Why do https connections take longer to establish than straight http connections?

Question

Why is it that Secured HTTP Connection (https) is Slower then than typical HTTP (http)?

Just interested in knowing only.

Thanks.

Answer 1

To open a TCP/IP connection requires 3 packets to be exchanged between the client and the server. The connection is then considered established, and the client can submit its request.

When SSL is added on top of the TCP/IP connection there are several additional interactions that have to happen before the connection is considered established.

Unless the latency is negligible between the client and the server (read, the same network), then it is likely that this additional latency, due to the additional round trips to exchange SSL handshaking data, not the CPU overhead of calculating the key material, is the major factor in the delay in establishing an SSL connection.

More information about TCP/IP connection establishment

More information about SSL/TLS handshaking

Answer 2

In simple words: Because it encrypts and decrypts the traffic, this requires processing on both sides (the server and the client).

Answer 3

As mentioned by other people there is the encryption and decryption steps for all transfers. There are two other issues though:

• The negotiation phase when you first talk to the server, in which the server and browser negotiate a key for the encryption process and your browser performs some checks on the servers certificate (it it checks yours if you are using client certs).
• The fact that no content (including the main page source, scripts, images and stylesheets) carried on a HTTPS connection should be cached by your browser, so it has to re-request objects it would otherwise get from cache every time it needs them.

Answer 4

Jeff Moser just posted a good article on this explaining the ins and outs, handshaking etc.

http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html

Answer 5

To add to pauska's answer:

Most web server platforms can add hardware/software to improve the performance of SSL on the server. This product does this.

Answer 6

Because it takes a little bit of time to encrypt the content, and the encryption generally increases the size of the content.

Answer 7

Like a number of people have mentioned Crypto is hard and the server needs to take the time to do it. Plus your browser and the proxys between you and the server can't/won't cache anything so you have to re-request all pages components on each new page.