February 4 2022

NGINX performance improvement with kernel TLS and SSL_sendfile ()

Move the cryptographic implementation from user space to kernel space.


Transport Layer Security (TLS) is an extremely popular encryption protocol. Implementing TLS in the kernel (kTLS) improves performance by significantly reducing the need for copy operations between user space and the kernel.

The combination of kTLS and sendfile()it means that the data is encrypted directly in kernel space, before being passed to the network stack for transmission. This eliminates the need to copy data into user space to be encrypted by TLS libraries and then back into kernel space for transmission. kTLS also allows TLS processing to be offloaded to hardware, including offloading TLS symmetric cryptographic processing to network devices .

Modern Linux and FreeBSD kernels support TLS offloading into the kernel, and now NGINX Open Source does too! NGINX 1.21.4 introduces support for kTLS when you need static files with SSL_sendfile(), which can greatly improve performance. As described below, both the kernel and OpenSSL must be compiled with kTLS for NGINX to use SSL_sendfile().

In this blog we detail which operating system and versions of OpenSSL support kTLS and show how to build and configure the kernel and NGINX for kTLS. To give you an idea of ​​the performance improvement you can expect from kTLS, we also share specifications and results from our tests on FreeBSD and Ubuntu.

Note: kTLS implementations are quite new and evolving rapidly. This blog describes support for kTLS starting November 2021, but keep an eye out for the announcements on nginx.org and the NGINX blog about changes to the information and instructions provided here.

General requirements

  • Operating System - One of the following:
    • FreeBSD 13.0+. As of November 2021, FreeBSD 13.0+ is the only operating system that supports kTLS in NGINX without a manual build of NGINX to incorporate OpenSSL 3.0.0+. You see Enable NGINX with kTLS on FreeBSD .
    • A Linux distribution based on Linux kernel version 4.17 or later, although we recommend using those based on version 5.2 or later whenever possible. (KTLS support is actually available in version 4.13, but OpenSSL 3.0.0 requires kernel header version 4.17 or later.)
  • OpenSSL - Version 3.0.0 or later
  • NGINX - Version 1.21.4 or later

Performance improvement with kTLS

When serving static files under heavy load conditions, SSL_sendfile()is possible increase throughput to 2 times the user space TLS, but the size of the performance increase depends significantly on various factors (disk performance, system load, etc.). You can also reduce CPU usage if your network adapter supports TLS offload.


NGINX 1.21.4 introduces support for kTLS when serving static files with SSL_sendfile(). Our tests show that performance improves between 8% and 29%, depending on the operating system.


Do you have doubts? Don't know where to start? Contact us!

We have all the answers to your questions to help you make the right choice.

Chat with us

Chat directly with our presales support.


Contact us by phone during office hours 9:30 - 19:30

Contact us online

Open a request directly in the contact area.


Managed Server Srl is a leading Italian player in providing advanced GNU/Linux system solutions oriented towards high performance. With a low-cost and predictable subscription model, we ensure that our customers have access to advanced technologies in hosting, dedicated servers and cloud services. In addition to this, we offer systems consultancy on Linux systems and specialized maintenance in DBMS, IT Security, Cloud and much more. We stand out for our expertise in hosting leading Open Source CMS such as WordPress, WooCommerce, Drupal, Prestashop, Joomla, OpenCart and Magento, supported by a high-level support and consultancy service suitable for Public Administration, SMEs and any size.

Red Hat, Inc. owns the rights to Red Hat®, RHEL®, RedHat Linux®, and CentOS®; AlmaLinux™ is a trademark of AlmaLinux OS Foundation; Rocky Linux® is a registered trademark of the Rocky Linux Foundation; SUSE® is a registered trademark of SUSE LLC; Canonical Ltd. owns the rights to Ubuntu®; Software in the Public Interest, Inc. holds the rights to Debian®; Linus Torvalds holds the rights to Linux®; FreeBSD® is a registered trademark of The FreeBSD Foundation; NetBSD® is a registered trademark of The NetBSD Foundation; OpenBSD® is a registered trademark of Theo de Raadt. Oracle Corporation owns the rights to Oracle®, MySQL®, and MyRocks®; Percona® is a registered trademark of Percona LLC; MariaDB® is a registered trademark of MariaDB Corporation Ab; REDIS® is a registered trademark of Redis Labs Ltd. F5 Networks, Inc. owns the rights to NGINX® and NGINX Plus®; Varnish® is a registered trademark of Varnish Software AB. Adobe Inc. holds the rights to Magento®; PrestaShop® is a registered trademark of PrestaShop SA; OpenCart® is a registered trademark of OpenCart Limited. Automattic Inc. owns the rights to WordPress®, WooCommerce®, and JetPack®; Open Source Matters, Inc. owns the rights to Joomla®; Dries Buytaert holds the rights to Drupal®. Amazon Web Services, Inc. holds the rights to AWS®; Google LLC holds the rights to Google Cloud™ and Chrome™; Microsoft Corporation holds the rights to Microsoft®, Azure®, and Internet Explorer®; Mozilla Foundation owns the rights to Firefox®. Apache® is a registered trademark of The Apache Software Foundation; PHP® is a registered trademark of the PHP Group. CloudFlare® is a registered trademark of Cloudflare, Inc.; NETSCOUT® is a registered trademark of NETSCOUT Systems Inc.; ElasticSearch®, LogStash®, and Kibana® are registered trademarks of Elastic NV Hetzner Online GmbH owns the rights to Hetzner®; OVHcloud is a registered trademark of OVH Groupe SAS; cPanel®, LLC owns the rights to cPanel®; Plesk® is a registered trademark of Plesk International GmbH; Facebook, Inc. owns the rights to Facebook®. This site is not affiliated, sponsored or otherwise associated with any of the entities mentioned above and does not represent any of these entities in any way. All rights to the brands and product names mentioned are the property of their respective copyright holders. Any other trademarks mentioned belong to their registrants. MANAGED SERVER® is a trademark registered at European level by MANAGED SERVER SRL, Via Enzo Ferrari, 9, 62012 Civitanova Marche (MC), Italy.

Back to top