I've configured my IIS 6 server to use compression as documented in
http://weblogs.asp.net/owscott/archive/2004/01/12/57916.aspx. Seems to work
fine under normal http access. But when I access the same server via SSL,
everything works fine, but there is no compression. I'm using Fiddler to see
if the responses are compressed.

Is there some additional configuration step I need to perform to allow
compression under SSL?

--
...Mike

RE: IIS Compression and SSL by changliw

changliw
Fri May 02 00:16:30 CDT 2008

Hi Mike,
You may first refer to this article to see if it helps:
Securing Communications with SSL and the .NET Compact Framework
http://msdn.microsoft.com/en-us/library/bb738067.aspx

Now we are performing research on this issue and may need more time to get
back to you for detailed response. I appreicate your patience.

If you have any other questions or concerns, please feel free to let me
know.

Best regards,
Charles Wang
Microsoft Online Community Support
===========================================================
Delighting our customers is our #1 priority. We welcome your
comments and suggestions about how we can improve the
support we provide to you. Please feel free to let my manager
know what you think of the level of service provided. You can
send feedback directly to my manager at: msdnmg@microsoft.com.
===========================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for
non-urgent issues where an initial response from the community
or a Microsoft Support Engineer within 1 business day is acceptable.
Please note that each follow up response may take approximately
2 business days as the support professional working with you may
need further investigation to reach the most efficient resolution.
The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by
contacting Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
============================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
=========================================================






Re: IIS Compression and SSL by David

David
Fri May 02 03:19:45 CDT 2008

On May 1, 5:17=A0am, Mike Kraley <mkra...@community.nospam> wrote:
> I've configured my IIS 6 server to use compression as documented inhttp://=
weblogs.asp.net/owscott/archive/2004/01/12/57916.aspx. Seems to work
> fine under normal http access. But when I access the same server via SSL,
> everything works fine, but there is no compression. I'm using Fiddler to s=
ee
> if the responses are compressed.
>
> Is there some additional configuration step I need to perform to allow
> compression under SSL?
>
> --
> ...Mike


1. When you access the same server via SSL, is the request still
requiring compression? i.e. is it the exact same HTTP request as over
port 80
2. Is Fiddler showing you raw data and if so, how raw? Because it is
obviously decrypting or else you won't know the contents, but does it
unwind any other transport/content encodings. For example, is the data
still chunk encoded or not? Is the data still compressed or not?
3. How exactly are you determining that "there is no compression"

The details matter.


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Re: IIS Compression and SSL by mkraley

mkraley
Fri May 02 16:34:01 CDT 2008

See answers below:


"David Wang" wrote:

> On May 1, 5:17 am, Mike Kraley <mkra...@community.nospam> wrote:
> > I've configured my IIS 6 server to use compression as documented inhttp://weblogs.asp.net/owscott/archive/2004/01/12/57916.aspx. Seems to work
> > fine under normal http access. But when I access the same server via SSL,
> > everything works fine, but there is no compression. I'm using Fiddler to see
> > if the responses are compressed.
> >
> > Is there some additional configuration step I need to perform to allow
> > compression under SSL?
> >
> > --
> > ...Mike
>
>
> 1. When you access the same server via SSL, is the request still
> requiring compression? i.e. is it the exact same HTTP request as over
> port 80

Yes, that's correct.

> 2. Is Fiddler showing you raw data and if so, how raw? Because it is
> obviously decrypting or else you won't know the contents, but does it
> unwind any other transport/content encodings. For example, is the data
> still chunk encoded or not? Is the data still compressed or not?

In a different configuraion, where SSL is being done at the load balancer,
the decrypted responses as seen in Fiddler show that they are compressed, so
that leads me to believe that the data is not being compressed.

Also the message body length after decryption is the same as when I don't
use SSL in the software SSL case, further leading me to believe there is no
compression

> 3. How exactly are you determining that "there is no compression"

In Fiddler, under the Session Inspector on the Transformer tab, when a
session is compressed, you get a header saying that. Also see above.

