Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to decide whether to use SSL for a webapp. It doesn't handle credit cards or financial data, but it does store information that should be private for personal/social reasons. There is also the usual user registration and login functionality that maybe should be protected.

I know that there is going to be some performance reduction with SSL because server and client have encrypt and decrypt. Also, from what I understand, encrypted data doesn't compress as much, so Apache's mod_deflate probably won't work as well.

How significant is the performance hit likely to be? I plan to do some testing, but nonetheless I'd be interested in any comments based on experience.

share|improve this question
4  
mod_deflate compresses HTTP responses, which are on a higher layer than SSL encryption - so the server compresses plain data and only then encrypts it, which means it's still as effective as it should be (and more secure too). –  grawity Feb 13 '10 at 14:47
add comment

4 Answers 4

up vote 3 down vote accepted

There's a noticeable performance hit on each connect for the PKI overhead. The actual data transfer, using symmetric keys, has relatively little overhead. Exact ratios and costs depend on your particular hardware/software stack.

In general, the overhead for transferring lots of data is small; the overhead for doing lots of small connects (https for lots of small images, for example) is much larger. You can pick and choose parts of a page to protect, it doesn't have to be all or none.

Do your tests and benchmarks, I suspect you'll find that the overall performance hit is small and tolerable.

share|improve this answer
add comment

If you are worried about performance, then SSL should only be apart of your overall strategy. I manage several sites for some fortune-5 companies that see millions of hits per day and thousands of unique visitors and we don't use any SSL off loading. We've found that most of our loading concerns are focused on the code base and 3rd party libraries we use (.NET, Java mostly).

So if you're concerned about SSL load, don't be unless you also have concerns with other aspects such as the code performance under heavy traffic that you're also dealing with. And load here really means memory foot print and CPU... It's easy to fix traffic loads; it's these other loads that mostly matter or come into play first.

share|improve this answer
    
Do your sites serve more HTTP or HTTPS responses? Yes, there are other bottlenecks (poor code possibly the worst), but full en/de-cryption on every page is more significant than you suggest bsc.es/media/389.pdf - code optimisation is more expensive than network hardware, I suggest the OP stress tests. –  Andy Feb 13 '10 at 14:53
    
highscalability.com/blog/2010/8/12/… –  Andy Aug 12 '10 at 17:24
add comment

Yes, it does cause a degree of load, and is worth offloading to a load balancer with SSL modules installed. However if you must use a server, any load it created worth its weight if you are dealing with any sensitive data, although whether personal information is considered sensitive is a different question (apart from login, social networks don't tend to use https).

Try ab for stress testing over HTTP vs HTTPS to see the difference, and be sure to only enable mod_ssl in the :443 sections in your vhost.conf etc

encrypted data doesn't compress as much

SSL has its own compression protocols, the client use of which you can monitor. To increase speed of requests, be sure to use SSL Session Caching

share|improve this answer
add comment

There will be a slight performance hit, which is why typically most websites only require SSL on the registration and login forms to make sure data is sent securely, after which browsing resumes without SSL.

share|improve this answer
    
...and is vulnerable to session hijacking –  Jakub Narębski Apr 4 '13 at 21:31
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.