INSSL - HTTP Input Gateway with SSL Support

	At a Glance
	Catalog	System
	Category	Gateways
	User volumes	yes
	Min. memory	64M
	OS	Linux
	Constraints	no
	Questions/Comments	Ask Forum

The INSSL appliance is a layer-7 gateway for secure HTTP requests. It converts the requests to unencoded HTTP requests. This can be used whenever it is necessary to support secure HTTP on the client's side, but the back-end processing infrastructure does not or cannot support SSL, including:

• using a fast and light-weight HTTP server that does not have SSL support
• using multiple back-end servers, for performance or for redundancy, connected through a load-balancing switch
• using multiple back-end servers for unrelated functions, connected through a URL switch
• offloading the SSL encryption/decryption to a separate server to improve throughput

INSSL provides a firewalled entry point for network traffic into an AppLogic application, which can be configured with an Internet-accessible static IP address.

To support applications that need to appear at a single IP address for more than one service, SSL can be configured to direct non-HTTP traffic transparently to a separate output terminal. For such connections, the appliance acts as a layer-3 firewall/NAT router.

Boundary

Resources

Note: the amount of memory given to INSSL does not affect its throughput. Use more memory only to support more concurrent requests that have been forwarded to a back end server, pending a response, if the back-end servers hold up requests for excessively long times. Pound on INSSL uses 25 threads per 10MB available memory.

Terminals

Properties

Volumes

Performance

Request Rate

INSSL routes no less than 700 http or 120 https transactions (request/response pairs) per second, when operating on a single 2GHz CPU.

Data Throughput

INSSL routes no less than 3MB/s over http or 0.5MB/s over https, on a 3K average packet size (request and response).

Concurrent Connections

When given its maximum memory requirement, SSL should be able to handle no less than 300 concurrently pending requests. (A "pending request" being an open TCP connection from the client, on which there is one or more un-completed HTTP request in progress).

Error Messages

The following messages may appear in either the appliance log file or the system log of the grid controller when the appliance fails to start:

• Firewall configuration failed
• 'Pound failed to start
• The RSA private key is pass protected
• You specified raw l3 proto but did not specify proto number (l3_accept_port)

Certificates

In order to use SSL you need both the signed certificate and the private key it was encrypted with. The key and the certificate should be in PEM format and put in a single file specified by the cert_file property.

Generating a certificate

First, you need a private key. You can generate one by executing:

• openssl genrsa -out privkey.pem 2048

To generate a pass protected key, use the following (note that in order to use the key with INSSL you need a passwordless key, if you create a pass protected key you need to remove the password before using it in INSSL)

• openssl genrsa -des3 -out privkey.pem 2048

Next you need a certificate. You have two options here - create a certificate request and have it signed by a trusted CA (for which they will charge you), or create a self-signed certificate for test purposes (in this case browsers requesting your site will issue warnings that the certificate is not signed by a trusted CA).

To generate a certificate request, execute the following:

• openssl req -new -key privkey.pem -out server.csr

After you send the .csr file to your trusted CA, it will give you back a signed certificate ( .crt file) which you can use.

To generate a self signed certificate, execute the following:

• openssl req -new -x509 -key privkey.pem -out server.crt -days 1095

Using the certificate

You can now put the certificate and the key in a file and use it in INSSL:

• cat privkey.pem  server.crt > server.pem

If your key is password protected, you can remove the password by executing the following:

• openssl rsa -in key_with_pass.pem -out privkey.pem

Using existing apache+mod_ssl certificate

If you have an existing certificate that you use in Apache, you can use it in INSSL as well. Just make sure the key is not password protected (see above) and put the private key and the certificate in one file in that order. Example:

• cat privkey.pem  server.csr > server.pem

If you are using a chained certificate, you should also include the intermediate certificate provided by the issuer. Put the private key, the certificate and the intermediate certificate in one file in that order. Example:

• cat privkey.pem server.csr sf_issuing.crt > server.pem

The server signing key is your Web site's "proof of identity". It is also vulnerable, since it is not password-encrypted (so that the appliance can read it without your help). Take the necessary measures to protect the key file, when installing it on the data volume. Do not use the same data volume for other purposes and don't make it visible to a Web server, e.g., to host Web-accessible data (HTML pages, scripts and such).

Typical Usage

Web applications

To provide http(s) access to your application, connect the http terminal directly to the WEB appliance.


If you need a scalable web application hook the http terminal to a HLB appliance.

Configuration for web applications

Note: the configuration examples list only properties set to non-default values and lack the network configuration (ip_addr, netmask, gateway).

The MAIL appliance shown within the examples is not shipped with AppLogic.

Web application with additional services

If you have more services than just http in your application, you can use INSSL to pass http traffic to its http terminal and use the aux terminal for other services.

Web applications with > 1 additional services

If you have multiple tcp/udp services and http, you can use INSSL to pass http traffic to its http terminal and use the aux to feed the rest of the traffic to PS8, which will feed the desired traffic to the backend servers.

Notes and Links

Notes

• the INSSL input supports HTTP 1.0 and HTTP 1.1, but if the client identifies itself as MSIE, HTTP 1.1 support is turned off for that connection (to avoid bugs in some versions of MSIE).
• if the client is not MSIE, the SSL appliance will support HTTP 1.1 for the client (incl, the multiple requests per TCP session ability), even if the back-end server uses supports only HTTP 1.0.
• The INSSL class supports a single external IP and therefore a single SSL certificate may be used.

Related Documents

• Implementation Design
• Test Plans and Results
• Release Notes?

Questions and Comments

To post a question or comment on this appliance, visit our forum.

-- NetClime - 13 Mar 2007