Article Type: FAQ

This article describes different components of XDQP SSL-enabled performance.

A few things about MarkLogic XDQP SSL Enabled...

1. By default, the MarkLogic Server has TLS enabled and is forced to use FIPS mode (Federal Information Processing Standards). 
2. MarkLogic uses the OpenSSL library (open source) for Encryption implementation, the industry standard for all major software vendors.
3. Enabling SSL on XDQP does NOT change number of initial TCP channels (3) on XDQP Port (7999), rather MarkLogic will establish 3 SSL Channels instead of TCP channels. Overhead to establish 3 SSL channels, are extra SSL handshakes in addition to the 3-way TCP handshakes during cluster startup (which are needed in non-SSL scenario as well).
4. Once the SSL channel is established, the nature and number of XDQP messages on top of SSL do not change purely because of the SSL configuration (bandwidth usage will only change based on load).

MarkLogic Internal XDQP SSL Enable Performance Test results...

The following results are from a single MarkLogic Lab infrastructure test. They may vary depending on several other factors, some of which are described later in this article.

XDQP+SSL:

• a.(1 Threads) :
            4.124 % overhead
• b.(4 Threads) :
            1.435 % overhead
• c.(16 Threads) :
            5.034 % overhead
• d.(64 Threads) :
            -3.395 % overhead

Based on internal testing, we do not expect an XDQP SSL Performance difference of more than ~5%;

While SSL does not add overhead to network traffic (except initial SSL handshake), Encryption itself has a Processing Cost.

1) Hardware/CPU support for Encryption: Once the channel is established (cluster startup), XDQP data communicated are encrypted with symmetrical cryptography using the OpenSSL library. However, most modern CPUs provide hardware-based encryption support, accelerating the Encryption itself. If enabling SSL over XDQP results in considerable Performance cost, you should check with your hardware provider whether your hardware has encryption support and ask to see their test data.  

2) Resource Availability for Current Load Pattern: Ensure you have sufficient CPU and Memory in your environment with an existing load so that enabling XDQP SSL does not tip you over the edge.

3) Firewall: Various 3rd party tests confirm that a firewall (and other SSL inspection software) contributes to SSL performance (once SSL traffic grows beyond a certain limit). If you are running into a Performance issue, we recommend testing the Performance after disabling the Firewall & other Network inspection software across the clusters (including Routers) and measuring the difference to see if that is the direction of the Performance issue resolution.

• FIPS mode (Wikipedia)
• OpenSSL (Open Source Project)