Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to setup a SSL terminator / load-balancer in front of my tcp service, I've considered

1) Stunnel (weird performance problem, I compiled it with no-libwrap, pthreads but still pretty slow for most of my clients)

2) Nginx (I don't want/need HTTP bind/processing stuff)

3) HAProxy (no ssl termination)

So, is there any other solution out there?

share|improve this question

migrated from stackoverflow.com Mar 16 '11 at 13:16

This question came from our site for professional and enthusiast programmers.

2 Answers 2

up vote 2 down vote accepted

Pound SSL is a good solution: http://www.apsis.ch/pound/

Take note of the comment on the homepage about the availability of PRCE and tcmalloc from the Google perftools suite for improved performance.

Although Pound is a reverse proxy and has other features such as load balancing, they're not compulsory. You can simply use it to decrypt the SSL and forward onto a local web server if you wish.

share|improve this answer
    
which one will be faster? nginx or pound? –  user74617 Mar 16 '11 at 0:01
1  
They both use the openssl library (which is multi-threaded) for decryption, so on similar hardware I'd expect similar performance. Although as mentioned, Pound does have some performance enhancements. I would suggest compiling both from source with any available enhancements, and then comparing, because there's going to be no obvious answer. Make sure you have a recent version of openssl installed to compile against. –  James Little Mar 16 '11 at 10:23
1  
I tried to use pound today, however, it's still doing that HTTP parsing thing and somewhat more unreliable than stunnel. –  user74617 Mar 18 '11 at 1:40
    
Pound only does the HTTP protocol though. you can't do just SSL over tcp with it. it will look for headers. –  rox0r Oct 12 '12 at 19:42

Stunnel would be the correct option for you. You can strike HAProxy off the list because it doesn't support SSL.

You can use stunnel along with a layer 4 load balancer like LVS for load balancing needs.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.