2

What's the best web server to handle SSL connections? 80% of our connections will be in SSL, so we need to choose the right web server. We're leaning towards nginx, but don't know how it handles SSL.

Improve this question
3
  • 2
    ...it's more a function of what content you're serving than just how it handles SSL.
    – Bart Silverstrim
    Oct 16, 2011 at 0:25
  • 1
    If you're really worried about the SSL component (in terms of performance I'm assuming) of your web application, you should look at using an ssl accelerator instead of the webserver. Provided your deployment warrants this, you'd have a load balancer upstream terminate the connections and do the SSL stuff.
    – sandroid
    Oct 16, 2011 at 1:22
  • Over SSL the key-exchange and cipher have a big impact on performance, but in general processing time will be limited by dynamic content more than by SSL. nginx does very well (both for serving content and SSL), if you disable DHE key exchange, have your SSL sessions cached, and enable keep-alive.
    – cyberx86
    Oct 16, 2011 at 1:25

3 Answers 3

Reset to default
4

There are a lot of factors that affect SSL speeds from the choice of SSL library (OpenSSL vs GNUTLS), the choice of algorithms (RC4 vs AES etc) to the type of web-server used (Apache vs NGINX etc).

That said, you should not be too concerned with SSL performance these days. With a correctly configured SSL machine, there is little additional overhead compared to non-SSL connections.

Adam Langley from Google released some tips on SSL tuning a while back and their experiences switching over to SSL. I recommend that you read his article.

On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead.

Improve this answer
0

There is not much difference between web servers in SSL handling, SSL handling depends on the CPU power of the web server and its RAM size to handle concurrent connections.

I recommend you use SSL accelerator cards on your web server to handle SSL better, you can also use SSL offloading with a seperate hardware SSL accelerator device that acts as a load balancer or SSL terminator for your SSL requests.

Improve this answer
0

Both Reza and sybreon have brought up some good points about SSL it is true that a well apache and nginx will handle SSL close to one another when they are correctly configrered. It is also important to know that an SSL card will bost your ssl perfomance on decrypting the data.

Now if you need to do it on the cheap with I would recommend load balancing with nginx and then processing with apache. I have found(and i am sure many people will disagre with me) that apache by default is more secure then nginx if your willing to work with nignx and really limit what can be called and where the call is directed then you can nginx nice and tight like a drum but if you need something working and not have to worry about it being hacked to quickly stick with apache. I would then use nginx load balncing on ip_hash mode this way requests get sent to the same server (unless a server fail happens) So if you are getting a lot of requests this should be able to help you fix ur ssl issue if you think you will go down.

If you wanna a really easy look on setting up nginx and load balancing look here.

http://mickeyben.com/2009/12/30/using-nginx-as-a-load-balancer.html

Improve this answer

Not the answer you're looking for? Browse other questions tagged .