I am sick of the articles saying enabling HTTPS is not going to impact performance "much".
Even without pulling out jmeter, apache bench, or load runner I can tell you just hitting F5 on a HTTPS page makes it take longer. It's the responsiveness. I don't really care if it takes 10% more CPU. CPU cycles are getting cheaper and cheaper. I do care a lot that it takes 50ms more.
Yes I know you can tweak things so that the HTTPS connection stays open and doesn't have to handshake everytime. But really, is there anyway to get that handshake down to something acceptable?
I don't know HTTPS, but it should be just HTTP over SSL. That means regular "Connection: keep-alive" should work just as well on HTTPS as HTTP. In both cases it will keep the connection alive, allowing several requests after one another.
Comments
Yes we already know HTTPS is secure.
I am sick of the articles saying enabling HTTPS is not going to impact performance "much".
Even without pulling out jmeter, apache bench, or load runner I can tell you just hitting F5 on a HTTPS page makes it take longer. It's the responsiveness. I don't really care if it takes 10% more CPU. CPU cycles are getting cheaper and cheaper. I do care a lot that it takes 50ms more.
Yes I know you can tweak things so that the HTTPS connection stays open and doesn't have to handshake everytime. But really, is there anyway to get that handshake down to something acceptable?
Yeah. It's called False Start - http://www.imperialviolet.org/2010/09/05/blacklisting.html
Actually that's really interesting. How can you keep the https connection open?
I don't know HTTPS, but it should be just HTTP over SSL. That means regular "Connection: keep-alive" should work just as well on HTTPS as HTTP. In both cases it will keep the connection alive, allowing several requests after one another.