4

I just came across this statement on the CloudFlare SSL page: "Modern SSL can actually improve page load times."

How can SSL improve page load times? Is there a situation where loading an HTTPS page could be faster than loading an HTTP-only page?

2

SSL/TLS always adds some overhead to the connection so a statement that it can improve page load times is kind of misleading. But it is not completely wrong either: In order to increase the use of TLS, browsers provide some modern features only for TLS connections. Especially the modern HTTP/2 protocol can in practically all current browsers only be used over TLS. And use of this protocol can actually improve page load times. Same is true for the still experimental and less used QUIC protocol.

Apart from this some other new features which can have positive effects to load time are only available with HTTPS: better data compression with the brotli algorithm and service workers.

In other words: use of TLS can actually improve page load times since it allows to use more efficient HTTP/2 (and maybe QUIC) protocol in the browsers. But the same improvement could in theory also be gained if the more efficient protocols would be used without TLS. Only browsers don't support this by design even though HTTP/2 could in theory be also used without TLS.

| improve this answer | |
  • 3
    You might want to mention service workers, the caching and other features they provide can really help load times, and HTTPS is mandatory for them – jrtapsell Jul 1 '18 at 7:36
  • @jrtapsell: Contrary to HTTP/2 service workers require (major?) changes in the logic of a web application so this is not as simple as enable TLS and profit. But I've added it to the answer since this kind of application tuning is available with TLS only. I've also added brotli compression which contrary to service workers don't need changes to the application logic. – Steffen Ullrich Jul 1 '18 at 10:39
3

I don't believe TLS can actually improve page load times on its own. What they are claiming is that their service is optimized so that performance-improving features (in particular HTTP/2) are not incompatible with encryption, and that a website served over HTTPS (likely using HTTP/2, session resumption, etc) on Cloudflare will be faster than a website served over HTTP without their services. This is supported by their general statements on performance:

HTTPS isn’t what it used to be. It’s faster, more secure, and used by more websites than ever before. SSL enables HTTP/2, which has the potential to make websites up to two times faster with no changes to existing codebases. Modern TLS also includes performance-oriented features like session resumption, OCSP stapling, and elliptic curve cryptography that uses smaller keys (resulting in a faster handshake). TLS 1.3 reduces latency even further and removes insecure features of TLS making HTTPS more secure and performant than any previous version of TLS and its non-secure counterpart, HTTP.

So while TLS on its own cannot improve performance (it necessarily adds a small amount of computational overhead), some modern network protocols like HTTP/2 only work over TLS. While this isn't standardized, practically all browsers require TLS with it. As such, you could argue that TLS is necessary to use protocols that improve performance, but TLS alone speeds nothing up.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.