Even though, Internet Explorer doesn’t support the protocol yet, here are directions to add it.

Add the following to the web.config file:

<system.webServer>
    <httpProtocol>
        <customHeaders>
            <add name="Strict-Transport-Security" value="max-age=31536000"/>
        </customHeaders>
    </httpProtocol>
</system.webServer>

Install this IIS module

Source

One of the sites I maintain was unable to serve pages due to the server timing out. At first, I suspected it was a bandwidth issue, since traffic was significantly elevated due to a recent ad campaign that was initiated. On close examination, I noticed the system’s resources were barely taxed at all. Hard disk I/0, CPU usage, bandwidth, and memory were either normal or barely used.

I then remembered a similar incident with another site that showed the same symptoms, except the site was hosted on an Apache server. The problem was that Apache was consuming too much memory and was unable to fulfill requests fast enough due to having a high connection timeout setting. The fix was to limit the amount of processes spawned and reduce the connection timeout setting.

Since memory and CPU usage was not an issue, the only other suspect was to check the connection timeout setting. The Connection Timeout setting is located under:

1. Open IIS Manager

2. Expand websites

3. Select target website’s properties.

4. Select Website tab

On default, it is set to 120 or 900 seconds – a very long time, especially if a web server has a queue of 1000+ objects to serve. My recommendation is to set the Connection Timeout setting to 2-5 seconds. This will free up the amount of connections available to users immensely. In addition, there are other optimizations to threading and compression that aren’t enabled by default.

The following tweaks will help manage processes and threads for serving pages. In the %WINDIR%\Microsoft.NET\Framework\v1.1.4322\CONFIG\machine.config, set the following:

Setting	Default	“Optimized”
maxconnection	2	12 * #CPUs
maxIoThreads	20	100
maxWorkerThreads	20	100
minFreeThreads	8	88 * #CPUs
minLocalRequestFreeThreads	4	76 * #CPUs

Enabling file compression can free up a significant amount of bandwidth and increase the number of objects served at a time. First, give the folder where the compressed files will be stored write permissions to the IIS User. By default, this is “%windir%\IIS Temporary Compressed Files”. The IUSR_{machinename} will need the write permission to the folder.

Next, you need to enable Compression in IIS.

1. Open IIS Manager

2. Select the websites folder

3. Right click and select properties.

4. Select the Service’s tab

5. Enable Compress application files

6. Enable Compress static files

7. Set max size to something sensible.

Then enable the direct Metabase editing. This allows you to edit the metabase while IIS is running.

1. Open IIS Manager

2. Right click the computer icon

3. select properties

4. Check the checkbox ‘Enable Direct Metabase Edit’

Afterwards, you will need to open the IIS metabase by editing the file, %WINDIR%\system32\inetsrv\metabase.xml. Then find the attribute HcDynamicCompressionLevel and change the setting from 0 to 9, zero is the default setting. This will compress the pages as much possible without straining the CPU too much. There will two HcDynamicCompressionLevel attributes, each one under IIsCompressionScheme element that set deflate and gzip behaviors. Save the file.

Next entails adding the file extensions for static and dynamic pages that will be compressed. To do this, open the command prompt and open the directory C:\InetPub\AdminScripts\. Then execute the following to enable compression for the most commonly served files.

cscript.exe adsutil.vbs set W3Svc/Filters/Compression/GZIP/HcFileExtensions "htm" "html" "txt" "ppt" "xls" "xml" "pdf" "xslt" "doc" "xsl" "htc" "js" "css"

cscript.exe adsutil.vbs set W3Svc/Filters/Compression/DEFLATE/HcFileExtensions "htm" "html" "txt" "ppt" "xls" "xml" "pdf" "xslt" "doc" "xsl" "htc" "js" "css"

cscript.exe adsutil.vbs set W3Svc/Filters/Compression/GZIP/HcScriptFileExtensions "asp" "dll" "exe" "aspx" "asmx" "ashx"

cscript.exe adsutil.vbs set W3Svc/Filters/Compression/DEFLATE/HcScriptFileExtensions "asp" "dll" "exe" "aspx" "asmx"

IISreset.exe /restart

Do not compress images, as they are already compressed [jpg, gif, tiff, etc.]

Adjusting the IIS Application Pool can help resource utilization. The settings I changed were:

• ‘Limit Request Queues’ setting under the Performance tab. Depending on how many CPUs, Worker Processes, and memory available, this setting can increase performance. The machine I was tweaking this setting on had 4 CPUs and 8 GB of RAM. I increased the limit from 4000 to 10,000 with only 1 worker process enabled.
• Another setting I disabled in the tab was the ‘Shutdown worker processes after being idle for..’. I noticed that starting worker processes was extremely expensive in terms of CPU usage.

If your site is database driven, you may want to turn off Connection Pooling and set a low connection timeout if you’re confident that your server will not have resources issues when a large number of database connections are opened. In ASP.NET, add the Connect Timeout and Pooling settings to the connection string:

Data Source=SERVERNAME;Database=DATABASENAME;Integrated Security=SSPI;Pooling=false;Connect Timeout=5;

For references, please consult the following Links

• Working with IIS 6.0 Application Pools – The Performance Tab
• IIS 6.0 Tuning for Performance
• IIS Compression in IIS 6.0
• Planning, Testing, and Tuning for ASP.NET and IIS
• SQL Server SqlConnection properties

As a exercise, I wanted to figure out how to create an SSL certificate that I could use on this website for securing the admin section and my credentials at login. After a quick google search, I yielded two solutions – either create a certificate using OpenSSL or use Microsoft’s IIS Resource Kit.

I opted for the OpenSSL solution, however in hindsight, it would’ve been alot easier if I had just used the MS Resource Kit. I had to jump through quite a few hoops to get the OpenSSL solution working. For tutorials on both methods check the following links.

• Tutorial for creating certificates using OpenSSL for Windows
  
• Tutorial for creating certificates using Microsoft’s IIS Resource Kit

Even though the OpenSSL tutorial says ‘for IIS 5’, the directions work fine for IIS 6. Another thing to note is that during installation of OpenSSL, it asked to replace a few DLL files. I replaced mine, but not before backing them up. So far I have not had to revert to my previously installed files.