SSL Speed

[Old Forum guest] anonymous
Created: 7 years and 11 months ago
I was pretty curious to know what you have done in order to make https://duckduckgo.com/ so fast. It is one of the fastest SSL sites I have used and I think whatever you are doing would be great to know, because especially in light of the whole firesheep extension, people need to learn to use SSL a lot more, if not always, on their webservers. Any insight would be great! Thanks, great product by the way. I hope you make googles fear.

This forum has been archived

Thank you all for the many comments, questions and suggestions. Particular thanks go to user x.15a2 for constantly monitoring, replying and helping so many users here. To continue these discussions, please head over to the DuckDuckGo subreddit.


yegg
Wow, I'm actually surprised--it seems to vary a lot. I'm not doing anything particular special. No hardware accelerator (yet) and no special servers. 

I'm using nginx, which I think has good performance in general, and I've tweaked various settings on it and FreeBSD to make things work fast. For SSL settings in particular, just these:

      keepalive_timeout  75;
      keepalive_requests 250;

So it keeps the connection. And I try to keep the machine relatively idle so there is plenty of processing available to make the handshake.
posted by yegg Staff7 years and 11 months ago Link
anonymous
How great, you use nginx! I assume you then offload the ssl onto the nginx box and not just pass it through/reverse proxy? I really enjoy that product myself, it is so small and easy to use. What is the load https://duckduckgo.com gets each day? Is that alright for me to ask? I am trying to get a sense of it. Do you also load balance on the backend to a server farm of sorts? Thanks for being so willing to answer questions. :)
posted by [Old Forum guest] • 7 years and 11 months ago Link
yegg
That's right--the main query processing is done on the nginx box, though it does proxy to the scripts via fastcgi processes (through sockets). It's about 80% idle right now, but I've taken things off of it -- it was 50% before doing that. The load balancing I've done is more modular. So different indexes/calls get pulled from different machines. I don't have enough traffic yet to require much more :)
posted by yegg Staff7 years and 11 months ago Link
anonymous
Right on man, I applaud you. You are doing great things. I will continue to promote the glorious duckness! Keep it real bro.
posted by [Old Forum guest] • 7 years and 11 months ago Link