René's URL Explorer Experiment


Title: Is TLS Fast Yet?

X Title: Is TLS Fast Yet?

Description: TLS has exactly one performance problem: it is not used widely enough. Everything else can be optimized.

X Description: TLS has exactly one performance problem: it is not used widely enough. Everything else can be optimized.

direct link

Domain: istlsfastyet.com

authorIlya Grigorik
twitter:cardsummary
og:image/images/preview.png
twitter:image:src/images/preview.png
twitter:creator@igrigorik
twitter:urlhttps://istlsfastyet.com/

Links:

CPU & latency costshttps://istlsfastyet.com/#cpu-latency
"Overclocking SSL"https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
"HTTP2 Expression of Interest"https://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0251.html
"Forward Secrecy at Twitter"https://blog.twitter.com/2013/forward-secrecy-at-twitter-0
TLS handshakehttps://hpbn.co/transport-layer-security-tls/#tls-handshake
TLS session resumptionhttps://hpbn.co/transport-layer-security-tls/#tls-session-resumption
TLS False Starthttps://hpbn.co/transport-layer-security-tls/#enable-tls-false-start
TLS record size optimizationhttps://hpbn.co/transport-layer-security-tls/#optimize-tls-record-size
Early terminationhttps://hpbn.co/transport-layer-security-tls/#leverage-early-termination
HTTP Strict Transport Security (HSTS)https://hpbn.co/transport-layer-security-tls/#enable-http-strict-transport-security-hsts
TLS performance checklisthttps://hpbn.co/transport-layer-security-tls/#optimizing-for-tls
Qualys SSL Server Testhttps://www.ssllabs.com/ssltest/
Read HPBN onlinehttps://hpbn.co/?utm_source=istlsfastyet&utm_medium=referral&utm_campaign=tls
Server performancehttps://istlsfastyet.com/#server-performance
Apachehttps://httpd.apache.org/docs/2.4/mod/mod_ssl.html
yeshttps://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslsessioncache
yeshttps://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslsessionticketkeyfile
yeshttps://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslusestapling
yeshttps://httpd.apache.org/docs/2.4/mod/mod_http2.html#h2tlscooldownsecs
yeshttps://httpd.apache.org/docs/trunk/mod/mod_ssl.html#sslalpnpreference
yeshttps://wiki.mozilla.org/Security/Server_Side_TLS#Apache
yeshttps://httpd.apache.org/docs/trunk/mod/mod_http2.html
yeshttps://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslciphersuite
ATShttps://docs.trafficserver.apache.org/en/latest/index.html
yeshttps://docs.trafficserver.apache.org/en/latest/admin-guide/files/records.config.en.html#proxy-config-ssl-session-cache-timeout
yeshttps://cwiki.apache.org/confluence/display/TS/What's+new+in+v4.2.x#What'snewinv4.2.x-RFC5077TLSSessiontickets
yeshttps://issues.apache.org/jira/browse/TS-2367
dynamichttps://issues.apache.org/jira/browse/TS-2503
yeshttp://mail-archives.us.apache.org/mod_mbox/www-announce/201206.mbox/%3C4FE245C6.6060900@apache.org%3E
yeshttps://issues.apache.org/jira/browse/TS-2372
yeshttps://docs.trafficserver.apache.org/en/latest/admin-guide/files/records.config.en.html#http-2-configuration
yeshttps://cwiki.apache.org/confluence/display/TS/What%27s+New+in+v8.0.x
Caddyhttps://github.com/mholt/caddy
yeshttps://caddyserver.com/docs/tls#summary
yeshttps://caddyserver.com/docs/tls#summary
yeshttps://caddyserver.com/docs/tls#summary
yeshttps://caddyserver.com/docs/tls#summary
yeshttps://caddyserver.com/docs/tls#summary
yeshttps://caddyserver.com/docs/tls#summary
yeshttps://caddyserver.com/docs/tls#summary
yeshttps://caddyserver.com/docs/tls#protocols
F5 BIG-IPhttps://support.f5.com/kb/en-us/solutions/public/14000/700/sol14783.html
