I am running a SSL enabled website on apache 2.2 which is comparatively static but the data is fetched from mysql as it makes updating easier for business side.

Few points about the site:
1. It runs fine during low load condition
2. It was running fine without ssl even in heavy traffic
3. But after enabling SSL it is slowing down during heavy traffic.
4. Whenever inactivity is more than 5 seconds it makes new SSL connection/handshake.
5. SSL Handshake during heavy traffic takes upto 12-15 secs.


LoadModule ssl_module modules/mod_ssl.so
Listen 443
SSLPassPhraseDialog  builtin
SSLSessionCache         shmcb:/path/scache(512000)
SSLSessionCacheTimeout  300
SSLMutex default
SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin
SSLCryptoDevice builtin
SSLStrictSNIVHostCheck off
SSLProtocol all -SSLv3
SSLHonorCipherOrder on
HostnameLookups Off
NameVirtualHost ip:port

<VirtualHost ip:port>
    ServerName domain
    DocumentRoot /folder/
    <Directory /folder/>
        Options -Indexes
        AllowOverride All
    ErrorLog /path/error_log
    CustomLog /path/access_log  common
           SSLEngine on
           SSLCertificateFile /path.txt
           SSLCertificateKeyFile /path.key
           SSLCertificateChainFile /path.txt

How can I custimze ssl.conf to get best possible perfomance without upgrading hardware?


Naturally SSL, even when configured perfectly, consumes more resources, as it needs to encrypt everything. It might well be that your server is underpowered. However, there might be other things you could try to tweak first.

  • Finally upgrade your Apache 2.2 to 2.4. It was released 6 years ago, being 7 years younger than its old brother. Despite having more features it performs faster. With Apache 2.4 you could additionally choose Multi-Processing Module (MPM): Worker or Event might perform faster.
  • You might also have other old software versions performing slower than current versions, but your question lacks this information, assuming the SSL configuration is the problem. Both SQL server and what ever is used to fetch the content from it might benefit from upgrading. Also, MySQL could be upgraded to MariaDB.
  • Load only the modules you need. You have relatively simple needs, so there might easily be unnecessary modules.
  • Check that you don't do DNS lookups by disabling HostnameLookups and avoiding hostnames instead of IPs in Allow & Deny.
  • You have at least one AllowOverride All. That causes additional reading of .htaccess file on every request. Move the configuration from .htaccess context to the Directory context.
  • Caching etc. There's so many things you could do before blaming SSL configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.