Is there a better way to check?

...Mike
>
> The details matter.
>
>
> //David
> http://w3-4u.blogspot.com
> http://blogs.msdn.com/David.Wang
> //
>

Re: IIS Compression and SSL by wjzhang

wjzhang
Mon May 05 05:06:33 CDT 2008

Hi Mike,

HTTP compression requires web browser client side support. For example, if
you disable HTTP 1.1 support in IE, IIS will not send compressed data to
the IE client.

To determine if IIS server side does perform compression on the SSL enabled
contents, please clean up the compressed temp files in \WINDOWS\IIS
Temporary Compressed Files directory. Then browse to a sample page on the
SSL enabled site, then check if its corresponding temp file be generated
again in the directory.

Furthermore, I've heard some encryption layer like SSL3.0 already do parts
of the compression job. Therefore, enabling http compression on a SSL site
is not quite necessary.

Thanks.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
msdnmg@microsoft.com.

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.


Re: IIS Compression and SSL by mkraley

mkraley
Mon May 05 12:37:01 CDT 2008

WenJun,

Thanks for your reply, but unfortunately you haven't helped me answer my
questions.

It's not an issue with the client side - I'm using exactly the same client
and configuration to access the different cases. I see the compressed
responses when using hardware SSL, but not with software SSL.

Looking at the temporary compressed files folder is only helpful for looking
at static files. Since most of the files invovled here are dynamic, that's
not very helpful. However, I did run a test with a couple of static files and
they are indeed not showing up in that folder.

SSL3 may indeed do some compression, but since the received message bodies
are the same length as they are when compression is turned off, I conclude
that no compression is occurring.

--
...Mike


""WenJun Zhang[msft]"" wrote:

> Hi Mike,
>
> HTTP compression requires web browser client side support. For example, if
> you disable HTTP 1.1 support in IE, IIS will not send compressed data to
> the IE client.
>
> To determine if IIS server side does perform compression on the SSL enabled
> contents, please clean up the compressed temp files in \WINDOWS\IIS
> Temporary Compressed Files directory. Then browse to a sample page on the
> SSL enabled site, then check if its corresponding temp file be generated
> again in the directory.
>
> Furthermore, I've heard some encryption layer like SSL3.0 already do parts
> of the compression job. Therefore, enabling http compression on a SSL site
> is not quite necessary.
>
> Thanks.
>
> Sincerely,
>
> WenJun Zhang
>
> Microsoft Online Community Support
>
> Delighting our customers is our #1 priority. We welcome your comments and
> suggestions about how we can improve the support we provide to you. Please
> feel free to let my manager know what you think of the level of service
> provided. You can send feedback directly to my manager at:
> msdnmg@microsoft.com.
>
> ==================================================
> Get notification to my posts through email? Please refer to
> http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
> ications.
>
> Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
> where an initial response from the community or a Microsoft Support
> Engineer within 1 business day is acceptable. Please note that each follow
> up response may take approximately 2 business days as the support
> professional working with you may need further investigation to reach the
> most efficient resolution. The offering is not appropriate for situations
> that require urgent, real-time or phone-based interactions or complex
> project analysis and dump analysis issues. Issues of this nature are best
> handled working with a dedicated Microsoft Support Engineer by contacting
> Microsoft Customer Support Services (CSS) at
> http://msdn.microsoft.com/subscriptions/support/default.aspx.
> ==================================================
> This posting is provided "AS IS" with no warranties, and confers no rights.
>
>

Re: IIS Compression and SSL by David

David
Mon May 05 15:41:31 CDT 2008

On May 2, 2:34=A0pm, Mike Kraley <mkra...@community.nospam> wrote:
> See answers below:
>
>
>
>
>
> "David Wang" wrote:
> > On May 1, 5:17 am, Mike Kraley <mkra...@community.nospam> wrote:
> > > I've configured my IIS 6 server to use compression as documented inhtt=
p://weblogs.asp.net/owscott/archive/2004/01/12/57916.aspx. Seems to work
> > > fine under normal http access. But when I access the same server via S=
SL,
> > > everything works fine, but there is no compression. I'm using Fiddler =
to see
> > > if the responses are compressed.
>
> > > Is there some additional configuration step I need to perform to allow=

