TLS handshake time adds measurable latency to every new HTTPS connection — understanding and monitoring this specific component helps you identify and address a sometimes-overlooked performance factor.
Why TLS Handshake Time Matters
Before any actual data transfer, establishing an HTTPS connection requires a TLS handshake — this adds real, measurable latency (particularly for the very first connection to your server, before session resumption/keep-alive benefits apply), directly affecting perceived page load speed.
Measuring TLS Handshake Time
curl -w "Connect: %{time_connect}\nTLS Handshake: %{time_appconnect}\n" -o /dev/null -s https://yourdomain.comtime_appconnect minus time_connect isolates specifically the TLS negotiation time, separate from the underlying TCP connection establishment.
Factors Affecting Handshake Speed
- TLS protocol version (TLS 1.3 has fewer round-trips than TLS 1.2)
- Certificate chain length and OCSP stapling configuration
- Server's cipher suite negotiation efficiency
- Network latency between client and server (physical distance matters)
Ensuring TLS 1.3 Is Enabled
See TLS 1.2 vs TLS 1.3: Understanding and Configuring Modern TLS on Nginx & Apache — TLS 1.3's reduced handshake round-trips (compared to 1.2) provide a direct, measurable performance improvement, one of several reasons to prioritize its adoption.
Verifying OCSP Stapling Is Active
See What Is OCSP Stapling and How to Enable It — without stapling, the client's browser may need to make a separate OCSP request to verify certificate revocation status, adding additional latency beyond the handshake itself.
Checking Certificate Chain Length
See Understanding Certificate Chains and Intermediate Certificates — an unnecessarily long certificate chain (extra intermediate certificates) adds slightly more data to transfer during the handshake; use the shortest valid chain your CA provides.
Enabling TLS Session Resumption
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 10m;
ssl_session_tickets on;Lets returning visitors skip the full handshake process on subsequent connections within the session cache window, significantly speeding up repeat visits.
Using 0-RTT (TLS 1.3 Feature, Use with Awareness)
ssl_early_data on;Allows even faster reconnection for TLS 1.3 clients, though has some security nuances (replay attack considerations for non-idempotent requests) worth understanding before enabling broadly.
Measuring the Real-World Impact
Compare page load metrics before/after TLS optimization changes using both synthetic testing and, ideally, Real User Monitoring (see How to Set Up Real User Monitoring (RUM) for Your Website) to confirm actual improvement for genuine visitors.
Considering Geographic Distribution for Handshake Latency
Since handshake round-trip time is affected by physical network latency, visitors far from your server experience proportionally more handshake-related delay — a CDN (see How to Set Up a CDN in Front of Your VPS) with edge TLS termination close to visitors directly addresses this.
Common Errors
Handshake time seems unexpectedly high despite TLS 1.3 — verify session resumption is actually working (check for cache hits in access logs or specific TLS debugging), and confirm the certificate chain isn't unnecessarily long.
Continue Reading
- TLS 1.2 vs TLS 1.3: Understanding and Configuring Modern TLS on Nginx & Apache
- What Is OCSP Stapling and How to Enable It
- How to Reduce Time to First Byte (TTFB)
Browse more articles in Performance & Monitoring.
