Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Update I switched to using a 1024 bit key, and I changed the SSLCipherSuite in my ssl.conf file. SSLCipherSuite RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP


I've set apache up to use SSL with a self signed certificate.

With https (KeepAlive on), I can get over 3000 requests per second. However, with https (KeepAlive off), I can only get 13 requests per second.

I know there is supposed to be a bit of an overhead, but this seems abnormal. Can anyone suggest how I might go about debugging this.

Here is the ab log for https:

Server Software:        Apache/2.2.3
Server Hostname:
Server Port:            443
SSL/TLS Protocol:       TLSv1/SSLv3,DHE-RSA-AES256-SHA,4096,256

Document Path:          /hello.html
Document Length:        29 bytes

Concurrency Level:      5
Time taken for tests:   30.49425 seconds
Complete requests:      411
Failed requests:        0
Write errors:           0
Total transferred:      119601 bytes
HTML transferred:       11919 bytes
Requests per second:    13.68 [#/sec] (mean)
Time per request:       365.565 [ms] (mean)
Time per request:       73.113 [ms] (mean, across all concurrent requests)
Transfer rate:          3.86 [Kbytes/sec] received

Connection Times (ms)
              min  mean[+/-sd] median   max
Connect:      190  347  74.3    333     716
Processing:     0   14  24.0      1     166
Waiting:        0   11  21.6      0     165
Total:        191  361  80.8    345     716

Percentage of the requests served within a certain time (ms)
  50%    345
  66%    377
  75%    408
  80%    421
  90%    468
  95%    521
  98%    578
  99%    596
 100%    716 (longest request)
share|improve this question
up vote 1 down vote accepted

I suspect that the time is being used by the RSA computation required for the SSL handshake. You have selected a very large RSA key (4096 bits). You may want to also verify that your client is properly using SSL resume sessions.

share|improve this answer
Yes, that was part of it. I also needed to change the SSLCipherSuite. – raucous12 May 4 '10 at 0:17

Check SSLRandomSeed. You should not be using /dev/random (unless your OS don't block on not enough entropy).

Also check if you're using a session cache. If not, then enable one (check SSLSessionCache).

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.