# Nginx SSL proxy **URL:** \ **Category:** NGINX\ **Created:** [February 13, 2009, 1:56am UTC](https://www.ruby-forum.com/t/nginx-ssl-proxy/160213 "2009-02-13T01:56:23Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Pavel\_Ivashkov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/9f8e36/32.png) [@Pavel\_Ivashkov](https://www.ruby-forum.com/u/Pavel_Ivashkov)\ **Post date:** [February 13, 2009, 1:56am UTC](https://www.ruby-forum.com/t/nginx-ssl-proxy/160213/1 "2009-02-13T01:56:23Z")
Hello all, I have nginx to reverse proxy SSL site to end users. (And yes, I need SSL on the back-end as well as on the front-end.) The problem is - it is too slow (~200ms overhead per each request). I found this comment from Dave C.: > The the dog slowness you are seeing is probably nginx renegitiation SSL on > every backend request. At the moment nginx will issue a connection close > after each request. So my question is whether it’s still true for the nginx-0.7.34 ? (assuming that client to nginx keeps single connection alive for all requests) # In the log file I can see several entries like: # 2009/02/13 02:35:33 [debug] 26638#0: \*1 SSL handshake handler: 0 2009/02/13 02:35:33 [debug] 26638#0: \*1 SSL\_do\_handshake: 1 2009/02/13 02:35:33 [debug] 26638#0: \*1 SSL: TLSv1, cipher: “RC4-MD5 SSLv3 Kx=RS A Au=RSA Enc=RC4(128) Mac=MD5” 2009/02/13 02:35:33 [debug] 26638#0: \*1 save session: 08975D40:2 2009/02/13 02:35:33 [debug] 26638#0: \*1 http upstream send request Does it actually mean the SSL connection initialization to backend? Turning on google\_perftools\_profiles gave me the following list but I’m not sure how to interpret the results and whether is shows the full picture: # pprof --text /usr/local/nginx/sbin/nginx profile.24433 Total: 51 samples 11 21.6% 21.6% 11 21.6% \_x86\_AES\_encrypt 5 9.8% 31.4% 5 9.8% sha1\_block\_asm\_data\_order 4 7.8% 39.2% 4 7.8% AES\_cbc\_encrypt 4 7.8% 47.1% 4 7.8% memcpy 4 7.8% 54.9% 4 7.8% \_\_epoll\_wait\_nocancel 3 5.9% 60.8% 3 5.9% md5\_block\_asm\_host\_order 3 5.9% 66.7% 3 5.9% \_\_read\_nocancel 2 3.9% 70.6% 2 3.9% RC4 2 3.9% 74.5% 2 3.9% \_\_write\_nocancel 1 2.0% 76.5% 1 2.0% bn\_sub\_part\_words 1 2.0% 78.4% 1 2.0% \_\_gettimeofday\_internal 1 2.0% 80.4% 25 49.0% ngx\_worker\_process\_cycle 1 2.0% 82.4% 1 2.0% CRYPTO\_lock 1 2.0% 84.3% 4 7.8% ngx\_ssl\_send\_chain 1 2.0% 86.3% 1 2.0% lh\_doall\_arg 1 2.0% 88.2% 1 2.0% OPENSSL\_cleanse 1 2.0% 90.2% 1 2.0% ERR\_clear\_error 1 2.0% 92.2% 1 2.0% tls1\_mac 1 2.0% 94.1% 1 2.0% BN\_from\_montgomery 1 2.0% 96.1% 1 2.0% ngx\_palloc 1 2.0% 98.0% 6 11.8% ngx\_http\_write\_filter 1 2.0% 100.0% 1 2.0% RC4\_set\_key 0 0.0% 100.0% 1 2.0% DH\_OpenSSL 0 0.0% 100.0% 6 11.8% ngx\_http\_postpone\_filter 0 0.0% 100.0% 1 2.0% ERR\_add\_error\_data 0 0.0% 100.0% 2 3.9% ngx\_http\_upstream\_finalize\_request 0 0.0% 100.0% 3 5.9% ssl3\_write 0 0.0% 100.0% 12 23.5% ngx\_http\_upstream\_process\_upstream 0 0.0% 100.0% 10 19.6% ngx\_event\_pipe ---
**Author:** ![Pavel\_Ivashkov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/9f8e36/32.png) [@Pavel\_Ivashkov](https://www.ruby-forum.com/u/Pavel_Ivashkov)\ **Post date:** [February 13, 2009, 4:12am UTC](https://www.ruby-forum.com/t/nginx-ssl-proxy/160213/2 "2009-02-13T04:12:42Z")
> So my question is whether it’s still true for the nginx-0.7.34 ? > (assuming that client to nginx keeps single connection alive for all > requests) Looking throught the 0.7.x release notes, there is no indication HTTP/1.1 reverse proxying is supported yet. Cheers Dave ---
**Author:** ![Pavel\_Ivashkov](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/9f8e36/32.png) [@Pavel\_Ivashkov](https://www.ruby-forum.com/u/Pavel_Ivashkov)\ **Post date:** [February 13, 2009, 8:34am UTC](https://www.ruby-forum.com/t/nginx-ssl-proxy/160213/3 "2009-02-13T08:34:28Z")
On Fri, Feb 13, 2009 at 02:40:25AM +0200, Pavel Ivashkov wrote: > # So my question is whether it’s still true for the nginx-0.7.34 ? 2009/02/13 02:35:33 [debug] 26638#0: \*1 http upstream send request > > Does it actually mean the SSL connection initialization to backend? Yes, as nginx still does not use persisent connection to backend, it has to do SSL renegitiation. However, it tries to reuse previously saved SSL session, this eliminates RSA: proxy\_ssl\_session\_reuse on|off; # default is on Changes with nginx 0.7.11 18 Aug 2008 ``` *) Feature: the "proxy_ssl_session_reuse" directive. ``` If a session was reused you will lines: "SSL: TLSv1, cipher: “RC4-MD5 SSLv3 Kx=RS A Au=RSA Enc=RC4(128) Mac=MD5” “SSL reused session” However, I can not say what may be a cause of 200ms delay. Probably tcpdump may help. > ``` > 4 7.8% 54.9% 4 7.8% __epoll_wait_nocancel > 1 2.0% 88.2% 1 2.0% OPENSSL_cleanse > 0 0.0% 100.0% 3 5.9% ssl3_write > 0 0.0% 100.0% 12 23.5% ngx_http_upstream_process_upstream > 0 0.0% 100.0% 10 19.6% ngx_event_pipe > > ``` As I understand here main CPU hogs are AES/SHA cipher, but not RSA. Here are RSA related functions: ``` 1 2.0% 76.5% 1 2.0% bn_sub_part_words 1 2.0% 94.1% 1 2.0% BN_from_montgomery ```