joyent/node — Issue #2846: Poor SSL handshaking performance
Author: kfox
Created: 2012-02-29 17:43:57+00:00
State: open

I compared the SSL handshaking performance of node 0.6.11 to Apache 2.2.22 on the same hardware and node's performance seemed much lower than I'd expected. Node was getting about 600-650 handshakes per second while Apache 2.2.22 was getting about 2000. I ran each test for 30 seconds to see if performance was sustained. The tests were run against a Fedora 16 server, using the RSA_With_3DES_EDE_CBC_SHA cipher, 512-bit encryption, and SSLv3 (not TLSv1). I used specialized third-party hardware to simulate the client load.

After digging into the packet captures a bit, it looks like node does not currently reuse Session IDs when the client offers a previously-negotiated ID, a.k.a. SSL session resume. Other SSL-capable web servers, e.g. Apache and lighttpd, do.

[This](https://gist.github.com/1934981) is the node.js code I used, and [these](https://gist.github.com/1942782) are the kernel parameter tweaks I made. (The Apache config was provided to the nodejs-dev mailing list.)

Adding the option to reuse session IDs for SSL session resumption would theoretically make node's performance jump appreciably higher and reduce the amount of bandwidth used. As an illustration, 30 seconds of testing against Apache (2000 handshakes per second) resulted in a 19MB packet capture, while 30 seconds of testing against node.js 0.6.11 (600 handshakes per second) resulted in a 33MB packet capture due to the constant SSL session renegotiation.