Windows – Do you use performance counters on production IIS web sites

The big one that's likely to kill you is disk IO. Collecting both the transactions per second and the sectors read/written per second will give you a start on determining what you'll need on the SAN. Keep an eye on memory and pagefile usage, too, that can do bad things to your disk IO stats, and provisioning your VMs with some extra memory is simple.

Network is probably the next most important one, but that's pretty simple -- aggregate transfer and packets per second, make sure it's not too ridiculous.

CPU is the least likely bottleneck on a modern system, in my experience. I'd be inclined not to worry about it unless you've got multiple machines that are pegging their CPU consistently. Provisioning an extra VM server if you're running out of CPU is straightforward.

Assuming you've already monitored your Internet connection to make sure it isn't saturated (that isn't SSL specific of course) the main impact of SSL is likely to be CPU, so use performance monitor to check the CPU over some suitable period. You may also want to monitor the process counter to check CPU usage for the inetinfo and w3wp processes.

I don't know of a way to drill down further, e.g. to see that it's SSL causing the high CPU as opposed to a rogue ASP script. I suppose you could run all SSL traffic in a separate application pool and just monitor CPU for the appropriate w3wp process.

JR