# Ssl benchmarks with and without nginx

**URL:** <https://www.ruby-forum.com/t/ssl-benchmarks-with-and-without-nginx/212005>\
**Category:** NGINX\
**Created:** [September 19, 2011, 9:57pm UTC](https://www.ruby-forum.com/t/ssl-benchmarks-with-and-without-nginx/212005 "2011-09-19T21:57:09Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![luislavena](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/0ea827/32.png) [@luislavena](https://www.ruby-forum.com/u/luislavena)\
**Post date:** [September 19, 2011, 9:57pm UTC](https://www.ruby-forum.com/t/ssl-benchmarks-with-and-without-nginx/212005/1 "2011-09-19T21:57:09Z")

</div>

Dear Reader,

today on the haproxy list was this link posted

> **[Benchmarking SSL Performance](https://www.haproxy.com/blog/benchmarking-ssl-performance)**
>
> In this blog post, we explain how one can improve SSL/TLS performance by adding some functionality to SSL open-source software with HAProxy.

I have asked why they not have tried to use nginx the answer was another  
link

> **[TLS termination: stunnel, nginx & stud](https://vincent.bernat.ch/en/blog/2011-ssl-benchmark)**
>
> Here is the short version: to get better performance on your TLS terminator, use stud on 64-bit system with patch from Émeric Brun for TLS session...

Maybe someone can verify if there is really a problem in nginx or this  
difference is due to the fact that nginx is a REAL Webserver and the  
other both ‘only’ SSL-Terminator.

BR  
Aleks

---

<div class="post-metadata">

**Author:** ![Aleksandar\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8edcca/32.png) [@Aleksandar\_L](https://www.ruby-forum.com/u/Aleksandar_L)\
**Post date:** [September 20, 2011, 12:20am UTC](https://www.ruby-forum.com/t/ssl-benchmarks-with-and-without-nginx/212005/2 "2011-09-20T00:20:32Z")

</div>

Hello!

On Mon, Sep 19, 2011 at 09:56:19PM +0200, Aleksandar L. wrote:

> Maybe someone can verify if there is really a problem in nginx or this  
> difference is due to the fact that nginx is a REAL Webserver and the  
> other both ‘only’ SSL-Terminator.

The main problem I see is nginx configuration. By default nginx  
is configured to handle real-word load, not for ssl session  
microbenchmarks. And the config used in particular test makes  
things even worse due to “multi\_accept on” used. For  
microbenchmarking ssl one want to use

```
events {
    accept_mutext off;
    multi_accept off;
    ...
}

```

to ensure better distribution of connections between worker  
processes, this should resolve observed latency issues.

Maxim D.

p.s. Stunnel in the same test was obviously benchmarked with  
non-threaded OpenSSL, and that’s why it doesn’t scale to multiple  
CPUs. With properly compiled OpenSSL it will scale fine.

---

<div class="post-metadata">

**Author:** ![Aleksandar\_L](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8edcca/32.png) [@Aleksandar\_L](https://www.ruby-forum.com/u/Aleksandar_L)\
**Post date:** [October 11, 2011, 11:59pm UTC](https://www.ruby-forum.com/t/ssl-benchmarks-with-and-without-nginx/212005/3 "2011-10-11T23:59:13Z")

</div>

OoO En cette nuit nuageuse du mardi 20 septembre 2011, vers 00:20,  
mdounin at [mdounin.ru](http://mdounin.ru) (Maxim D.) disait :

> > Maybe someone can verify if there is really a problem in nginx or this  
> > difference is due to the fact that nginx is a REAL Webserver and the  
> > other both ‘only’ SSL-Terminator.

> The main problem I see is nginx configuration. By default nginx  
> is configured to handle real-word load, not for ssl session  
> microbenchmarks. And the config used in particular test makes  
> things even worse due to “multi\_accept on” used. For  
> microbenchmarking ssl one want to use

> ```
> events {
> accept_mutext off;
> multi_accept off;
> ...
> }
> 
> ```

> to ensure better distribution of connections between worker  
> processes, this should resolve observed latency issues.

Meantime, I have done and published another round of tests where I still  
had the same issues for nginx. Aleksandar pointed me to your post. I  
have modified my nginx configuration as you say and the latency issues  
are now gone. I have updated my latest post with this correction and new  
data. nginx now performs like stud (and even better since stud has  
another kind of latency issue).

[TLS termination: stunnel, nginx & stud, round 2](http://vincent.bernat.im/en/blog/2011-ssl-benchmark-round2.html)

> p.s. Stunnel in the same test was obviously benchmarked with  
> non-threaded OpenSSL, and that’s why it doesn’t scale to multiple  
> CPUs. With properly compiled OpenSSL it will scale fine.

## The problem with stunnel was a bug in OpenSSL (for which stunnel implements a slow workaround). Upgrading to a recent version of OpenSSL allows stunnel to perform well.

Vincent Bernat ☯ [http://vincent.bernat.im](http://vincent.bernat.im)

panic(“Attempted to kill the idle task!”);  
2.2.16 /usr/src/linux/kernel/exit.c