> > > compression under SSL?
>
> > > --
> > > ...Mike
>
> > 1. When you access the same server via SSL, is the request still
> > requiring compression? i.e. is it the exact same HTTP request as over
> > port 80
>
> Yes, that's correct.
>
> > 2. Is Fiddler showing you raw data and if so, how raw? Because it is
> > obviously decrypting or else you won't know the contents, but does it
> > unwind any other transport/content encodings. For example, is the data
> > still chunk encoded or not? Is the data still compressed or not?
>
> In a different configuraion, where SSL is being done at the load balancer,=

> the decrypted responses as seen in Fiddler show that they are compressed, =
so
> that leads me to believe that the data is not being compressed.
>
> Also the message body length after decryption is the same as when I don't
> use SSL in the software SSL case, further leading me to believe there is n=
o
> compression
>
> > 3. How exactly are you determining that "there is no compression"
>
> In Fiddler, under the Session Inspector on the Transformer tab, when a
> session is compressed, you get a header saying that. Also see above.
>
> Is there a better way to check?
>
> ...Mike
>
>
>
>
>
> > The details matter.
>
> > //David
> >http://w3-4u.blogspot.com
> >http://blogs.msdn.com/David.Wang
> > //- Hide quoted text -
>
> - Show quoted text -- Hide quoted text -
>
> - Show quoted text -


I expect the Message Body to be the same decoded length whether
compression happened or not -- things like compression, SSL
encryption, and Transfer-Encoding are aspects for transport that the
end consumer at Browser-level should not worry about. Of course, the
value and meaning of all these things depend on the observing tool. I
do not trust end-user tools like IE, Fiddler, or anything else when
counting the bytes or verifying HTTP-level behavior -- unless you can
tell me unequivocably where each measurement is taken at every stage
of the HTTP transport/transformation. And since end-user tools hardly
want to show that level of detail, hence my distrust.

For example, Dynamic Compression from IIS is transferred via Chunked
Encoding. If you counted the encrypted bytes, or even the sum of the
encoded chunks, it is most likely different than the count of non-
compressed or even static-compressed content. However, I expect that
once everything is unwound/decoded, that the resulting message body
*must* be the same length (otherwise the transport was lossy, and
that's bad). Hence, my question focuses on when you say "Message Body
Length", which of the prior "lengths" do you (or Fiddler) really
mean?...

I would use WFetch from IIS Diagnostic Tools and have it send an HTTP
request over SSL to the server and see what comes back. WFetch has the
option to show you the "raw" unencrypted bytes as well as the "raw"
undecoded results prior to decompression and dechunking. In
combination with the raw response headers (also shown by WFetch), it
provides enough concrete evidence to say one thing or another about
any request/response.

http://www.microsoft.com/downloads/details.aspx?familyid=3D9bfa49bc-376b-4a5=
4-95aa-73c9156706e7&displaylang=3Den


//David
http://w3-4u.blogspot.com
http://blogs.msdn.com/David.Wang
//

Re: IIS Compression and SSL by wjzhang

wjzhang
Wed May 07 04:05:45 CDT 2008

Hi Mike,

The best way to know if and/or why compression was done/not done should be
enabling tracing on IIS6:

Troubleshooting IIS 6.0 with Tracing (IIS 6.0)
http://www.microsoft.com/technet/prodtechnol/WindowsServer2003/Library/IIS/f
4535a1e-09da-4347-86ee-f51aef0dabbe.mspx?mfr=true

Thanks.

Sincerely,

WenJun Zhang

Microsoft Online Community Support

Delighting our customers is our #1 priority. We welcome your comments and
suggestions about how we can improve the support we provide to you. Please
feel free to let my manager know what you think of the level of service
provided. You can send feedback directly to my manager at:
msdnmg@microsoft.com.

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.