Does it make sense to have this architecture where users connect to https://a.com then HAProxy does TCP redirection to one of the servers defined in the cluster, then once that server gets the data (NGINX) it will decrypt the SSL and then pass the request on to an application server (COldFusion) on another machine. So basically the data is going through 3 machines , HaProxy,NGIX and Finally CF.

Is Latency a big issue here?


It sounds like you're doing premature optimization. If you already have a load that warrants that architecture, then you should also have facts about CPU load etc from your current servers.

So basically the data is going through 3 machines , HaProxy, NGIX and Finally CF. Is Latency a big issue here?

Normally, no. Each layer adds a little bit of latency of course, but usually it's less than 10 milliseconds, even with general-purpose servers and software.


  • Keep it simple.
  • Keep it standardized.

How about at first doing:

Internet ->  | nginx -> CF |

And then later on:

             -------------          ------
Internet ->  | nginx(SSL)| -> | ->  | CF |
             -------------    |     ------
                              |     ------
                              | ->  | CF |
                              |     ------

And lastly, to fully answer your question: Yes your setup does make sense; when the SSL decryption alone is more than a single server can handle.

Essentially you're suggesting a modified version of what Willy Tarreau wrote about in this excellent overview of load balancing technique. In many cases it might be simpler to just use firewall hashing, or routing tricks, or DNS Round Robin at the very front (in front of the SSL accelerators) instead of using HAPRoxy in TCP mode as you suggest -- maybe consider that.

  • Wow great answer. Thanks and just in time too , I was just about to set up some servers. – Faisal Abid Jul 1 '11 at 4:46

I believe you can decrypt at the HAProxy level as well, removing the need for nginx. If HAProxy is seeing a lot of traffic, I suppose you may not want the extra burden of handling SSL, however having three machines just seems like one more than is necessary.

  • Hmm I thought so. The site is expected to get a lot of traffic which is why i want to remove SSL processesing from HAProxy. If NGIX was decrypting the SSL and CF was kicking in and processing the request would that be better? With just 2 servers? So HaProxy --> (NGIX & CF) – Faisal Abid Oct 16 '10 at 20:09
  • HAproxy does not decrypt SSL. – ThatGraemeGuy Jun 30 '11 at 10:49
  • You are correct. Thanks. I was lead to believe otherwise. For the reasons I mentioned above, HAProxy chooses to avoid this: haproxy.1wt.eu/#desi – nategood Jul 13 '11 at 14:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.