I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also the usual user registration and login functionality that maybe should be protected.
I know that there is going to be some performance reduction with SSL because server and client have encrypt and decrypt. Also, from what I understand, encrypted data doesn't compress as much, so Apache's
mod_deflate probably won't work as well.
How significant is the performance hit likely to be? I plan to do some testing, but nonetheless I'd be interested in any comments based on experience.