Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A lot of the expensive 12-25k solutions seem limited to 4k SSL connections simultaneously. has a reasonably priced solution for many HTTP requests, but is limited to 2k SSL connections.

For a site as active as mine, will that be enough? Is there a better way to do it than to rely on the load balancer which may or may not have an ASIC SSL off loader co-processor where I can get more than the 4k ceiling for sub 17k machines?

Do they make ASIC SSL cards that can go into a pci-x/express port? (I have not been able to find much even at google). Is there a guideline/recommendation spec for a build your own solution that can be dedicated just to process the SSL encryption/decryption?

We'd be looking for high availability/loadbalancing type solutions. Even if that means we use separate load balancers (in tandem) with reverse proxy boxes cruncing SSL conenctions.

PCI compliance is also a concern, so any suggestions should fall within those guidelines as well.

share|improve this question

closed as off-topic by MadHatter, Jenny D, Rex, TheCleaner, Ward Nov 8 '13 at 21:55

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking product, service, or learning material recommendations are off-topic because they tend to become obsolete quickly. Instead, describe your situation and the specific problem you're trying to solve." – MadHatter, Jenny D, Rex, TheCleaner, Ward
If this question can be reworded to fit the rules in the help center, please edit the question.

Scale out, not up. Use a TCP-level load balancer (Linux HA is free and outscales and outperforms every proprietary solution I've ever used), and forward the SSL connections to the machines behind it and let them do the SSL stuff. No need to worry about whether an individual "SSL accelerator" can handle the connection rate because if you need more, you just bung another backend box in.

share|improve this answer

Open Source SSL Acceleration has a DIY Linux SSL accelerator example - see also the F5 rebuttal.

share|improve this answer

On the appliance side Brocade (formerly Foundry Networks) have the ServerIron line.

Their SSL modules can do this, although the new versions they've just introduced won't have SSL for another few months.

They certainly aren't cheap (a pair of the entry level (albeit 16M sessions) non-SSL models is ~US$30k) but they're easily the most reliable equipment we've ever used, ~10 years in production and we've never even lost a power supply or port from ~20 in production. However we don't currently use SSL as our endpoints don't support it.

Most of the SSL accelerator cards seem to have fairly lacluster driver support. Test one before deploying, many of them saturate well below host capacity.

share|improve this answer

I'm a big fan of the relatively inexpensive KEMP LoadMaster series. They are full-featured load balancers with ASIC SSL offloading. They are non-OSS linux-based appliances. Support is outstanding and the feature set keeps improving, frequently in direct response to user requests.

share|improve this answer

Sun have a crypto accelerator which has drivers for Solaris, RHEL and SUSE, a quick google shows IBM and Discretix have cards as well.

share|improve this answer
whistles... $1350+ for the Sun crypto accelerator buys a lot of extra general-purpose hardware. – womble Jul 22 '09 at 9:46

Err... I think you have your numbers wrong, "seem limited to 4k SSL connections simultaneously." The limitation is TPS terminations per second... Which even on a appliance could mean millions of concurrent users. Also as the first guy said, scale out not up, the TPS restriction is only for SSL terminated locally on the load balancer if you pass the SSL through to the backend cluster you get almost unlimited scalability.

share|improve this answer