SSL on MQ : CPU Performance

Question

I would like to deploy SSL on a MQ server but I would like to know if my current CPU capacity will support SSL. (I do not have budget to increase the number of CPU cores and MQ PVU)

My specs:

Windows 2003 Server SP2, 1 core of Intel Xeon CPU E5-2690 2.9GHz, 2 GB RAM, 1 Qmgr, Linear Logging, Persistants messages, DQM with 5 parteners, 10 senders channels, 10 receivers channels

For a month:

we exchange in average 3 million messages with our partners on a total of 15Gbytes of data. (so 5K per message). we had in average variations of CPU between 20% and 40% we had 4 peaks of 100% CPU

Do you think my system can cope SSL with Cipher RC4_MD5_EXPORT ?

Best Regards,

Pascal

Answer 1

I don't think it's possible to provide a definitive answer as to whether your server can cope with enabling SSL using the RC4_MD5_EXPORT cipher on your MQ channels short of trying it and assessing the impact. You may also want to take a look at the processor queue length using the Windows Performance Monitor tool to see how many processes are waiting for CPU time when the usage increases.

As your CPU provides hardware support for the AES encryption algorithm you may want to consider using one of the AES CipherSpecs instead. This also has the advantage of providing better security as both MD5 and RC4 are fairly weak in terms of hashing and encryption.

One option to consider is installing an SSL acceleration card in your server to allow the messages to be encrypted/hashed using dedicated hardware rather than your server's CPU. This page http://www-01.ibm.com/support/knowledgecenter/#!/SSFKSJ_7.5.0/com.ibm.mq.ref.doc/q049300_.htm on the IBM Knowledge Center provide some further information and lists which cards are supported by WebSphere MQ.