How to improve TLS/SSL handshake time

You want the time that it takes for your server to respond to any request to output data to be a short as possible. This includes the time it takes for the TLS/SSL handshake to be performed.

If you’ve never heard of the TLS/SSL handshake before and how to improve it, let’s explain. The handshake is a series of steps that a client (think browser, for example) and server take to establish a secure connection. It’s the internet’s way of ensuring that your data doesn’t fall into the wrong hands.

Why do we need to improve the TLS/SSL handshake?

Now, you might wonder, “Why does the speed of the handshake matter?” Imagine your visitors are in a queue waiting for that secret handshake. The longer they wait, the more likely they are to leave.

We’re aiming for a handshake that’s as quick as a street magician’s sleight of hand. The aim should be to have all parts of what determine a speedy website be fast. Not just a couple.

So, before we can look at things we can do to improve the TLS/SSL handshake time, we first need to understand which steps are involved.

Handshake Steps

Let’s break down this cryptographic handshake into its core steps.

Step 1: Initiating the Handshake

It all begins when a client, such as your web browser, attempts to connect securely with a server. The client sends a “ClientHello” message, which includes the TLS version it supports, a list of suggested cipher suites, and a string of random bytes known as the “client random.”

Step 2: Server Response

The server picks up the pace by responding with a “ServerHello” message. This message contains the chosen cipher suite, the server’s SSL certificate, and the “server random”, another string of random bytes.

Step 3: Authentication and Pre-Master Secret

Now, the client verifies the server’s SSL certificate with the issuing Certificate Authority (CA). This is like checking an ID card to ensure it’s valid and hasn’t expired. Once verified, the client creates a “pre-master secret” for the session.

Step 4: Decryption and Master Secret

The server receives the pre-master secret, encrypted with the server’s public key. The server decrypts it with its private key. Both parties then use this pre-master secret to generate a “master secret.”

Step 5: Generating Session Keys

With the master secret in hand, the client and server create session keys. These keys are what they’ll use to encrypt and decrypt the information they exchange during the session.

Step 6: Final Handshake Messages

To finish up, the client sends a “Finished” message encrypted with the session key. The server decrypts this and sends its own “Finished” message. If all goes well, both parties confirm that the handshake was successful.

Steps Conclusion

As we’ve established, the TLS/SSL handshake is a complex dance that ensures secure communication over the internet. It involves the exchange of messages, verification of identities, and the creation of shared secrets and keys.

By following these steps, clients and servers can communicate with the assurance that their conversation is private and their data is secure.

How to Improve the Handshake

Before diving into improvements, let’s measure the current handshake time. Tools like SSL Labs’ SSL Test or Chrome’s DevTools can help, but Scanfully measures it on every performance check as the TLS handshake phase. Open the site’s Performance screen and look at Where a request goes for the average of the period, or at Phases of this check in Latest check. Up to 300 ms counts as fast, above 500 ms as slow. The Certificate screen shows the TLS version and cipher suite your server uses.

Choose the Right Cipher Suite

Cipher suites are like the ingredients in a secret sauce. Some are zesty and quick; others are like a slow-cooked stew. Opt for cipher suites that support forward secrecy and are faster to compute, such as those using ECDHE (Elliptic Curve Diffie-Hellman Ephemeral).

Reduce the Number of Handshakes

Reusing an established handshake can cut down wait times. It’s like having a VIP pass at a concert. Implement session resumption protocols like Session IDs or TLS tickets to reuse secure connections.

Utilize OCSP Stapling

Online Certificate Status Protocol (OCSP) stapling is like getting your ID checked before you hit the club. By attaching the OCSP response to the handshake, you save a roundtrip to the CA, keeping the line moving smoothly.

Implement HTTP/2

HTTP/2 is like upgrading from a bicycle to a motorcycle. It’s not just about the handshake, but the overall performance. HTTP/2 reduces latency and allows multiplexing, making your website zip along.

Optimize Your Certificates

Heavy certificates are like bulky wallets; they slow you down. Trim down the fat by removing unnecessary intermediate certificates and keeping certificate chains short and sweet.

DNS Optimization

DNS resolution is like asking for directions. If it takes too long, you’re late to the party. Employ DNS caching and consider using a DNS service that offers quick response times.

Server Location Matters

The physical distance between your server and the client can feel like a long-distance relationship. It’s all about reducing latency, so consider a Content Delivery Network (CDN) to bring your content closer to your users.

Final Optimization Tips

Most of the above solutions to improve the performance of your TLS/SSL Handshake are solved by adding Cloudflare in front of your website. You’ll still need to configure Cloudflare properly, of course. As well the basics like keeping your server software up to date and monitoring your performance regularly.

It’s like tuning your car before a race; you want to be in top shape before you hit the track, and that means everything needs to be prepared for speed. Your brakes, your tires, your engine, your suspension, your fuel are just the basics for a fast race car.

It’s always every single component.

Conclusion

By now, you should be well-equipped to turbocharge your TLS/SSL handshake. Remember, the goal is to make your website’s handshake faster than a New York minute.

Execute on all the above mentioned tips, and watch as your website become ever so slightly faster. Keep measuring, keep optimizing, and always aim for that seamless, speedy user experience.