relevant vendor for information on how to configure this on other operating systems.

For example, on Linux systems, executing "rngd -r /dev/urandom" can be used to start the Random Number Generator daemon set to /dev/urandom.

2.  At the Java level

/dev/urandom can be designated in $DLC/jre/lib/security/java.security.  Any specific questions on this usage should be addressed to the relevant Java provider.

The relevant section and parameter is as follows:
# Select the source of seed data for SecureRandom. By default an
# attempt is made to use the entropy gathering device specified by
# the securerandom.source property. If an exception occurs when
# accessing the URL then the traditional system/thread activity
# algorithm is used.
#
# On Solaris and Linux systems, if file:/dev/urandom is specified and it
# exists, a special SecureRandom implementation is activated by default.
# This "NativePRNG" reads random bytes directly from /dev/urandom.
#
# On Windows systems, the URLs file:/dev/random and file:/dev/urandom
# enables use of the Microsoft CryptoAPI seed functionality.
#
securerandom.source=file:/dev/urandom

#.  At the UBroker level.

Configure /dev/random using the jvmArgs setting. For example, on Linux systems:

jvmArgs=-Djava.security.egd=file:/dev/./urandom

When added to the [UBroker.WS] section, it is set to be used for all WebSpeed Brokers. Otherwise for a specific WebSpeed instance it can be added to that WebSpeed's settings e.g. [UBroker.WS.wsbroker1].

For specific an WebSpeed broker it is possible to set it through the OpenEdge Explorer WebSpeed broker Advanced Features section, under jvmargs: set the parameter -Djava.security.egd=file:/dev/./urandom 

 
Workaround
Notes
Keyword Phrase
Last Modified Date11/20/2020 7:26 AM

Powered by