I am by no means a pro. Just sharing my experience with Nginx tuning.
Nginx Performance Tuning for SSL
techsamurais.com
Nginx Performance Tuning for SSL
1–10 of 21 posts
Re: Nginx Performance Tuning for SSL
#2Change your SSL cipher settings to this:
ssl_ciphers ALL:!kEDH!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
. SSLv2 is flawed (http://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_1....).
He should disable it.
Re: Nginx Performance Tuning for SSL
#3Change your SSL cipher settings to this: ssl_ciphers ALL:!kEDH!ADH:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP; . SSLv2 is flawed ( http://en.wikipedia.org/wiki/Transport_Layer_Security#SSL_1.... ). He should disable it.
Thanks I will update the article now.
Re: Nginx Performance Tuning for SSL
#4Perhaps someone more experienced can clarify, but is the gist of this article basically sacrificing perfect forward secrecy for more performance?
Re: Nginx Performance Tuning for SSL
#5Perhaps someone more experienced can clarify, but is the gist of this article basically sacrificing perfect forward secrecy for more performance?
I would love to know the answer too. Or may be nginx should fix the way it executes the encryption algorithm.
Re: Nginx Performance Tuning for SSL
#6Sacrificing security in exchange for a minor performance boost. How does your domain score with https://www.ssllabs.com/ssltest/ after disabling those various ciphers?
Please read this discussion thread from 2 years ago for a discussion on the pros/cons of this approach: https://news.ycombinator.com/item?id=2759596
Re: Nginx Performance Tuning for SSL
#7Good to see my conclusions from two years ago still hold: http://matt.io/technobabble/hivemind_devops_alert:_nginx_doe... (or its HN thread meritt kindly dug up: https://news.ycombinator.com/item?id=2759596)
Sadly, these days we want PFS everywhere to stop the snooping apparati, but if you're not really important and just want to stop local network or MiTM snooping, removing PFS should be okay (at least for my boring sites).
Re: Nginx Performance Tuning for SSL
#8Perhaps someone more experienced can clarify, but is the gist of this article basically sacrificing perfect forward secrecy for more performance?
That's exactly what's happening.
Re: Nginx Performance Tuning for SSL
#9> The web server is running on an EC2 t1.micro instance.
Why do people do this?! t1.micros run beautifully at load for 30 seconds then essentially stop entirely for a while... not to mention having much slower internet than even a m1.small.
Re: Nginx Performance Tuning for SSL
#10I am always extremely wary of any configuration changes that alter encryption algorithms. A simple typo can mean going from the exclusion of a weak cipher to the explicit inclusion of it.
One of the performance perks comes from the session cache. Is there an effective way to share that cache between machines serving on the same hostname? For instance: ten servers all serving round robin requests for www.example.com.