No, SSL/TLS is not expensive. I've been running a moderalty high traffic website in EC2 for a few weeks. It is peaking at ~250k requests per minute per c3.8xlarge instance using only 40% CPU. 100% of the traffic is over SSL/TLS and the response size is less than 100 bytes, so most of the overhead is in handshaking (which is much more expensive than just sending data). With a larger response size, the CPU utilization would be even lower.