yeshttps://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ssl-administration-11-6-0/5.html#unique_828493537
yeshttps://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ssl-administration-11-6-0/5.html#unique_774070786
yeshttps://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ssl-administration-11-6-0/4.html#unique_823049624
yeshttps://support.f5.com/content/kb/en-us/products/big-ip_ltm/manuals/product/bigip-ssl-administration-12-1-0/_jcr_content/pdfAttach/download/file.res/BIG-IP_System__SSL_Administration.pdf
yeshttps://support.f5.com/kb/en-us/products/big-ip-aam/manuals/product/aam-concepts-11-6-0/15.html
yeshttps://support.f5.com/kb/en-us/solutions/public/13000/100/sol13163.html
yeshttps://support.f5.com/kb/en-us/products/big-ip-aam/manuals/product/aam-concepts-11-6-0/15.html
yeshttps://support.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/product/relnote-bigip-14-1-0.html#rn_ltm-tmos_14101_new
H2Ohttps://h2o.examp1e.net/
yeshttps://h2o.examp1e.net/configure/base_directives.html#ssl-session-resumption
yeshttps://h2o.examp1e.net/configure/base_directives.html#ssl-session-resumption
yeshttps://h2o.examp1e.net/configure/base_directives.html#ocsp-update-interval
dynamichttps://h2o.examp1e.net/configure/http2_directives.html#latency-optimization
yeshttps://h2o.examp1e.net/configure/base_directives.html#ssl-session-resumption-ticket-based
yeshttps://h2o.examp1e.net/configure/http2_directives.html
yeshttps://github.com/h2o/h2o/releases/tag/v2.2.0
yeshttps://github.com/h2o/h2o/releases/tag/v2.2.0
HAProxyhttps://cbonte.github.io/haproxy-dconv/1.8/configuration.html
yeshttps://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.1-no-tls-tickets
yeshttps://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.1-no-tls-tickets
yeshttps://kura.io/2014/07/02/haproxy-ocsp-stapling/
dynamichttps://gist.github.com/igrigorik/8960971
yeshttps://cbonte.github.io/haproxy-dconv/configuration-1.5.html#5.1-alpn
yeshttps://wiki.mozilla.org/Security/Server_Side_TLS#Haproxy
yeshttps://cbonte.github.io/haproxy-dconv/1.8/configuration.html#1.1
yeshttps://cbonte.github.io/haproxy-dconv/1.8/configuration.html#5.1-ssl-max-ver
yeshttps://cbonte.github.io/haproxy-dconv/1.8/configuration.html#5.1-allow-0rtt
Hitchhttps://github.com/varnish/hitch
yeshttps://github.com/varnish/hitch/blob/master/docs/configuration.md#ocsp-stapling
yeshttps://github.com/varnish/hitch/blob/master/docs/configuration.md#alpnnpn-support
yeshttps://github.com/varnish/hitch/blob/master/docs/configuration.md#alpnnpn-support
yeshttps://github.com/varnish/hitch/blob/master/CHANGES.rst#hitch-150-2018-12-17
IIShttps://www.iis.net/configreference
yeshttps://technet.microsoft.com/en-us/library/hh831771.aspx
yeshttps://unmitigatedrisk.com/?p=368
yeshttps://technet.microsoft.com/en-us/library/hh831771.aspx
yeshttps://blogs.technet.com/b/erezs_iis_blog/archive/2013/08/22/perfect-secrecy-in-an-imperfect-world.aspx
yeshttps://blogs.iis.net/nazim/http-2-for-iis-in-windows-10-technical-preview
yeshttps://docs.microsoft.com/en-us/windows-server/get-started/whats-new-in-windows-server-2022#transport-https-and-tls-13-enabled-by-default-on-windows-server-2022
Citrix ADChttps://www.citrix.com/products/citrix-adc/?posit=glnav
yeshttps://support.citrix.com/article/CTX121925
yeshttps://docs.citrix.com/en-us/netscaler/12/ssl/ssl-profiles/ssl-enabling-the-default-profile.html
yeshttps://docs.citrix.com/en-us/netscaler/12/ssl/ssl-11-1-ocsp-stapling-solution.html
yeshttps://docs.citrix.com/en-us/netscaler/12/ssl/ciphers-available-on-the-citrix-ADC-appliances/diffie-hellman-key-generation-and-achieving-pfs-with-dhe.html
yeshttps://docs.citrix.com/en-us/netscaler/12/system/http-configurations/configuring-http2.html
