1. Https is slower. From a practicality standpoint - is it that much slower to actually make a difference from a UX side of things?
2. I've implemented https on one of my sites, but in chrome, it's not full green, but appears as https with the broken lock. Any idea on what that means and how to fix it?
Create a text file called curl-format.txt:
time_namelookup: %{time_namelookup}\n
time_connect: %{time_connect}\n
time_appconnect: %{time_appconnect}\n
time_pretransfer: %{time_pretransfer}\n
time_redirect: %{time_redirect}\n
time_starttransfer: %{time_starttransfer}\n
----------\n
time_total: %{time_total}\n
curl -w "@curl-format.txt" -o /dev/null -s "https://mysite.com"
- Link: https://www.bionicspirit.com/
- SSL Rating: https://www.ssllabs.com/ssltest/analyze.html?d=bionicspirit....
- Server is in Europe, here's a load test from New York: http://tools.pingdom.com/fpt/200PE/https://www.bionicspirit....
On nr. (1) it is not that big of a deal and for your own content SPDY can make a difference. Satellite connections are indeed problematic for HTTPS.
BTW - I have insisted on having my personal blog on HTTPS because I noticed that some public networks in hotels and public places are injecting content into websites. And so for me HTTPS is a way of signing my content.
If you put a real web application on that server, enable all the bells and whistles (keep-alive, session cache, OCSP stapling, SPDY, etc), and configure your benchmark tool to make use of those features, the performance penalty of HTTPS becomes less than 5%.
And that was a couple of years ago on a relatively low-end VPS. Nowadays, the difference is probably even smaller.
Can you suggest a benchmark tool that can be used to give a more realistic figure than `ab`? I know jmeter can do session caching, but I find its interface baffling and I can't find a pre-made configuration.
I recently compared performance of my home ARM server when serving my blog through HTTP and HTTPS:
https://www.tablix.org/~avian/blog/archives/2014/11/cubietru...
By the way, did you use `ab` with the `-k` option when you ran those benchmarks? Testing HTTPS without keep-alive is utterly meaningless, since every browser aggressively reuses HTTPS connections nowadays.
Anyway, to get to your question; it can. Normally you wouldn't notice because you're close-ish to the servers and you have stuff like keep alive and TLS session caching(tickets or ID's) to mitigate the issue.. But under other circumstances such as the server being in the US and you are not in the America's the difference can be significant, particularly if session caching isn't working(or working properly) and of course on first request. You can mitigate this with geographical distributed endpoints but most sites won't bother with this.