Improve the performance of the SSL Service in NodeJS _ node. js

Despite the shocking vulnerability in OpenSSL, the SSL-based encryption protocol is still the most widely used. This is only a problem with OpenSSL, an open-source software. (Details: OpenSSL is written in poor products ), the following article provides some tips on how to improve HTTPS performance in NodeJS. When browsing the Internet, we all know that SSL encryption is very important. At PayPal, security is our top priority. We use end-to-end encryption, not only for our public websites, but also for our internal service calls. The SSL encryption technology will greatly affect the performance of node. js. We have spent time adjusting our external services and making full use of them. The following is a list of SSL configuration adjustments that can significantly improve the external performance of SSL.

SSL Password

Out-of-the-box, Node. js SSL uses a very powerful set of cryptographic algorithms. In particular, the key exchange and elliptic curve algorithms of diphirmann are extremely expensive. In addition, if you use too many external SSL calls in the default configuration, the performance of Node. js will be fundamentally weakened. To get the conclusion about how slow it is, here is a sample CPU for service calling:

918834.0ms 100.0% 0.0 node (91770)911376.0ms 99.1% 0.0  start911376.0ms 99.1% 0.0  node::Start911363.0ms 99.1% 48.0  uv_run909839.0ms 99.0% 438.0  uv__io_poll876570.0ms 95.4% 849.0   uv__stream_io873590.0ms 95.0% 32.0    node::StreamWrap::OnReadCommon873373.0ms 95.0% 7.0     node::MakeCallback873265.0ms 95.0% 15.0     node::MakeDomainCallback873125.0ms 95.0% 61.0     v8::Function::Call873049.0ms 95.0% 13364.0    _ZN2v88internalL6InvokeEbNS0832660.0ms 90.6% 431.0     _ZN2v88internalL21Builtin821687.0ms 89.4% 39.0      node::crypto::Connection::ClearOut813884.0ms 88.5% 37.0       ssl23_connect813562.0ms 88.5% 54.0       ssl3_connect802651.0ms 87.3% 35.0        ssl3_send_client_key_exchange417323.0ms 45.4% 7.0         EC_KEY_generate_key383185.0ms 41.7% 12.0        ecdh_compute_key1545.0ms 0.1% 4.0          tls1_generate_master_secret123.0ms 0.0% 4.0           ssl3_do_write...

Let's focus on key generation:

802651.0ms 87.3% 35.0 ssl3_send_client_key_exchange417323.0ms 45.4% 7.0 EC_KEY_generate_key383185.0ms 41.7% 12.0 ecdh_compute_key

87% of the call time is spent on generating the key!

These passwords can be changed to reduce intensive computing. This idea has been implemented in https (or proxy. For example:

var agent = new https.Agent({  "key": key,  "cert": cert,  "ciphers": "AES256-GCM-SHA384"});

The above key is no longer used for the expensive difi Herman key exchange. After we replace it with something similar, we can see significant changes in the following example:

...57945.0ms 32.5% 16.0 ssl3_send_client_key_exchange28958.0ms 16.2% 9.0 generate_key26827.0ms 15.0% 2.0 compute_key...

With OpenSSL documentation, you can learn