yeshttps://www.citrix.com/blogs/2018/09/11/citrix-announces-adc-support-for-tls-1-3/
lighttpdhttps://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL
nohttps://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL#Session-Caching
yeshttps://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL#Session-Tickets
yeshttps://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL#OCSP-Stapling
yeshttps://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL#Perfect-Forward-Secrecy-PFS
yeshttps://redmine.lighttpd.net/issues/2813
yeshttps://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_SSL
NGINXhttps://nginx.org/en/docs/http/ngx_http_ssl_module.html
yeshttps://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_cache
yeshttps://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_session_tickets
yeshttps://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_stapling
statichttps://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_buffer_size
yeshttps://wiki.mozilla.org/Security/Server_Side_TLS#Nginx
yeshttps://www.nginx.com/blog/early-alpha-patch-http2/
yeshttps://twitter.com/nginxorg/status/856896480497385473
yeshttps://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data
node.jshttps://nodejs.org/api/https.html
yeshttps://nodejs.org/api/tls.html#tls_tls_createserver_options_secureconnectionlistener
optionalhttps://nodejs.org/api/tls.html#tls_event_ocsprequest
optionalhttps://nodejs.org/api/tls.html#tls_tlssocket_setmaxsendfragment_size
yeshttps://nodejs.org/api/tls.html#tls_event_secureconnection
yeshttps://nodejs.org/api/tls.html#tls_perfect_forward_secrecy
yeshttps://nodejs.org/dist/latest-v12.x/docs/api/http2.html
yeshttps://github.com/nodejs/node/blob/master/doc/changelogs/CHANGELOG_V12.md#2019-04-23-version-1200-current-bethgriggs
Gohttps://golang.org/pkg/crypto/tls/
yeshttps://golang.org/pkg/crypto/tls/#ClientSessionState
yeshttps://golang.org/pkg/crypto/tls/#Config.SetSessionTicketKeys
optionalhttps://golang.org/pkg/crypto/tls/#Certificate
yeshttps://golang.org/doc/go1.7#crypto_tls
yeshttps://golang.org/pkg/crypto/tls/#Config
yeshttps://golang.org/pkg/crypto/tls/#Config
yeshttps://golang.org/doc/go1.6#http2
yeshttps://golang.org/doc/go1.12#tls_1_3
nghttpxhttps://nghttp2.org/documentation/nghttpx.1.html
yeshttps://nghttp2.org/documentation/nghttpx.1.html#session-id-resumption
yeshttps://nghttp2.org/documentation/nghttpx.1.html#tls-session-ticket-resumption
yeshttps://nghttp2.org/documentation/nghttpx.1.html#ocsp-stapling
dynamichttps://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx--tls-dyn-rec-warmup-threshold
yeshttps://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx--npn-list
yeshttps://nghttp2.org/documentation/nghttpx.1.html#cmdoption-nghttpx--ciphers
yeshttps://nghttp2.org/documentation/nghttpx.1.html#http-2-and-spdy
yeshttps://nghttp2.org/blog/2018/10/04/nghttp2-v1-34-0/
yeshttps://nghttp2.org/blog/2018/10/04/nghttp2-v1-34-0/
Pulse Secure vTMhttps://www.pulsesecure.net/vtm
yeshttps://www.pulsesecure.net/download/techpubs/current/1027/Pulse-vADC-Solutions/Pulse-Virtual-Traffic-Manager/17.4/ps-vtm-17.4-userguide.pdf#page=224
yeshttps://www.pulsesecure.net/download/techpubs/current/1027/Pulse-vADC-Solutions/Pulse-Virtual-Traffic-Manager/17.4/ps-vtm-17.4-userguide.pdf#page=228
yeshttps://www.pulsesecure.net/download/techpubs/current/1027/Pulse-vADC-Solutions/Pulse-Virtual-Traffic-Manager/17.4/ps-vtm-17.4-userguide.pdf#page=225
yeshttps://www.pulsesecure.net/download/techpubs/current/1027/Pulse-vADC-Solutions/Pulse-Virtual-Traffic-Manager/17.4/ps-vtm-17.4-userguide.pdf#page=175
