Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've been benchmarking my TLS performance, and I noticed that during the "write client key exchange" phase, there's significant overhead compared to all other actions. I'm wondering if there's anything I can do to speed this up?

40348.989720O ssl_info_callback SSL_connect SSLv3 read server certificate A
140348.989934O ssl_info_callback SSL_connect SSLv3 read server key exchange A
140348.989954O ssl_info_callback SSL_connect SSLv3 read server certificate request A
140348.989968O ssl_info_callback SSL_connect SSLv3 read server done A
140348.990606O ssl_info_callback SSL_connect SSLv3 write client certificate A
140349.29131O ssl_info_callback SSL_connect SSLv3 write client key exchange A
140349.35914O ssl_info_callback SSL_connect SSLv3 write certificate verify A
140349.36013O ssl_info_callback SSL_connect SSLv3 write change cipher spec A
140349.36062O ssl_info_callback SSL_connect SSLv3 write finished A
140349.36077O ssl_info_callback SSL_connect SSLv3 flush data
140349.36094O ssl_info_callback SSL_connect error in SSLv3 read server session ticket A

Based on this, it looks like the client key exchange takes ~300ms

share|improve this question
You really should include some data on the hardware and software platforms involved here. A client key exchange in only 300ms would be extremely fast if the client uses, say, a 33 MHz ARM processor -- and quite slow if the client is a 2 GHz PC. – Thomas Pornin Aug 3 '11 at 23:22
Please provide more information. It looks like OpenSSL. What version is it, can you reproduce that behavior with openssl s_client ? Do you have a public URL we can try ? – ixe013 Aug 5 '11 at 12:56

After your client receives the server's certificate, It could be that the client tries to check certificate revocation.

Save the server's CA certificates to a file and use the -CACert argument (or -CAPath).

share|improve this answer
and or is checking the certificate chain, especially if the chain is long – this.josh Aug 5 '11 at 6:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.