Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want to setup a SSL terminator / load-balancer in front of my tcp service, I've considered

1) Stunnel (weird performance problem, I compiled it with no-libwrap, pthreads but still pretty slow for most of my clients)

2) Nginx (I don't want/need HTTP bind/processing stuff)

3) HAProxy (no ssl termination)

So, is there any other solution out there?

share|improve this question

migrated from stackoverflow.com Mar 16 '11 at 13:16

This question came from our site for professional and enthusiast programmers.

add comment

2 Answers

up vote 2 down vote accepted

Pound SSL is a good solution: http://www.apsis.ch/pound/

Take note of the comment on the homepage about the availability of PRCE and tcmalloc from the Google perftools suite for improved performance.

Although Pound is a reverse proxy and has other features such as load balancing, they're not compulsory. You can simply use it to decrypt the SSL and forward onto a local web server if you wish.

share|improve this answer
    
which one will be faster? nginx or pound? –  Yucong Sun Mar 16 '11 at 0:01
1  
They both use the openssl library (which is multi-threaded) for decryption, so on similar hardware I'd expect similar performance. Although as mentioned, Pound does have some performance enhancements. I would suggest compiling both from source with any available enhancements, and then comparing, because there's going to be no obvious answer. Make sure you have a recent version of openssl installed to compile against. –  James Little Mar 16 '11 at 10:23
1  
I tried to use pound today, however, it's still doing that HTTP parsing thing and somewhat more unreliable than stunnel. –  Yucong Sun Mar 18 '11 at 1:40
    
Pound only does the HTTP protocol though. you can't do just SSL over tcp with it. it will look for headers. –  rox0r Oct 12 '12 at 19:42
add comment

Stunnel would be the correct option for you. You can strike HAProxy off the list because it doesn't support SSL.

You can use stunnel along with a layer 4 load balancer like LVS for load balancing needs.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.