# Ssl\_ciphers for speed

**URL:** <https://www.ruby-forum.com/t/ssl-ciphers-for-speed/219512>\
**Category:** NGINX\
**Created:** [May 5, 2012, 2:54pm UTC](https://www.ruby-forum.com/t/ssl-ciphers-for-speed/219512 "2012-05-05T14:54:28Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Gurdipe\_D](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/b77776/32.png) [@Gurdipe\_D](https://www.ruby-forum.com/u/Gurdipe_D)\
**Post date:** [May 5, 2012, 2:54pm UTC](https://www.ruby-forum.com/t/ssl-ciphers-for-speed/219512/1 "2012-05-05T14:54:28Z")

</div>

Hello

I am using nginx 2.0 built with OpenSSL 0.9.8 and I have the following  
configuration for my ssl:

listen 443 ssl;  
ssl\_certificate /etc/ssl/private/wildcardcert.crt;  
ssl\_certificate\_key /etc/ssl/private/wildcardcert.key;  
ssl\_session\_cache shared:SSL:20m;  
ssl\_session\_timeout 5m;  
ssl\_prefer\_server\_ciphers on;

Since I dont have ssl\_ciphers I assume its picking up the default  
settings ’  
HIGH:!ADH:!MD5;’

I found quite a few articles to make the SSL connection strong and more  
secure but I am looking for a solution which is fastest in terms of  
negotiating an SSL connection. Can you recommend me some ssl\_cipher /  
other  
settings I should try to boost speed. I dont transfer any secure data so  
I  
am not concerned about security.

Thanks  
Sparsh G.

---

<div class="post-metadata">

**Author:** ![Sparsh\_G](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/5e9695/32.png) [@Sparsh\_G](https://www.ruby-forum.com/u/Sparsh_G)\
**Post date:** [May 5, 2012, 9:28pm UTC](https://www.ruby-forum.com/t/ssl-ciphers-for-speed/219512/2 "2012-05-05T21:28:24Z")

</div>

On Sat, May 05, 2012 at 06:23:24PM +0530, Sparsh G. wrote:

> ssl\_prefer\_server\_ciphers on;
> 
> Thanks  
> Sparsh G.

Here is what we use for a use case with similar requirements:

ssl\_ciphers  
RC4:AES128+SHA:!kEDH:!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;

RC4 is the fastest without hardware assist. If you have hardware support  
in  
your processor for AES, put the AES128 first, instead of RC4.

Regards,  
Ken

---

<div class="post-metadata">

**Author:** ![Sparsh\_G](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/5e9695/32.png) [@Sparsh\_G](https://www.ruby-forum.com/u/Sparsh_G)\
**Post date:** [May 6, 2012, 11:22am UTC](https://www.ruby-forum.com/t/ssl-ciphers-for-speed/219512/3 "2012-05-06T11:22:05Z")

</div>

Thanks, I dont have AES support in my processor and I tried doing some  
benchmarks with the suggested cipher

I saw very negligible improvement unfortunately. Is this is the best my  
processor can do? Or is there any thing else I can tweak in my machine  
(and  
nginx) to improve SSL connections speed

Thanks  
Sparsh G.

---

<div class="post-metadata">

**Author:** ![Sparsh\_G](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/5e9695/32.png) [@Sparsh\_G](https://www.ruby-forum.com/u/Sparsh_G)\
**Post date:** [May 6, 2012, 2:43pm UTC](https://www.ruby-forum.com/t/ssl-ciphers-for-speed/219512/4 "2012-05-06T14:43:43Z")

</div>

Hi,

On 06-05-2012 11:20, Sparsh G. wrote:

> Thanks, I dont have AES support in my processor and I tried doing  
> some  
> benchmarks with the suggested cipher I saw very negligible  
> improvement  
> unfortunately.
> 
> Is this is the best my processor can do?  
> Or is there any thing else I can tweak in my machine  
> (and nginx) to improve SSL connections speed

What do you get when you call

openssl speed

or dedicated

openssl speed rc4 aes sha1

for your all options for speed please call

openssl speed --help

To see if openssl is able to use a ssl-engine please check the output  
of

openssl engine -t -v

> Thanks  
> Sparsh G.

BR  
Aleks

> > > ssl\_certificate /etc/ssl/private/wildcardcert.crt;  
> > > I found quite a few articles to make the SSL connection strong and  
> > > Thanks
> > 
> > Regards,  
> > Ken
> > 
> > * * *
> > 
> > nginx mailing list  
> > [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) [1]  
> > [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx) [2]

Links:

---

<div class="post-metadata">

**Author:** ![Sparsh\_G](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/5e9695/32.png) [@Sparsh\_G](https://www.ruby-forum.com/u/Sparsh_G)\
**Post date:** [May 6, 2012, 9:00pm UTC](https://www.ruby-forum.com/t/ssl-ciphers-for-speed/219512/5 "2012-05-06T21:00:25Z")

</div>

On Sun, May 06, 2012 at 02:50:58PM +0530, Sparsh G. wrote:

> Thanks, I dont have AES support in my processor and I tried doing some  
> benchmarks with the suggested cipher
> 
> I saw very negligible improvement unfortunately. Is this is the best my  
> processor can do? Or is there any thing else I can tweak in my machine (and  
> nginx) to improve SSL connections speed
> 
> Thanks  
> Sparsh G.

If you are using RC4 that is pretty much the best that you can do with  
respect to encryption speed. It sounds like the slow part is not the  
SSL/TLS encryption.

Cheers,  
Ken