Tag Info

Hot answers tagged

7

How did you benchmark your server? What application is running behind your HTTPS server? What CPU does your server use? How you can see, your question lack many important details... Anyway, SSL surely is somewhat slower then "pure" HTTP: public key cryptography is way slower then symmetric-key one, and this is the very reason why pubkey is only used to ...


5

The fact is that you added the rule that allows port 443 at the end of the INPUT chain. But you have a previous rule that drops everything : Chain INPUT (policy DROP) [...] DROP all -- 0.0.0.0/0 0.0.0.0 [...] ACCEPT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 [...] With iptables rules order matters! Use iptables ...


3

When using SSL-Session-Cache, the performance of keep-alive connections over SSL might be enormously increased. When the server does have it enabled, it is not necessary for the client to do a full SSL-handshake every request, thus saving time and cpu-resources. You can read up more here: ...


2

But if I load a page on site 1 that includes content from site 2 say an image then the padlock breaks in the browser and warns about mixed content. This is not a problem of using content across domains, but across protocols. Mixed content means that you try to include resources via HTTP (unencrypted) on a HTTPS (encrypted) site, no matter if this is ...


2

HTTPS is slower because it has more data to exchange (the X.509 certificate from the server), it has a secure data connection to set up, ... ab can give 'Connect' time and that's where you'll see your timing difference. TLS setup take more time than no setup.


2

You need to realise the difference between what ab does and what a browser does. (I'm not going to answer what ab does, because I'm not familiar enough with it). For example: Is ab using TLS session re-use? A browser would, and would perform much faster because of it (for subsequent requests). You can verify this with wireshark (perhaps ...


1

Yes, you can review the information through the browser. The subject section of the CSR is visible in IE, Firefox, Chrome for Windows XP through Windows 10. The browsers that work on multiple OS versions are usually very similar in how to view the certificate information. Ex. the steps for Firefox in Linux is the same as windows. Make sure you establish ...


1

Yes, check out the Apache 2.2 doc for mod_rewrite: Apache Module mod_rewrite Also check this serverfault post: Redirect, Change URLs or Redirect HTTP to HTTPS in Apache - Everything You Ever Wanted to Know About Mod_Rewrite Rules but Were Afraid to Ask But remember. SSL is negotiated before URL rewriting, so you will get a CN mismatch error on your ...


1

You added the rules for port 443 at the end of the INPUT chain. Rule #13 (as listed above) drops any traffic that did not match against an earlier rule. Use the -I flag when adding the rule instead of -A. For example: sudo iptables -I INPUT 6 -p tcp --dport 443 -j ACCEPT That way the traffic will not be dropped.


1

This was resolved by opening port 443 in my security group. Oops! Thanks!



Only top voted, non community-wiki answers of a minimum length are eligible