Summary

The correct setup, which has cryptographic hardware support enabled can greatly improve throughput rates and achieve a good SSL performance with IBM WebSphere Application Server (WAS) or IBM HTTP server (IHS) as web server frontend.

When System z® cryptographic features are available, it is recommended to use them in order to achieve the best throughput and response times for a SSL secured communication.

One important aspect is the selection of an appropriate SSL cipher suite that is supported by IBM® System z cryptographic features, for example a cipher suite consisting of RSA, AES and SHA algorithms. The additional effort required by the SSL protocol causes extra workload on the WAS server driving the SSL encryption, no matter whether WAS or the IHS is managing the SSL connection. The faster and less CPU intensive this additional workload can be processed on the general purpose CPUs, the faster is the response time and the more user queries can be processed at the same time.

The stronger a selected cipher suite for SSL is, the more CPU power is required on the WAS server. Especially when using RSA key sizes of 2048-bit or 4096-bit, IBM System z cryptographic features contribute to provide good performance and response times on the WAS server. A RSA key size of 1024-bit is no longer recommended for security reasons.

Adding the IHS to the system under test (SUT) (scenario 2) results in better transaction throughput numbers for all the considered cryptographic setups.