Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I want to setup a SSL terminator / load-balancer in front of my tcp service, I've considered

1) Stunnel (weird performance problem, I compiled it with no-libwrap, pthreads but still pretty slow for most of my clients)

2) Nginx (I don't want/need HTTP bind/processing stuff)

3) HAProxy (no ssl termination)

So, is there any other solution out there?

share|improve this question

migrated from stackoverflow.com Mar 16 '11 at 13:16

This question came from our site for professional and enthusiast programmers.

3 Answers 3

up vote 2 down vote accepted

Pound SSL is a good solution: http://www.apsis.ch/pound/

Take note of the comment on the homepage about the availability of PRCE and tcmalloc from the Google perftools suite for improved performance.

Although Pound is a reverse proxy and has other features such as load balancing, they're not compulsory. You can simply use it to decrypt the SSL and forward onto a local web server if you wish.

share|improve this answer
which one will be faster? nginx or pound? –  user74617 Mar 16 '11 at 0:01
They both use the openssl library (which is multi-threaded) for decryption, so on similar hardware I'd expect similar performance. Although as mentioned, Pound does have some performance enhancements. I would suggest compiling both from source with any available enhancements, and then comparing, because there's going to be no obvious answer. Make sure you have a recent version of openssl installed to compile against. –  James Little Mar 16 '11 at 10:23
I tried to use pound today, however, it's still doing that HTTP parsing thing and somewhat more unreliable than stunnel. –  user74617 Mar 18 '11 at 1:40
Pound only does the HTTP protocol though. you can't do just SSL over tcp with it. it will look for headers. –  rox0r Oct 12 '12 at 19:42

Since June 2014 HAProxy provides native support for SSL, version 1.5.x upwards.

There are quite a few options for SSL termination: Stunnel, Stud, Pound, NGINX & HAProxy. (please add comment if there are any other suitable suggestions)

While support is available the features available vary greatly. I can neither find feature lists or a comparison anywhere on-line.

Using NGINX for SSL termination provides a good configuration options with regards to SSL configuration. See http://nginx.com/resources/admin-guide/nginx-ssl-termination/ .

HAProxy would be more suited to a more robust set-up, requiring solid load balancing. See https://serversforhackers.com/haproxy-ssl-termation-pass-through/ & http://blog.haproxy.com/2012/09/10/how-to-get-ssl-with-haproxy-getting-rid-of-stunnel-stud-nginx-or-pound/ .

share|improve this answer

Stunnel would be the correct option for you. You can strike HAProxy off the list because it doesn't support SSL.

You can use stunnel along with a layer 4 load balancer like LVS for load balancing needs.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.