2

I want to setup a SSL terminator / load-balancer in front of my tcp service, I've considered

1) Stunnel (weird performance problem, I compiled it with no-libwrap, pthreads but still pretty slow for most of my clients)

2) Nginx (I don't want/need HTTP bind/processing stuff)

3) HAProxy (no ssl termination)

So, is there any other solution out there?

Improve this question

3 Answers 3

Reset to default
2

Pound SSL is a good solution: http://www.apsis.ch/pound/

Take note of the comment on the homepage about the availability of PRCE and tcmalloc from the Google perftools suite for improved performance.

Although Pound is a reverse proxy and has other features such as load balancing, they're not compulsory. You can simply use it to decrypt the SSL and forward onto a local web server if you wish.

Improve this answer
4
  • which one will be faster? nginx or pound?
    – user74617
    Mar 16, 2011 at 0:01
  • 1
    They both use the openssl library (which is multi-threaded) for decryption, so on similar hardware I'd expect similar performance. Although as mentioned, Pound does have some performance enhancements. I would suggest compiling both from source with any available enhancements, and then comparing, because there's going to be no obvious answer. Make sure you have a recent version of openssl installed to compile against.
    – James Little
    Mar 16, 2011 at 10:23
  • 1
    I tried to use pound today, however, it's still doing that HTTP parsing thing and somewhat more unreliable than stunnel.
    – user74617
    Mar 18, 2011 at 1:40
  • Pound only does the HTTP protocol though. you can't do just SSL over tcp with it. it will look for headers.
    – rox0r
    Oct 12, 2012 at 19:42
1

Stunnel would be the correct option for you. You can strike HAProxy off the list because it doesn't support SSL.

You can use stunnel along with a layer 4 load balancer like LVS for load balancing needs.

Improve this answer
1

Since June 2014 HAProxy provides native support for SSL, version 1.5.x upwards.

There are quite a few options for SSL termination: Stunnel, Stud, Pound, NGINX & HAProxy. (please add comment if there are any other suitable suggestions)

While support is available the features available vary greatly. I can neither find feature lists or a comparison anywhere on-line.

Using NGINX for SSL termination provides a good configuration options with regards to SSL configuration. See http://nginx.com/resources/admin-guide/nginx-ssl-termination/ .

HAProxy would be more suited to a more robust set-up, requiring solid load balancing. See https://serversforhackers.com/haproxy-ssl-termation-pass-through/ & http://blog.haproxy.com/2012/09/10/how-to-get-ssl-with-haproxy-getting-rid-of-stunnel-stud-nginx-or-pound/ .

Improve this answer

You must log in to answer this question.