Author: Marco Carlo Changho, Systems and Optimization Engineer, Intel
Contributor: Sabarinath Mukundu Subramanian, Software Engineer, HCL Technologies
NGINX, a versatile open-source web server, reverse proxy, and load balancer, has been synonymous with high-performance websites since its release in 2004.(1) Used by more websites than any other server, NGINX manages traffic, serves web content, and improves the scalability and reliability of web applications by distributing requests and handling secure sockets layer (SSL) termination.
Intel® Quick Assist Technology (Intel® QAT) accelerates cryptography workloads in OpenSSL used in NGINX, by either offloading them to a dedicated hardware accelerator (Intel QAT Hardware) or by using vector instructions (Intel QAT Software). In this blog, the latter is used to measure the NGINX secure handshake TLS performance when establishing secure, encrypted server connections.
With Intel QAT, the Intel Xeon 128-core 6980P processor outperforms the same core count AMD EPYC 9755 and the higher count 192-core 9965 AMD EPYC processor.
How the NGINX TLS Handshake Test Works
One of the metrics used in NGINX performance is connections per second (CPS), CPS measures how many new TLS secure connections a server can create and send back to clients making the requests.
NGINX TLS handshake tests the establishment of a secure connection (HTTPS) between a client, such as a web browser, and an NGINX server. Web server connections-per-second are tested using NGINX in the following steps:
- The sender sends connection requests without asking for a packet.
- Sender/receiver uses key exchange plus certificate authentication.
- No packets are requested by the sender, so only a TLS handshake is completed.
This represents real-world performance by stressing the resources of the server Device Under Test (DUT), namely compute, memory, and I/O.
Figure 1: Testing NGINX performance using CPS between a client and a web server.
Comparative Analysis with AMD EPYC Processors
The 128-core Intel® Xeon® 6980P processor outperforms the 192-core AMD EPYC 9965 by 9% in CPS with 33% fewer cores (see Figure 2). When tested using the same number of cores, the Intel Xeon 6980P delivers 26% higher performance than the 128-core AMD EPYC 9755 (see Figure 2). Normalizing for performance per core, the Intel Xeon 6980P outperforms the AMD EPYC 9965 by 64% (see Figure 2).*
Figure 2: Intel® Xeon® 6 processors with P-cores outperform AMD EPYC processors in CPS performance by 9% despite having 33% fewer cores.
About Intel QuickAssist Hardware Acceleration
Built into 4th and 5th Gen Intel® Xeon® processors and Intel® Xeon® 6 processors, the performance provided by Intel QAT hardware accelerators allows systems to serve content quickly, and connect more clients and users to content with high-performance public key cryptography while reducing the CPU processing requirements.
Each Intel Xeon 6980P processor offers four Intel QAT hardware devices per processor, each can handle up to 16.7K CPS with two processing cores or up to 67K CPS for four Intel QAT hardware devices using 8 cores (using AES128-GCM-SHA256 with ECDHE-X25519-RSA2K). This is approximately 16% of the total performance provided by one Intel Xeon 6980P processor running NGINX with Intel QAT software. For users who only require a certain amount of NGINX cryptography performance, this feature can free other cores to perform other tasks while the connection requests continue to be serviced via the Intel QAT hardware accelerator.
Whether customers choose to utilize QATSW and QAT Hardware, Intel Xeon processors allow customers to serve content quickly and connect more clients and users to content with high-performance public key cryptography.
Learn more about the performance benefits of Intel Xeon 6 processors.
Product and Performance Information
Configurations
1-node, 1S out of 2x Intel(R) Xeon(R) 6980P, 128 cores, 500W TDP, HT On, Turbo Off, Total Memory 1536GB (24x64GB DDR5 6400 MT/s [6400 MT/s]), BIOS 1.1, microcode 0x1000314, 2x Ethernet Controller X550, 2x Ethernet Controller E830-CC for QSFP, 1x 1.7T SAMSUNG MZWLJ1T9HBJR-00007, Ubuntu 24.04 LTS, 6.8.0-50-generic. NGINX Async v0.5.1, OpenSSL 3.1.3, IPP Crypto 2021.8, IPsec-MB v1.4, QAT Driver QAT20.L.1.2.30-00020 and QAT_Engine v1.6.1. Test by Intel as of December 2024.
1-node, 1S out of 2x AMD EPYC 9755 128-Core Processor, 500W TDP, SMT On, Boost Off, Total Memory 1536GB (24x64GB DDR5 6400 MT/s [6000 MT/s]), microcode 0xb002116, 2x Ethernet Controller E810-C for QSFP, 2x Ethernet Controller 10-Gigabit X540-AT2, 1x 1.7T SAMSUNG MZ1L21T9HCLS-00A07, Ubuntu 24.04 LTS, 6.8.0-57-generic. NGINX Webserver TLS1.3 ECDHE-X25519-RSA2K, NGINX Async v0.5.1, OpenSSL 3.1.3. Test by Intel as of December 2024.
1-node, 1S out of 2x AMD EPYC 9965 192-Core Processor, 500W TDP, SMT On, Boost Off, Total Memory 1536GB (24x64GB DDR5 6400 MT/s [6000 MT/s]), microcode 0xb101021, 2x Ethernet Controller E810-C for QSFP, 2x Ethernet Controller 10-Gigabit X540-AT2, 1x 1.7T SAMSUNG MZ1L21T9HCLS-00A07, Ubuntu 24.04 LTS, 6.8.0-57-generic. NGINX Webserver TLS1.3 ECDHE-X25519-RSA2K, NGINX Async v0.5.1, OpenSSL 3.1.3. Test by Intel as of April 2025.
Your results may vary. Intel technologies may require enabled hardware, software, or service activation.
Endnotes:
(1) https://blog.nginx.org/blog/testing-the-performance-of-nginx-and-nginx-plus-web-servers
Notices and Disclaimers
Performance varies by use, configuration, and other factors. Learn more on the Performance Index site.
Performance results are based on testing as of dates shown in configurations and may not reflect all publicly available updates. See backup for configuration details. No product or component can be absolutely secure.
Your costs and results may vary.
Intel technologies may require enabled hardware, software, or service activation.
© Intel Corporation. Intel, the Intel logo, and other Intel marks are trademarks of Intel Corporation or its subsidiaries. Other names and brands may be claimed as the property of others.