Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to setup a SSL terminator / load-balancer in front of my tcp service, I've considered

1) Stunnel (weird performance problem, I compiled it with no-libwrap, pthreads but still pretty slow for most of my clients)

2) Nginx (I don't want/need HTTP bind/processing stuff)

3) HAProxy (no ssl termination)

So, is there any other solution out there?

share|improve this question

migrated from Mar 16 '11 at 13:16

This question came from our site for professional and enthusiast programmers.

up vote 2 down vote accepted

Pound SSL is a good solution:

Take note of the comment on the homepage about the availability of PRCE and tcmalloc from the Google perftools suite for improved performance.

Although Pound is a reverse proxy and has other features such as load balancing, they're not compulsory. You can simply use it to decrypt the SSL and forward onto a local web server if you wish.

share|improve this answer
which one will be faster? nginx or pound? – user74617 Mar 16 '11 at 0:01
They both use the openssl library (which is multi-threaded) for decryption, so on similar hardware I'd expect similar performance. Although as mentioned, Pound does have some performance enhancements. I would suggest compiling both from source with any available enhancements, and then comparing, because there's going to be no obvious answer. Make sure you have a recent version of openssl installed to compile against. – James Little Mar 16 '11 at 10:23
I tried to use pound today, however, it's still doing that HTTP parsing thing and somewhat more unreliable than stunnel. – user74617 Mar 18 '11 at 1:40
Pound only does the HTTP protocol though. you can't do just SSL over tcp with it. it will look for headers. – rox0r Oct 12 '12 at 19:42

Stunnel would be the correct option for you. You can strike HAProxy off the list because it doesn't support SSL.

You can use stunnel along with a layer 4 load balancer like LVS for load balancing needs.

share|improve this answer

Since June 2014 HAProxy provides native support for SSL, version 1.5.x upwards.

There are quite a few options for SSL termination: Stunnel, Stud, Pound, NGINX & HAProxy. (please add comment if there are any other suitable suggestions)

While support is available the features available vary greatly. I can neither find feature lists or a comparison anywhere on-line.

Using NGINX for SSL termination provides a good configuration options with regards to SSL configuration. See .

HAProxy would be more suited to a more robust set-up, requiring solid load balancing. See & .

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.