yeshttps://www.pulsesecure.net/download/techpubs/current/1027/Pulse-vADC-Solutions/Pulse-Virtual-Traffic-Manager/17.4/ps-vtm-17.4-userguide.pdf#page=219
yeshttps://www.pulsesecure.net/download/techpubs/current/1027/Pulse-vADC-Solutions/Pulse-Virtual-Traffic-Manager/17.4/ps-vtm-17.4-userguide.pdf#page=175
yeshttps://www.pulsesecure.net/download/techpubs/current/1441/Pulse-vADC-Solutions/Pulse-Virtual-Traffic-Manager/18.3/ps-vtm-18.3-userguide.pdf#page=226
ShimmerCathttps://www.shimmercat.com/
yeshttps://www.shimmercat.com/en/docs/1.5/featureset/#misc-tls-features
nohttps://www.shimmercat.com/en/docs/1.5/featureset/#misc-tls-features
nohttps://www.shimmercat.com/en/docs/1.5/featureset/#misc-tls-features
yeshttps://www.shimmercat.com/en/docs/1.5/featureset/#frame-sizes-for-data-headers
yeshttps://www.shimmercat.com/en/docs/1.5/featureset/#misc-tls-features
yeshttps://www.shimmercat.com/en/docs/1.5/featureset/#misc-tls-features
yeshttps://www.shimmercat.com/en/docs/1.5/featureset/#protocol-support
pull request!https://github.com/igrigorik/istlsfastyet.com/issues
CDN & PaaS performancehttps://istlsfastyet.com/#cdn-paas
early terminationhttps://hpbn.co/transport-layer-security-tls/#leverage-early-termination
yeshttps://community.akamai.com/customers/s/article/WebPerformanceCertificateProvisioningSystemCPSRecommendationsandBestPractices20180719231737
yeshttps://http2.akamai.com/
yeshttps://community.akamai.com/customers/s/article/Get-ready-for-TLS-1-3
yeshttps://aws.amazon.com/about-aws/whats-new/2014/02/19/elastic-load-balancing-perfect-forward-secrecy-and-more-new-security-features/
yeshttps://aws.amazon.com/about-aws/whats-new/2014/02/19/elastic-load-balancing-perfect-forward-secrecy-and-more-new-security-features/
yeshttps://aws.amazon.com/blogs/aws/new-aws-application-load-balancer/
yeshttps://aws.amazon.com/about-aws/whats-new/2016/09/amazon-cloudfront-now-supports-http2/
yeshttps://aws.amazon.com/about-aws/whats-new/2020/09/cloudfront-tlsv1-3-support/
yeshttps://docs.belugacdn.com/docs/ssl-certificates
yeshttps://docs.belugacdn.com/docs/ssl-certificates
yeshttps://docs.belugacdn.com/docs/ssl-certificates
dynamichttps://docs.belugacdn.com/docs/ssl-certificates
yeshttps://docs.belugacdn.com/docs/ssl-certificates
yeshttps://docs.belugacdn.com/docs/ssl-certificates
yeshttps://docs.belugacdn.com/docs/ssl-certificates
yeshttps://client.cdn77.com/support/knowledgebase/general-faq/ssl-tech-specs
yeshttps://client.cdn77.com/support/knowledgebase/general-faq/ssl-tech-specs
yeshttps://client.cdn77.com/support/knowledgebase/general-faq/ssl-tech-specs
dynamichttps://client.cdn77.com/support/knowledgebase/general-faq/ssl-tech-specs
yeshttps://client.cdn77.com/support/knowledgebase/general-faq/ssl-tech-specs
yeshttps://client.cdn77.com/support/knowledgebase/general-faq/ssl-tech-specs
yeshttps://www.cdn77.com/http2
yeshttps://www.cdn77.com/blog/latest-tls-improving-https/
yeshttps://www.cdn77.com/blog/latest-tls-improving-https/
yeshttps://blog.cloudflare.com/introducing-http2/
yeshttps://blog.cloudflare.com/introducing-tls-1-3/
yeshttps://blog.cloudflare.com/introducing-0-rtt/
yeshttps://www.verizondigitalmedia.com/blog/2017/04/http2-done-right/
yeshttps://www.verizondigitalmedia.com/blog/2018/12/tls-13-making-the-internet-faster-and-safer/
yeshttps://www.fastly.com/blog/http2-now-general-availability
yeshttps://docs.fastly.com/en/guides/enabling-tls-1-3-through-fastly
client->Fastly onlyhttps://docs.fastly.com/en/guides/enabling-tls-1-3-through-fastly#limitations-and-key-behaviors
yeshttps://devcenter.heroku.com/articles/ssl#supported-ssl-protocols
yeshttps://incapsula.zendesk.com/hc/en-us/articles/235148027-Incapsula-TLS-SSL-Tech-Specs
yeshttps://incapsula.zendesk.com/hc/en-us/articles/235148027-Incapsula-TLS-SSL-Tech-Specs
yeshttps://incapsula.zendesk.com/hc/en-us/articles/235148027-Incapsula-TLS-SSL-Tech-Specs
dynamichttps://incapsula.zendesk.com/hc/en-us/articles/235148027-Incapsula-TLS-SSL-Tech-Specs
yeshttps://incapsula.zendesk.com/hc/en-us/articles/235148027-Incapsula-TLS-SSL-Tech-Specs
yeshttps://incapsula.zendesk.com/hc/en-us/articles/235148027-Incapsula-TLS-SSL-Tech-Specs
yeshttps://www.incapsula.com/blog/http2-is-here-what-you-need-to-know.html
nohttps://docs.imperva.com/bundle/cloud-application-security/page/more/ssl-certificate.htm#TLSversionsupport
yeshttps://www.instartlogic.com/blog/upgrading-http2
yeshttps://www.instart.com/blog/may-2019-new-instart-features
yeshttps://www.instart.com/blog/may-2019-new-instart-features
yeshttps://www.keycdn.com/support/ocsp-stapling/
yeshttps://www.keycdn.com/blog/keycdn-http2-support/
yeshttps://www.keycdn.com/blog/tls-1-3-support/
yeshttps://www.keycdn.com/blog/tls-1-3-support/
yeshttps://www.limelight.com/orchestrate-platform/
yeshttps://www.maxcdn.com/blog/now-shipping-ocsp-stapling/
yeshttps://www.maxcdn.com/blog/http2-support/
yeshttps://www.netlify.com/blog/2015/10/20/netlify-news-no.-6/
yeshttps://vercel.com/docs/edge-network/encryption#tls-resumption
yeshttps://vercel.com/docs/edge-network/encryption#tls-resumption
yeshttps://vercel.com/docs/edge-network/encryption#ocsp-stapling
yeshttps://vercel.com/docs/edge-network/overview#supported-protocols
yeshttps://vercel.com/docs/edge-network/encryption#supported-ciphers
yeshttps://vercel.com/docs/edge-network/overview#supported-protocols
yeshttps://vercel.com/docs/edge-network/encryption#supported-tls-versions
pull request!https://github.com/igrigorik/istlsfastyet.com/issues
FAQhttps://istlsfastyet.com/#faq
handle more users with fewer resourceshttps://www.neotys.com/blog/performance-of-spdy-enabled-web-servers/
TLS 1.3https://www.ietf.org/proceedings/88/slides/slides-88-tls-4.pdf
QUIC crypto dochttps://docs.google.com/document/d/1g5nIXAIkN_Y-7XJW5K45IblHd_L2f5LTaDUDwvZ5L6g/edit
this GDL episodehttps://www.youtube.com/watch?v=hQZ-0mXFmk8
with a recommended ciphersuite listhttps://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_Ciphersuite
especially when forward secrecy is enabledhttps://www.imperialviolet.org/2013/06/27/botchingpfs.html
Let’s Encrypthttps://letsencrypt.org/
stronger security and smaller certificateshttps://casecurity.org/2014/06/10/benefits-of-elliptic-curve-cryptography/
ECDSAhttps://en.wikipedia.org/wiki/Elliptic_Curve_DSA
legacy clientshttps://support.globalsign.com/ssl/ssl-certificates-life-cycle/ecc-compatibility
hybrid certificatehttps://scotthelme.co.uk/hybrid-rsa-and-ecdsa-certificates-with-nginx/
CRIMEhttps://en.wikipedia.org/wiki/CRIME
BREACHhttps://en.wikipedia.org/wiki/BREACH_(security_exploit)
read morehttps://community.qualys.com/blogs/securitylabs/2013/08/07/defending-against-the-breach-attack
HTTPS Everywhere presentationhttps://www.youtube.com/watch?v=cBhZ6S0PFCY
slideshttps://docs.google.com/presentation/d/15H8Sj-Zol1tcum0CSylhmXns5r7cvNFtzYrcwAzkTjM/present
read morehttps://https.cio.gov/everything/
Is TLS Fast Yet?https://www.youtube.com/watch?v=0EB7zh_7UE4
slideshttps://bit.ly/fastTLS
High Performance Browser Networkinghttps://www.amazon.com/gp/product/B00FM0OC4S/ref=s9_simh_gw_p351_d2_i1
full chapter on TLS performancehttps://hpbn.co/tls
Tweethttps://twitter.com/share
@igrigorikhttps://twitter.com/igrigorik
View on GitHubhttps://github.com/igrigorik/istlsfastyet.com

Viewport: width=device-width, initial-scale=1.0

URLs of crawlers that visited me.