Can you guys help me learn some ssl networking basics plz?

  • What is a SSL transaction (a full handshake?)
  • Why do people think 2k ssl will melt netscalers (ssl trans/sec exceed netscaler max ssl trans/sec?)
  • Can't you install ssl on a cdn's edge nodes to save thecomputational overhead on netscalers?


1 Answer 1


Most times the expression "SSL transaction" is used it just means "a transaction protected by SSL"; otherwise, your interpretation is correct - it means the initial (full or simplified) handshake, where client and server exchange keys to be used from then on to protect messages.

Under the first interpretation, every request made after the initial handshake would still be protected by SSL, though stricly speaking it wouldn't be a "SSL Transaction" since there's no need for further key exchange. The overhead should be minimal (just a few more bytes per request/response), so the impact in performance should be very low.

Old versions of NetScaler in fact seems to have trouble with 2048-bit SSL, but I'm unsure why. However, newer versions have already adapted to it, so it shouldn't be a problem anymore. Besides, while the handshake is indeed somewhat expensive, the rest is actually very lightweight.

As for your last question, using SSL on a CDN would only protect your static media, but you'd still need to protect the dynamic messages exchanged (even more so). Besides, there are security arguments against using SSL on CDNs (in short, it gives a false sense of security) and, naturally, you'd need to use a different certificate for your site and the CDN - you wouldn't want to give your private keys to a third-party, no matter how trusted, right?

  • Thanks for that mgibsonbr. The links are very useful. I agree with you on the security; I wouldn't trust a third party with my private keys. As for SSL. The handshake is indeed more cpu intensive but that is a one off hit if keep alive is on correct? Most recent netscalers have 80,000 ssl transactions/sec (drops if 2k by half) as their max, this should be more than enough for majority of people in my opinion, unless the offloading cards struggle with the 5x computational increase going from 1k to 2k. Maybe people don't realise that alwayson ssl and moving to 2k is feasible on todays hardware.
    – alex
    Jun 6, 2012 at 23:09
  • That's right, the initial handshake needs to use a very strong cypher (since it's performed "in the clear"), but subsequent communication uses a symmetric encryption that is both faster to encode/decode and has very little overhead in the message length. So, a few users making many encrypted requests won't have performence problems, while many users making few requests might pose a challenge (since each of them needs to perform the handshake at least once).
    – mgibsonbr
    Jun 6, 2012 at 23:20
  • Thanks again mgibsonbr. I'm still having some trouble understanding TPS rating on Netscalers. If a site is set to be delivered entirely over SSL, is every GET request now an SSL transaction? Are there any commands one is able to run on a netscaler/webserver to see how it would cope with 2048 bit SSL keys ("openssl speed rsa"?) or determine the TPS if site was to go always on SSL? Thanks
    – user16115
    Jun 8, 2012 at 13:04
  • Every GET request would be protected, but the performance shall be close to unprotected ones (since the handshake/key exchange only need to happen once when starting the session). Unfortunatly I don't know about profiling commands. P.S. I moved the contents of this answer to the original question, so feel free to delete it.
    – mgibsonbr
    Jun 9, 2012 at 13:37

Not the answer you're looking for? Browse other questions tagged or ask your own question.