Skip to main content
Deployment

Optimizing SSL/TLS Performance

Improve HTTPS performance with protocol selection, session caching, OCSP stapling, and certificate settings.

CertOne1 min read

TLS adds some processing and connection overhead. Appropriate configuration can minimize that overhead and improve HTTPS performance.

1. Sources of overhead​

1. Handshake latency​

TLS handshakes add network round trips and latency.

2. Encryption and decryption​

Encrypting and decrypting traffic consumes CPU resources.

3. Certificate validation​

Validating the certificate chain takes time.

2. Optimization techniques​

1. Use TLS 1.3​

TLS 1.3 reduces handshake round trips and improves performance.

2. Enable HTTP/2​

HTTP/2 multiplexing can improve HTTPS request performance.

3. Configure session caching​

ssl_session_cache shared:SSL:50m;
ssl_session_timeout 1d;

4. Enable OCSP stapling​

Where supported by the CA, stapling reduces client OCSP queries.

5. Use ECDSA certificates​

ECDSA can offer performance advantages over RSA, depending on the operation and platform.

3. Best practices​

1. Protocol selection​

  • ✅ Use TLS 1.3
  • ✅ Enable HTTP/2
  • ✅ Disable obsolete protocols

2. Session management​

  • ✅ Configure TLS session caching
  • ✅ Choose appropriate timeouts
  • ✅ Use session tickets where appropriate for TLS 1.2

3. Certificate optimization​

  • ✅ Use ECDSA certificates where compatible
  • ✅ Enable OCSP stapling when supported by the certificate's CA
  • ✅ Serve an appropriate certificate chain

Conclusion​

Correct configuration minimizes TLS overhead and improves the speed of HTTPS connections.