Nginx Centmin Mod Nginx HTTP/2 HTTPS TLS Library Benchmarks - OpenSSL vs LibreSSL vs BoringSSL

Centmin Mod Nginx server by default uses OpenSSL 1.1.1 for its TLS library for HTTPS. However, Centmin Mod Nginx also optionally supports other TLS libraries for OpenSSL 3.0, LibreSSL and BoringSSL. It's been a while since I've benchmarked all the options, so I decided to use my newest favourite load testing tool, k6 to benchmark them quickly. The results are pretty close using k6 benchmarking tools, but OpenSSL 1.1.1 does win still with BoringSSL in second place

Centmin Mod 130.00beta01's Nginx default OpenSSL 1.1.1

Code (Text):

nginx -V
nginx version: nginx/1.23.2 (301022-065714-centos7-ed582fb-br-6e975bc)
built by gcc 11.2.1 20220127 (Red Hat 11.2.1-9) (GCC)
built with OpenSSL 1.1.1q  5 Jul 2022
TLS SNI support enabled

With OpenSSL 3.0.5

Code (Text):

nginx -V
nginx version: nginx/1.23.2 (301022-055900-centos7-ed582fb-br-6e975bc)
built by gcc 11.2.1 20220127 (Red Hat 11.2.1-9) (GCC)
built with OpenSSL 3.0.5 5 Jul 2022
TLS SNI support enabled

and BoringSSL

Code (Text):

nginx -V
nginx version: nginx/1.23.2 (301022-065301-centos7-ed582fb-br-6e975bc)
built by gcc 11.2.1 20220127 (Red Hat 11.2.1-9) (GCC)
built with OpenSSL 1.1.1 (compatible; BoringSSL) (running with BoringSSL)
TLS SNI support enabled

LibreSSL 3.5.3

Code (Text):

nginx -V
nginx version: nginx/1.23.2 (301022-061258-centos7-ed582fb-br-6e975bc)
built by gcc 11.2.1 20220127 (Red Hat 11.2.1-9) (GCC)
built with LibreSSL 3.5.3
TLS SNI support enabled

LibreSSL only 3.6.0 has experimental BoringSSL QUIC API support added

Code (Text):

nginx -V
nginx version: nginx/1.23.2 (301022-081947-centos7-ed582fb-br-6e975bc)
built by gcc 11.2.1 20220127 (Red Hat 11.2.1-9) (GCC)
built with LibreSSL 3.6.0
TLS SNI support enabled

k6 benchmarks were done with HTTP/2 with Centmin Mod Nginx using ECDSA 256bit SSL certificates which from past benchmarks show BoringSSL did have a slight lead for ECDSA SSL ciphers.

Average requests/sec vs average response times (ms)



Average requests/sec vs max response times (ms)

---

 

Yeah just and for these k6 benchmarks But unlike OpenSSL 1.1.1, BoringSSL doesn't support OCSP stapling nor does it support dual RSA 2048bit + ECDSA 256bit SSL certificates.