Optimizing TLS for High–Bandwidth Applications in FreeBSD

Transport Layer Security (TLS) is becoming increasingly desirable and necessary in the modern Internet. Unfortunately it also induces heavy penalties on application CPU performance for both the client and server. In this paper we examine the server-side performance implications on CPU computational and data-movement overhead when enabling TLS on Netflix’s OpenConnect Appliance (OCA [1]) network. We then explore enhancements to FreeBSD to reduce the costs that TLS adds when serving high volumes of video traffic. Finally we describe recent changes and future improvements to FreeBSD’s OpenCrypto Framework that can be used to further improve performance.