How CloudFlare is making SSL fast | Hacker News Reader

How CloudFlare is making SSL fast

blog.cloudflare.com

38 pointsjgrahamc8 comments

Too much fluff, too less technical information :/

Also, do they contribute their improvements to OpenSSL back or at least have a public repository where others could take a look?

I think it was pretty interesting, first time I've heard of OCSP stapling.

Apparently the AES-NI stuff is actually already part of the public OpenSSL codebase: http://datacenteroverlords.com/2011/09/07/aes-ni-pimp-your-a...

If they want anyone to use their software they should. Any crypto or security person worth a damn will be extremely skeptical of their changes until he or she verifies they don't affect the security of the implementation. Lots of people have ideas on how to 'speed up' crypto, and most of them are total junk.

meh, I get my page in EU on a DSL line displayed on my US comp over SSL in ~250ms. SPDY, etc, all those techs are free and simple to use.

Round-trip to EU of a ping for me is 150ms... probably coincidental but that matches the 100ms for "nearly local" har har.

SPDY made the biggest diff on SSL.

Just a reminder to everyone using SSL. AES-NI was introduced a few years ago to improve encryption performance and is supported by OpenSSL. Often you just need to enable it in your BIOS settings or speak to your VPS provider to see if they support it.

To use it in Nginx just add this under the worker_processes line: ssl_engine aesni;

For more information: http://datacenteroverlords.com/2011/09/07/aes-ni-pimp-your-a...

Note simply throwing hardware at it won't solve all performance cases. Some sites[1] are using RC4 for their symmetric encryption. AES is a popular scheme but it's not the only one used.

  [1]: https://www.google.com

Do you know how to find out if my dedicated server has it enabled since I can't tweak the bios myself?

I think I found the answer to my question.

`openssl engine -t` seems to do the trick.

This is useful for configuring nginx with aes-ni http://forum.nginx.org/read.php?2,181676

Reply on news.ycombinator.com