Adds a new config to parallelize loading of ssl_multicert.config#7877
Closed
zwoop wants to merge 2 commits intoapache:masterfrom
Closed
Adds a new config to parallelize loading of ssl_multicert.config#7877zwoop wants to merge 2 commits intoapache:masterfrom
zwoop wants to merge 2 commits intoapache:masterfrom
Conversation
Member
|
This is just FYI, but certs are loaded twice if you enable QUIC because QUICMultiCertConfigLoader is created and it does basically the same thing as SSLMultiCertConfigLoader with a couple of different options for SSL_CTX for QUIC. |
The new setting is (default: 0):
CONFIG proxy.config.ssl.server.multicert.concurrency INT 24
A setting of -1 will create one loader thread per system CPU. The
CPU used during load will be pretty heavy, loading certs is costly.
If enabbled, we will also allow the first load to consume all CPU.
Contributor
Author
|
if anyone wants to test / play with this (I'm still baffled that loading certs is so CPU expensive!), I have a tar-ball with 20,000 certificates and the accompanying ssl_multicert.config file. |
Contributor
|
This pull request has been automatically marked as stale because it has not had recent activity. Marking it stale to flag it for further consideration by the community. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The new setting is (default: 0):
A setting of -1 will create one loader thread per system CPU. Still testing performance implications here, but this likely is only a noticeable win with many, many thousands of certificates, or, a very slow "file system".
I intentionally left the line parser as-is, to avoid too much breakage and change. I think we should redo this parser, and use standard STL streams etc. to read the file line by line rather than loading the entire file into memory.