# SSL performance optimization with cache **URL:** \ **Category:** NGINX\ **Created:** [December 14, 2012, 3:45am UTC](https://www.ruby-forum.com/t/ssl-performance-optimization-with-cache/226542 "2012-12-14T03:45:47Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![justin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/3ab097/32.png) [@justin](https://www.ruby-forum.com/u/justin)\ **Post date:** [December 14, 2012, 3:45am UTC](https://www.ruby-forum.com/t/ssl-performance-optimization-with-cache/226542/1 "2012-12-14T03:45:47Z")
Hello, I am optimizing our install of nginx for SSL performance, since our SaaS app is served exclusively over https. I have the following SSL performance directives: ``` ssl_session_cache shared:SSL_CACHE:4m; ssl_session_timeout 5m; ``` My question is, what is the downfall, if any, of setting the timeout to like 720m which is 12 hours. Seems like caching longer would be better. Or, is there a security risk of caching for such a long time? Thanks. Posted at Nginx Forum: > **[SSL performance optimization with cache](https://forum.nginx.org/read.php?2,233990,233990#msg-233990)** > > Hello, I am optimizing our install of nginx for SSL performance, since our SaaS app is served exclusively over https. I have the following SSL performance directives: ssl\_session\_cache shared:SSL\_CACHE:4m; ssl\_session\_timeout 5m; My questio ---
**Author:** ![justin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/3ab097/32.png) [@justin](https://www.ruby-forum.com/u/justin)\ **Post date:** [December 14, 2012, 7:45am UTC](https://www.ruby-forum.com/t/ssl-performance-optimization-with-cache/226542/2 "2012-12-14T07:45:53Z")
Browsing my nginx error log noticed the following logged A LOT: 2012/12/13 21:37:18 [crit] 7968#0: ngx\_slab\_alloc() failed: no memory in SSL session shared cache “SSL\_CACHE” If the cache fills, does it flush older entries for new entries? Basically, how does the SSL cache work exactly? Thanks. Posted at Nginx Forum: > **[Re: SSL performance optimization with cache](https://forum.nginx.org/read.php?2,233990,233999#msg-233999)** > > Hello, I am optimizing our install of nginx for SSL performance, since our SaaS app is served exclusively over https. I have the following SSL performance directives: ssl\_session\_cache shared:SSL\_CACHE:4m; ssl\_session\_timeout 5m; My questio ---
**Author:** ![justin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/3ab097/32.png) [@justin](https://www.ruby-forum.com/u/justin)\ **Post date:** [December 14, 2012, 11:56am UTC](https://www.ruby-forum.com/t/ssl-performance-optimization-with-cache/226542/3 "2012-12-14T11:56:29Z")
Hello! On Fri, Dec 14, 2012 at 01:45:34AM -0500, justin wrote: > Browsing my nginx error log noticed the following logged A LOT: > > 2012/12/13 21:37:18 [crit] 7968#0: ngx\_slab\_alloc() failed: no memory in SSL > session shared cache “SSL\_CACHE” > > If the cache fills, does it flush older entries for new entries? Basically, > how does the SSL cache work exactly? If there is no memory available in a shared cache, oldest non-expired session will be dropped. In most cases this will be enough to create new session, but I wouldn’t rely on this as this is more an emergency mechanism than a normal behaviour. – Maxim D. > **[Technical Support for NGINX and NGINX Plus Software](https://www.nginx.com/support/)** > > Get the help you need with support directly from the authors and maintainers of NGINX Open Source and NGINX Plus. ---
**Author:** ![justin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/3ab097/32.png) [@justin](https://www.ruby-forum.com/u/justin)\ **Post date:** [December 14, 2012, 12:00pm UTC](https://www.ruby-forum.com/t/ssl-performance-optimization-with-cache/226542/4 "2012-12-14T12:00:34Z")
Hello! On Thu, Dec 13, 2012 at 09:45:19PM -0500, justin wrote: > 720m which is 12 hours. Seems like caching longer would be better. Or, is > there a security risk of caching for such a long time? You may consider RFC5246, which suggests an upper limit of 24h: > **[RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2](https://datatracker.ietf.org/doc/html/rfc5246)** > > This document specifies Version 1.2 of the Transport Layer Security (TLS) protocol. The TLS protocol provides communications security over the Internet. The protocol allows client/server applications to communicate in a way that is designed to... – Maxim D. > **[Technical Support for NGINX and NGINX Plus Software](https://www.nginx.com/support/)** > > Get the help you need with support directly from the authors and maintainers of NGINX Open Source and NGINX Plus. ---
**Author:** ![justin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/3ab097/32.png) [@justin](https://www.ruby-forum.com/u/justin)\ **Post date:** [December 14, 2012, 11:52pm UTC](https://www.ruby-forum.com/t/ssl-performance-optimization-with-cache/226542/5 "2012-12-14T23:52:40Z")
Maxim, Thanks for the reply, so if the oldest cache entries are automatically purged why am I seeing: ``` ngx_slab_alloc() failed: no memory in SSL session shared cache ``` “SSL\_CACHE” Logged thousands upon thousands of times in my error log? Was this because even though at that time my expiration was 5m, the cache was full, and it couldn’t purge any cache entries because none were expired? If this is the case, I recommend changing the message from critical error to a notice. Basically, just means that SSL connections could not use cache, they were not failing, just slower. Probably shouldn’t be a critical error right? Posted at Nginx Forum: > **[Re: SSL performance optimization with cache](https://forum.nginx.org/read.php?2,233990,234060#msg-234060)** > > Hello, I am optimizing our install of nginx for SSL performance, since our SaaS app is served exclusively over https. I have the following SSL performance directives: ssl\_session\_cache shared:SSL\_CACHE:4m; ssl\_session\_timeout 5m; My questio