Tuesday, November 28, 2017

Tuning Apache KeepAlive Timeout for HTTPS

My website forces HTTPS everywhere and has an average first load time of 3-5 seconds. Thanks to caching, repeat load time is 0.8 seconds.



The SSL negotiation takes 150-300ms on my server, so I want to keep each connection alive as frequently as possible to prevent latency.




SSLSessionCache is set to the default 300 seconds.



Apache KeepAlive Timeout was recently lowered from 5 seconds to 2 seconds.



This change has resulted in a noticeable decrease in Server Load Average (5% average instead of 10% average), but I'm wondering if it could also be causing slower first load times, if the first load times are 3-5 seconds? Does that mean it must perform the SSL negotation again each time it passes the 2 second timeout?



Is it better to have slightly higher load averages with fewer SSL negotations (but more sleeping httpd tasks), or lower load averages with more SSL negotations?



We definitely have plenty of CPU & memory resources to spare. So ultimately the question is, what will result in the best performance for our viewers? Raising the KeepAlive Timeout to 3-5, or keeping it at 2?




Thanks!

No comments:

Post a Comment

linux - How to SSH to ec2 instance in VPC private subnet via NAT server

I have created a VPC in aws with a public subnet and a private subnet. The private subnet does not have direct access to external network. S...