There are many great articles explaining how
SSL/TLS works on this site, but I would like to bring in the performance issue. The thing is that I am serving my web content over
HTTPS and the SSL handshake takes a lot of time.
As much I understand at the moment the connection thru
HTTPS is created as follows:
- TCP handshake
- SSL handshake
- HTTP data
Now, considering that I am not allowed to use the
keep-alive header in
HTTP, does that mean that with every request all those 3 points are triggered? My empiric tests show, that the SSL handshake part that is extra from plain
HTTP takes around 200-300ms. For loading the main page the app is making 10+ requests, so that would mean 200*10 = 2 seconds, right? That is too much.
So the question is: How can I optimize those routines? And also, how is the performance distributed between server and client during SSL handshake? Seems like the server has to do a lot more computation, is that correct?