SSL has poor/inconsistent performance

[clarkk@…]

I have just made some benchmarking Apache vs Nginx and of course Nginx outperformed Apache both in static content and with php-fpm

But then I tried to benchmark HTTPS requests and I got a bit surprised. Apache outperformed Nginx

The benchmark tests were made with ApacheBench

An when Nginx hit 200 concurrent requests 50% of all requests fails

user www-data;
worker_processes 8;
pid /run/nginx.pid;

events {

worker_connections 4096;
multi_accept on;
use epoll;

}

http {

sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;

server_tokens off;
autoindex off;

include /etc/nginx/mime.types;
default_type application/octet-stream;

access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log warn;

index index.php index.html index.htm;

gzip on;
gzip_vary on;
gzip_min_length 10240;
gzip_buffers 16 8k;
gzip_proxied any;
gzip_http_version 1.1;
gzip_types text/plain text/css application/json text/xml text/javascript application/javascript application/xml;

fastcgi_buffers 256 16k;
fastcgi_buffer_size 128k;
fastcgi_busy_buffers_size 256k;
fastcgi_temp_file_write_size 256k;

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;
ssl_session_cache shared:SSL:20m;
ssl_session_timeout 180m;

server {

listen 80;
listen 443 ssl;
server_name api.dyndev.dk;

access_log /var/log/nginx/access_api.dyndev.dk.log;

ssl_certificate /var/ini/ssl/dyndev.dk/public.crt;
ssl_certificate_key /var/ini/ssl/dyndev.dk/private.key;

# Add trailing slash
rewrite ^([.\?]*[^{/])$ $1/ permanent;}

location / {

include /var/ini/nginx/fastcgi.conf;
fastcgi_pass php;
fastcgi_param SCRIPT_FILENAME /var/www/dyndev.dk/public/api/index.php;

}

}

}

[clarkk@…]

I forgot to say I use the same SSL chipers on both Apache and Nginx

[Maxim Dounin]

Proper microbenchmarking requires a bit of tuning. In particular, using multi_accept (as explicitly switched on in your config) known to cause uneven request distribution between workers, resulting in sub-optimal performance on multi-CPU servers in SSL benchmarks. The same applies to accept_mutex (which is on by default, as it usually results in better performance in real life, but not with SSL microbenchmarks). In contrast, something like listen ... reuseport may help a lot, as connections will be distributed evenly between worker processes.

Note well that saying "nginx outpeforms Apache" is a wrong approach. It's not expected to outperform Apache, and in many cases it will behave worse. The main difference is how nginx scales - in contrast to Apache, it's event-based, and can handle thousands of connections in a single process. In the particular case of SSL handshakes microbenchmarking, nginx and Apache are expected to perform equally if properly configured, as both will be limited by SSL handshakes performance and available CPU resources.