From: Tomas Vondra <tomas.vondra@2ndquadrant.com>
To: pgsql-performance@postgresql.org
Subject: Re: Connection time when using SSL
Date: Mon, 01 Jun 2015 23:21:10 +0200
Message-ID: <556CCCC6.6030109@2ndquadrant.com> (raw)
In-Reply-To: <CO2PR0701MB759D55FEB89EFC60F14E310F0B60@CO2PR0701MB759.namprd07.prod.outlook.com>
References: <CO2PR0701MB759D55FEB89EFC60F14E310F0B60@CO2PR0701MB759.namprd07.prod.outlook.com>
List-Unsubscribe: <mailto:majordomo@postgresql.org?body=unsub%20pgsql-performance>
Hi
On 06/01/15 22:51, Marco Di Cesare wrote:
> I am connecting to a Postgres instance using SSL and seeing fairly slow
> connect times. I would expect there would be some overhead but it's more
> than I anticipated. The connection is happening over a network. I am
> using a wildcard SSL certificate on the server side only.
> Using one of these JDBC SSL connect strings takes on average: 1060 ms to
> connect to the database:
> jdbc:postgresql://db01-dev.pointclickcare.com:5432/testdb?ssl=true&sslmode=require&sslfactory=org.postgresql.ssl.jdbc4.LibPQFactory
> - or -
> jdbc:postgresql://db01-dev.pointclickcare.com:5432/testdb?ssl=true&sslmode=require&sslfactory=org.postgresql.ssl.NonValidatingFactory
> Using this JDBC non-SSL connect string takes on average: 190 ms to
> connect to the database:
> jdbc:postgresql://db01-dev.pointclickcare.com:5432/testdb
> Does this sound like a reasonable overhead that SSL would add to the
> connection time or does this seem high? (~870ms/~443% slower using SSL)
What is the network latency (ping) between the two hosts? SSL requires a
handshake, exchanging a number messages between the two hosts, and if
each roundtrip takes a significant amount of time ...
The 190ms seems quite high. On my rather slow workstation, a local
connection without SSL takes ~30ms , with SSL ~70ms. So I wouldn't be
surprised by ~100ms roundtrips in your case, and that is going to slow
down the SSL handshake significantly.
There's very little you can do with the roundtrip time, usually, but you
can keep the connections open in a pool. That'll amortize the costs.
regards
--
Tomas Vondra http://www.2ndQuadrant.com
PostgreSQL Development, 24x7 Support, Remote DBA, Training & Services
--
Sent via pgsql-performance mailing list (pgsql-performance@postgresql.org)
To make changes to your subscription:
http://www.postgresql.org/mailpref/pgsql-performance
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-performance@postgresql.org
Cc: tomas.vondra@2ndquadrant.com
Subject: Re: Connection time when using SSL
In-Reply-To: <556CCCC6.6030109@2ndquadrant.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox