Computational cost of SSL connections

Posted Over 13 years ago. Visible to the public. Linked content.

In January this year (2010), Gmail switched to using HTTPS for everything by default. Previously it had been introduced as an option, but now all of our users use HTTPS to secure their email between their browsers and Google, all the time. In order to do this we had to deploy no additional machines and no special hardware. On our production frontend machines, SSL/TLS accounts for less than 1% of the CPU load, less than 10KB of memory per connection and less than 2% of network overhead. Many people believe that SSL takes a lot of CPU time and we hope the above numbers (public for the first time) will help to dispel that.

If you stop reading now you only need to remember one thing: SSL/TLS is not computationally expensive any more.

imperialviolet.org
Thomas Eisenbarth
makandra.de
Say thanks
Last edit
Over 13 years ago
License
Source code in this card is licensed under the MIT License.

Related cards:

Working around OpenSSL::SSL::SSLErrors

If your requests blow up in Ruby or CURL, the server you're connecting to might only support requests with older SSL/TLS versions.

You might get an error like: OpenSSL::SSL::SSLError: SSL_connect SYSCALL returned=5 errno=0 state=unknown state

...

Show details of TLS/SSL connections of remote hosts

sslscan is a nice tool to show details about TLS/SSL connections:

~> sslscan some-host-at.makandra.de

Testing SSL server some-host-at.makandra.de on port 443

  Supported Server Cipher(s):
    Failed    SSLv3  256 bits  ECDHE-RSA-AES256-GC...

RestClient / Net::HTTP: How to communicate with self-signed or misconfigured HTTPS endpoints

Occasionally, you have to talk to APIs via HTTPS that use a custom certificate or a misconfigured certificate chain (like missing an intermediate certificate).

Using RestClient will then raise RestClient::SSLCertificateNotVerified errors, or wh...

Use SSL for Amazon RDS / MySQL (and your Rails app)

In case you have sensitive data within your RDS instance, you want to use encrypted connections between your application and RDS instances. If you're using MySQL on RDS, here's what to do:

  1. Download the AWS CA file and copy it to the machine yo...

The challenging setup of an offshore project

After managing a few agile projects from India and learning the tricks of the trade, I have been wondering why life is much easier when you are working closely with the client as compared to working offshore. What worried me more was that I had to...

List of handy Ruby scripts to transcode different file types (often by using GPT)

It's 2024 and we have tools like ffmpeg, imagemagick and GPT readily available. With them, it's easy to convert texts, images, audio and video clips into each other.

For the everyday use without any parameter tweaking I'm using a collection of ti...

Revisiting the hidden cost of features - Momoro Machine

Lots of hidden costs.

How to enable SSL in development with Passenger standalone

Here is how to start your Rails application to accept both HTTP and HTTPS in development.

  1. gem install passenger

  2. Create a [self-signed SSL certificate](https://makandracards.com/makandra/15901-howto-create-a-self-signed-certificate...

Turn off SSL for scenarios with Selenium

Selenium does not speak SSL because it uses WEBrick that doesn't. When you use Selenium for Cucumber scenarios that visit pages with SSL, they will fail.

To turn off SSL only for scenarios that are executed on WEBrick, put this method into your a...

Initiate SSL secured TCP connections to remote services

Establishing a TCP connection to a SSL secured remote service is not possible using telnet or nc.

Though, you can use openssl for that:

openssl s_client -connect www.makandra.com:443
Posted by Thomas Eisenbarth to makandra dev (2011-01-19 15:07)
This website uses short-lived cookies to improve usability.
or learn more